diff --git a/.backportrc.json b/.backportrc.json
index 8f458343c51af..3f1d639e9a480 100644
--- a/.backportrc.json
+++ b/.backportrc.json
@@ -3,6 +3,7 @@
   "targetBranchChoices": [
     { "name": "master", "checked": true },
     { "name": "7.x", "checked": true },
+    "7.9",
     "7.8",
     "7.7",
     "7.6",
@@ -26,7 +27,7 @@
   "targetPRLabels": ["backport"],
   "branchLabelMapping": {
     "^v8.0.0$": "master",
-    "^v7.9.0$": "7.x",
+    "^v7.10.0$": "7.x",
     "^v(\\d+).(\\d+).\\d+$": "$1.$2"
   }
 }
diff --git a/.browserslistrc b/.browserslistrc
index 89114f393c462..04395b913c9c5 100644
--- a/.browserslistrc
+++ b/.browserslistrc
@@ -1,7 +1,9 @@
 [production]
-last 2 versions
-> 5%
-Safari 7 # for PhantomJS support: https://github.com/elastic/kibana/issues/27136
+last 2 Firefox versions
+last 2 Chrome versions
+last 2 Safari versions
+> 0.25%
+not ie 11
 
 [dev]
 last 1 chrome versions
diff --git a/.ci/Jenkinsfile_baseline_capture b/.ci/Jenkinsfile_baseline_capture
index 7c7cc8d98c306..3f90a6bc05af0 100644
--- a/.ci/Jenkinsfile_baseline_capture
+++ b/.ci/Jenkinsfile_baseline_capture
@@ -8,12 +8,12 @@ kibanaPipeline(timeoutMinutes: 120) {
     catchError {
       parallel([
         'oss-visualRegression': {
-          workers.ci(name: 'oss-visualRegression', size: 's', ramDisk: false) {
+          workers.ci(name: 'oss-visualRegression', size: 's-highmem', ramDisk: true) {
             kibanaPipeline.functionalTestProcess('oss-visualRegression', './test/scripts/jenkins_visual_regression.sh')(1)
           }
         },
         'xpack-visualRegression': {
-          workers.ci(name: 'xpack-visualRegression', size: 's', ramDisk: false) {
+          workers.ci(name: 'xpack-visualRegression', size: 's-highmem', ramDisk: true) {
             kibanaPipeline.functionalTestProcess('xpack-visualRegression', './test/scripts/jenkins_xpack_visual_regression.sh')(1)
           }
         },
diff --git a/.ci/Jenkinsfile_coverage b/.ci/Jenkinsfile_coverage
index 3986367d660a1..ebb9c3dc86dd2 100644
--- a/.ci/Jenkinsfile_coverage
+++ b/.ci/Jenkinsfile_coverage
@@ -13,6 +13,7 @@ kibanaPipeline(timeoutMinutes: 240) {
       workers.base(name: 'coverage-worker', size: 'l', ramDisk: false, bootstrapped: false) {
         catchError {
           kibanaCoverage.runTests()
+          kibanaTeamAssign.load('team_assignment', "### Upload Team Assignment JSON")
           handleIngestion(TIME_STAMP)
         }
         handleFail()
diff --git a/.ci/pipeline-library/src/test/prChanges.groovy b/.ci/pipeline-library/src/test/prChanges.groovy
index 0fb750d6ff64e..f149340517ff0 100644
--- a/.ci/pipeline-library/src/test/prChanges.groovy
+++ b/.ci/pipeline-library/src/test/prChanges.groovy
@@ -84,4 +84,17 @@ class PrChangesTest extends KibanaBasePipelineTest {
 
     assertFalse(prChanges.areChangesSkippable())
   }
+
+  @Test
+  void 'areChangesSkippable() with skippable changes that are in notSkippablePaths'() {
+    props([
+      githubPrs: [
+        getChanges: { [
+          [filename: 'docs/developer/architecture/code-exploration.asciidoc'],
+        ] },
+      ],
+    ])
+
+    assertFalse(prChanges.areChangesSkippable())
+  }
 }
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index f053c6da9c29b..2ad82ded6cb38 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -24,29 +24,20 @@
 /src/plugins/vis_type_xy/ @elastic/kibana-app
 /src/plugins/visualize/ @elastic/kibana-app
 
-# Core UI
-# Exclude tutorials folder for now because they are not owned by Kibana app and most will move out soon
-/src/plugins/home/public @elastic/kibana-core-ui
-/src/plugins/home/server/*.ts @elastic/kibana-core-ui
-/src/plugins/home/server/services/ @elastic/kibana-core-ui
-# Exclude tutorial resources folder for now because they are not owned by Kibana app and most will move out soon
-/src/legacy/core_plugins/kibana/public/home/*.ts @elastic/kibana-core-ui
-/src/legacy/core_plugins/kibana/public/home/*.scss @elastic/kibana-core-ui
-/src/legacy/core_plugins/kibana/public/home/np_ready/ @elastic/kibana-core-ui
-
 # App Architecture
+/examples/bfetch_explorer/ @elastic/kibana-app-arch
+/examples/dashboard_embeddable_examples/ @elastic/kibana-app-arch
+/examples/demo_search/ @elastic/kibana-app-arch
 /examples/developer_examples/ @elastic/kibana-app-arch
+/examples/embeddable_examples/ @elastic/kibana-app-arch
+/examples/embeddable_explorer/ @elastic/kibana-app-arch
+/examples/state_container_examples/ @elastic/kibana-app-arch
+/examples/ui_actions_examples/ @elastic/kibana-app-arch
+/examples/ui_actions_explorer/ @elastic/kibana-app-arch
 /examples/url_generators_examples/ @elastic/kibana-app-arch
 /examples/url_generators_explorer/ @elastic/kibana-app-arch
-/packages/kbn-interpreter/ @elastic/kibana-app-arch
 /packages/elastic-datemath/ @elastic/kibana-app-arch
-/src/legacy/core_plugins/embeddable_api/ @elastic/kibana-app-arch
-/src/legacy/core_plugins/interpreter/ @elastic/kibana-app-arch
-/src/legacy/core_plugins/kibana_react/ @elastic/kibana-app-arch
-/src/legacy/core_plugins/kibana/public/management/ @elastic/kibana-app-arch
-/src/legacy/core_plugins/kibana/server/routes/api/management/ @elastic/kibana-app-arch
-/src/legacy/core_plugins/visualizations/ @elastic/kibana-app-arch
-/src/legacy/server/index_patterns/ @elastic/kibana-app-arch
+/packages/kbn-interpreter/ @elastic/kibana-app-arch
 /src/plugins/advanced_settings/ @elastic/kibana-app-arch
 /src/plugins/bfetch/ @elastic/kibana-app-arch
 /src/plugins/data/ @elastic/kibana-app-arch
@@ -61,9 +52,10 @@
 /src/plugins/share/ @elastic/kibana-app-arch
 /src/plugins/ui_actions/ @elastic/kibana-app-arch
 /src/plugins/visualizations/ @elastic/kibana-app-arch
-/x-pack/plugins/advanced_ui_actions/ @elastic/kibana-app-arch
+/x-pack/examples/ui_actions_enhanced_examples/ @elastic/kibana-app-arch
 /x-pack/plugins/data_enhanced/ @elastic/kibana-app-arch
-/x-pack/plugins/drilldowns/ @elastic/kibana-app-arch
+/x-pack/plugins/embeddable_enhanced/ @elastic/kibana-app-arch
+/x-pack/plugins/ui_actions_enhanced/ @elastic/kibana-app-arch
 
 # APM
 /x-pack/plugins/apm/  @elastic/apm-ui
@@ -79,6 +71,16 @@
 /x-pack/plugins/canvas/  @elastic/kibana-canvas
 /x-pack/test/functional/apps/canvas/  @elastic/kibana-canvas
 
+# Core UI
+# Exclude tutorials folder for now because they are not owned by Kibana app and most will move out soon
+/src/plugins/home/public @elastic/kibana-core-ui
+/src/plugins/home/server/*.ts @elastic/kibana-core-ui
+/src/plugins/home/server/services/ @elastic/kibana-core-ui
+# Exclude tutorial resources folder for now because they are not owned by Kibana app and most will move out soon
+/src/legacy/core_plugins/kibana/public/home/*.ts @elastic/kibana-core-ui
+/src/legacy/core_plugins/kibana/public/home/*.scss @elastic/kibana-core-ui
+/src/legacy/core_plugins/kibana/public/home/np_ready/ @elastic/kibana-core-ui
+
 # Observability UIs
 /x-pack/legacy/plugins/infra/ @elastic/logs-metrics-ui
 /x-pack/plugins/infra/ @elastic/logs-metrics-ui
diff --git a/NOTICE.txt b/NOTICE.txt
index 56280e6e3883e..e1552852d0349 100644
--- a/NOTICE.txt
+++ b/NOTICE.txt
@@ -26,9 +26,6 @@ This module was heavily inspired by the externals plugin that ships with webpack
 MIT License http://www.opensource.org/licenses/mit-license.php
 Author Tobias Koppers @sokra
 
----
-This product has relied on ASTExplorer that is licensed under MIT.
-
 ---
 This product includes code that is based on Ace editor, which was available
 under a "BSD" license.
diff --git a/docs/developer/advanced/development-basepath.asciidoc b/docs/developer/advanced/development-basepath.asciidoc
index f0b760a21ea0c..cb341b9591174 100644
--- a/docs/developer/advanced/development-basepath.asciidoc
+++ b/docs/developer/advanced/development-basepath.asciidoc
@@ -1,5 +1,5 @@
 [[development-basepath]]
-=== Considerations for basepath
+== Considerations for basepath
 
 In dev mode, {kib} by default runs behind a proxy which adds a random path component to its URL.
 
diff --git a/docs/developer/advanced/development-es-snapshots.asciidoc b/docs/developer/advanced/development-es-snapshots.asciidoc
index 92fae7a241edf..4c801bf750979 100644
--- a/docs/developer/advanced/development-es-snapshots.asciidoc
+++ b/docs/developer/advanced/development-es-snapshots.asciidoc
@@ -1,32 +1,32 @@
 [[development-es-snapshots]]
-=== Daily Elasticsearch Snapshots
+== Daily {es} Snapshots
 
-For local development and CI, {kib}, by default, uses Elasticsearch snapshots that are built daily when running tasks that require Elasticsearch (e.g. functional tests).
+For local development and CI, {kib}, by default, uses {es} snapshots that are built daily when running tasks that require {es} (e.g. functional tests).
 
-A snapshot is just a group of tarballs, one for each supported distribution/architecture/os of Elasticsearch, and a JSON-based manifest file containing metadata about the distributions.
+A snapshot is just a group of tarballs, one for each supported distribution/architecture/os of {es}, and a JSON-based manifest file containing metadata about the distributions.
 
-https://ci.kibana.dev/es-snapshots[A dashboard] is available that shows the current status and compatibility of the latest Elasticsearch snapshots.
+https://ci.kibana.dev/es-snapshots[A dashboard] is available that shows the current status and compatibility of the latest {es} snapshots.
 
-==== Process Overview
+=== Process Overview
 
-1. Elasticsearch snapshots are built for each current tracked branch of {kib}.
+1. {es} snapshots are built for each current tracked branch of {kib}.
 2. Each snapshot is uploaded to a public Google Cloud Storage bucket, `kibana-ci-es-snapshots-daily`.
 ** At this point, the snapshot is not automatically used in CI or local development. It needs to be tested/verified first.
 3. Each snapshot is tested with the latest commit of the corresponding {kib} branch, using the full CI suite.
 4. After CI
 ** If the snapshot passes, it is promoted and automatically used in CI and local development.
-** If the snapshot fails, the issue must be investigated and resolved. A new incompatibility may exist between Elasticsearch and {kib}.
+** If the snapshot fails, the issue must be investigated and resolved. A new incompatibility may exist between {es} and {kib}.
 
-==== Using the latest snapshot
+=== Using the latest snapshot
 
-When developing locally, you may wish to use the most recent Elasticsearch snapshot, even if it's failing CI. To do so, prefix your commands with the follow environment variable:
+When developing locally, you may wish to use the most recent {es} snapshot, even if it's failing CI. To do so, prefix your commands with the follow environment variable:
 
 ["source","bash"]
 -----------
 KBN_ES_SNAPSHOT_USE_UNVERIFIED=true
 -----------
 
-You can use this flag with any command that downloads and runs Elasticsearch snapshots, such as `scripts/es` or the FTR.
+You can use this flag with any command that downloads and runs {es} snapshots, such as `scripts/es` or the FTR.
 
 For example, to run functional tests with the latest snapshot:
 
@@ -35,7 +35,7 @@ For example, to run functional tests with the latest snapshot:
 KBN_ES_SNAPSHOT_USE_UNVERIFIED=true node scripts/functional_tests_server
 -----------
 
-===== For Pull Requests
+==== For Pull Requests
 
 Currently, there is not a way to run your pull request with the latest unverified snapshot without a code change. You can, however, do it with a small code change.
 
@@ -45,9 +45,9 @@ Currently, there is not a way to run your pull request with the latest unverifie
 
 Your pull request should then use the latest snapshot the next time that it runs. Just don't merge the change to `Jenkinsfile`!
 
-==== Google Cloud Storage buckets
+=== Google Cloud Storage buckets
 
-===== kibana-ci-es-snapshots-daily
+==== kibana-ci-es-snapshots-daily
 
 This bucket stores snapshots that are created on a daily basis, and is the primary location used by `kbn-es` to download snapshots.
 
@@ -61,7 +61,7 @@ The file structure for this bucket looks like this:
 * `<version>/archives/<unique id>/*.tar.gz.sha512`
 * `<version>/archives/<unique id>/manifest.json`
 
-===== kibana-ci-es-snapshots-permanent
+==== kibana-ci-es-snapshots-permanent
 
 This bucket stores only the most recently promoted snapshot for each version. Old snapshots are only deleted when new ones are uploaded.
 
@@ -73,18 +73,18 @@ The file structure for this bucket looks like this:
 * `<version>/*.tar.gz.sha512`
 * `<version>/manifest.json`
 
-==== How snapshots are built, tested, and promoted
+=== How snapshots are built, tested, and promoted
 
-Each day, a https://kibana-ci.elastic.co/job/elasticsearch+snapshots+trigger/[Jenkins job] runs that triggers Elasticsearch builds for each currently tracked branch/version. This job is automatically updated with the correct branches whenever we release new versions of {kib}.
+Each day, a https://kibana-ci.elastic.co/job/elasticsearch+snapshots+trigger/[Jenkins job] runs that triggers {es} builds for each currently tracked branch/version. This job is automatically updated with the correct branches whenever we release new versions of {kib}.
 
-===== Build
+==== Build
 
-https://kibana-ci.elastic.co/job/elasticsearch+snapshots+build/[This Jenkins job] builds the Elasticsearch snapshots and uploads them to GCS.
+https://kibana-ci.elastic.co/job/elasticsearch+snapshots+build/[This Jenkins job] builds the {es} snapshots and uploads them to GCS.
 
 The Jenkins job pipeline definition is https://github.com/elastic/kibana/blob/master/.ci/es-snapshots/Jenkinsfile_build_es[in the {kib} repo].
 
-1. Checkout Elasticsearch repo for the given branch/version.
-2. Run `./gradlew -p distribution/archives assemble --parallel` to create all of the Elasticsearch distributions.
+1. Checkout {es} repo for the given branch/version.
+2. Run `./gradlew -p distribution/archives assemble --parallel` to create all of the {es} distributions.
 3. Create a tarball for each distribution.
 4. Create a manifest JSON file containing info about the distribution, as well as its download URL.
 5. Upload the tarballs and manifest to a unique location in the GCS bucket `kibana-ci-es-snapshots-daily`.
@@ -93,9 +93,9 @@ The Jenkins job pipeline definition is https://github.com/elastic/kibana/blob/ma
 ** This allows the `KBN_ES_SNAPSHOT_USE_UNVERIFIED` flag to work.
 7. Trigger the verification job, to run the full {kib} CI test suite with this snapshot.
 
-===== Verification and Promotion
+==== Verification and Promotion
 
-https://kibana-ci.elastic.co/job/elasticsearch+snapshots+verify/[This Jenkins job] tests the latest Elasticsearch snapshot with the full {kib} CI pipeline, and promotes if it there are no test failures.
+https://kibana-ci.elastic.co/job/elasticsearch+snapshots+verify/[This Jenkins job] tests the latest {es} snapshot with the full {kib} CI pipeline, and promotes if it there are no test failures.
 
 The Jenkins job pipeline definition is https://github.com/elastic/kibana/blob/master/.ci/es-snapshots/Jenkinsfile_verify_es[in the {kib} repo].
 
diff --git a/docs/developer/advanced/index.asciidoc b/docs/developer/advanced/index.asciidoc
index 139940ee42fe2..5c53bedd95e72 100644
--- a/docs/developer/advanced/index.asciidoc
+++ b/docs/developer/advanced/index.asciidoc
@@ -5,8 +5,8 @@
 * <<development-es-snapshots>>
 * <<development-basepath>>
 
-include::development-es-snapshots.asciidoc[]
+include::development-es-snapshots.asciidoc[leveloffset=+1]
 
-include::running-elasticsearch.asciidoc[]
+include::running-elasticsearch.asciidoc[leveloffset=+1]
 
-include::development-basepath.asciidoc[]
\ No newline at end of file
+include::development-basepath.asciidoc[leveloffset=+1]
\ No newline at end of file
diff --git a/docs/developer/advanced/running-elasticsearch.asciidoc b/docs/developer/advanced/running-elasticsearch.asciidoc
index b03c231678eee..2361f805c7635 100644
--- a/docs/developer/advanced/running-elasticsearch.asciidoc
+++ b/docs/developer/advanced/running-elasticsearch.asciidoc
@@ -1,13 +1,13 @@
 [[running-elasticsearch]]
-=== Running elasticsearch during development
+== Running {es} during development
 
-There are many ways to run Elasticsearch while you are developing.
+There are many ways to run {es} while you are developing.
 
-[float]
+[discrete]
 
-==== By snapshot
+=== By snapshot
 
-This will run a snapshot of elasticsearch that is usually built nightly. Read more about <<development-es-snapshots>>.
+This will run a snapshot of {es} that is usually built nightly. Read more about <<development-es-snapshots>>.
 
 [source,bash]
 ----
@@ -25,36 +25,36 @@ yarn es snapshot --help
 
 **Keeping data between snapshots**
 
-If you want to keep the data inside your Elasticsearch between usages of this command, you should use the following command, to keep your data folder outside the downloaded snapshot folder:
+If you want to keep the data inside your {es} between usages of this command, you should use the following command, to keep your data folder outside the downloaded snapshot folder:
 
 [source,bash]
 ----
 yarn es snapshot -E path.data=../data
 ----
 
-==== By source
+=== By source
 
-If you have the Elasticsearch repo checked out locally and wish to run against that, use `source`. By default, it will reference an elasticsearch checkout which is a sibling to the {kib} directory named elasticsearch. If you wish to use a checkout in another location you can provide that by supplying --source-path 
+If you have the {es} repo checked out locally and wish to run against that, use `source`. By default, it will reference an {es} checkout which is a sibling to the {kib} directory named elasticsearch. If you wish to use a checkout in another location you can provide that by supplying --source-path 
 
 [source,bash]
 ----
 yarn es source
 ----
 
-==== From an archive
+=== From an archive
 
-Use this if you already have a distributable. For released versions, one can be obtained on the Elasticsearch downloads page.
+Use this if you already have a distributable. For released versions, one can be obtained on the {es} downloads page.
 
 [source,bash]
 ----
 yarn es archive <full_path_to_archive>
 ----
 
-Each of these will run Elasticsearch with a basic license. Additional options are available, pass --help for more information.
+Each of these will run {es} with a basic license. Additional options are available, pass --help for more information.
 
-==== From a remote host
+=== From a remote host
 
-You can save some system resources, and the effort of generating sample data, if you have a remote Elasticsearch cluster to connect to. (Elasticians: you do! Check with your team about where to find credentials)
+You can save some system resources, and the effort of generating sample data, if you have a remote {es} cluster to connect to. (Elasticians: you do! Check with your team about where to find credentials)
 
 You'll need to create a kibana.dev.yml (<<customize-kibana-yml>>) and add the following to it:
 
@@ -75,7 +75,7 @@ kibana.index: '.{YourGitHubHandle}-kibana'
 xpack.task_manager.index: '.{YourGitHubHandle}-task-manager-kibana'
 ----
 
-===== Running remote clusters
+==== Running remote clusters
 
 Setup remote clusters for cross cluster search (CCS) and cross cluster replication (CCR).
 
@@ -95,7 +95,7 @@ yarn es snapshot -E transport.port=9500 -E http.port=9201 -E path.data=../data_p
 
 Once both clusters are running, start {kib}. {kib} will connect to the primary cluster.
 
-Setup the remote cluster in {kib} from either Management -> Elasticsearch -> Remote Clusters UI or by running the following script in Console.
+Setup the remote cluster in {kib} from either Management -> {es} -> Remote Clusters UI or by running the following script in Console.
 
 [source,bash]
 ----
diff --git a/docs/developer/architecture/add-data-tutorials.asciidoc b/docs/developer/architecture/add-data-tutorials.asciidoc
index e16b1bc039a10..3891b87a00e64 100644
--- a/docs/developer/architecture/add-data-tutorials.asciidoc
+++ b/docs/developer/architecture/add-data-tutorials.asciidoc
@@ -1,16 +1,16 @@
 [[add-data-tutorials]]
-=== Add data tutorials
+== Add data tutorials
 
 `Add Data` in the {kib} Home application contains tutorials for setting up data flows in the Elastic stack.
 
 Each tutorial contains three sets of instructions:
 
-* `On Premise.` Set up a data flow when both {kib} and Elasticsearch are running on premise.
-* `On Premise Elastic Cloud.` Set up a data flow when {kib} is running on premise and Elasticsearch is running on Elastic Cloud.
-* `Elastic Cloud.` Set up a data flow when both {kib} and Elasticsearch are running on Elastic Cloud.
+* `On Premise.` Set up a data flow when both {kib} and {es} are running on premise.
+* `On Premise Elastic Cloud.` Set up a data flow when {kib} is running on premise and {es} is running on Elastic Cloud.
+* `Elastic Cloud.` Set up a data flow when both {kib} and {es} are running on Elastic Cloud.
 
-[float]
-==== Creating a new tutorial
+[discrete]
+=== Creating a new tutorial
 1. Create a new directory in the link:https://github.com/elastic/kibana/tree/master/src/plugins/home/server/tutorials[tutorials directory].
 2. In the new directory, create a file called `index.ts` that exports a function.
 The function must return a function object that conforms to the `TutorialSchema` interface link:{kib-repo}tree/{branch}/src/plugins/home/server/services/tutorials/lib/tutorial_schema.ts[tutorial schema].
@@ -23,15 +23,15 @@ The function must return a function object that conforms to the `TutorialSchema`
 If you are creating a new plugin and the tutorial is only related to that plugin, you can also place the `TutorialSchema` object into your plugin folder. Add `home` to the `requiredPlugins` list in your `kibana.json` file.
 Then register the tutorial object by calling `home.tutorials.registerTutorial(tutorialObject)` in the `setup` lifecycle of your server plugin.
 
-[float]
-===== Variables
+[discrete]
+==== Variables
 String values can contain variables that are substituted when rendered. Variables are specified by `{}`.
 For example: `{config.docs.version}` is rendered as `6.2` when running the tutorial in {kib} 6.2.
 
 link:{kib-repo}tree/{branch}/src/legacy/core_plugins/kibana/public/home/np_ready/components/tutorial/replace_template_strings.js#L23[Provided variables]
 
-[float]
-===== Markdown
+[discrete]
+==== Markdown
 String values can contain limited Markdown syntax.
 
 link:{kib-repo}tree/{branch}/src/legacy/core_plugins/kibana/public/home/components/tutorial/content.js#L8[Enabled Markdown grammars]
diff --git a/docs/developer/architecture/code-exploration.asciidoc b/docs/developer/architecture/code-exploration.asciidoc
new file mode 100644
index 0000000000000..2f67ae002c916
--- /dev/null
+++ b/docs/developer/architecture/code-exploration.asciidoc
@@ -0,0 +1,589 @@
+////
+
+NOTE:
+  This is an automatically generated file. Please do not edit directly. Instead, run the
+  following from within the kibana repository:
+
+    node scripts/build_plugin_list_docs
+
+  You can update the template within packages/kbn-dev-utils/target/plugin_list/generate_plugin_list.js
+
+////
+
+[[code-exploration]]
+== Exploring Kibana code
+
+The goals of our folder heirarchy are:
+
+- Easy for developers to know where to add new services, plugins and applications.
+- Easy for developers to know where to find the code from services, plugins and applications.
+- Easy to browse and understand our folder structure.
+
+To that aim, we strive to:
+
+- Avoid too many files in any given folder.
+- Choose clear, unambigious folder names.
+- Organize by domain.
+- Every folder should contain a README that describes the contents of that folder.
+
+[discrete]
+[[kibana-services-applications]]
+=== Services and Applications
+
+[discrete]
+==== src/plugins
+
+- {kib-repo}blob/{branch}/src/plugins/advanced_settings[advancedSettings]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/src/plugins/apm_oss[apmOss]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/src/plugins/bfetch/README.md[bfetch]
+
+bfetch allows to batch HTTP requests and streams responses back.
+
+
+- {kib-repo}blob/{branch}/src/plugins/charts/README.md[charts]
+
+The Charts plugin is a way to create easier integration of shared colors, themes, types and other utilities across all Kibana charts and visualizations.
+
+
+- {kib-repo}blob/{branch}/src/plugins/console[console]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/src/plugins/dashboard[dashboard]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/src/plugins/data/README.md[data]
+
+data plugin provides common data access services.
+
+
+- {kib-repo}blob/{branch}/src/plugins/dev_tools/README.md[devTools]
+
+The ui/registry/dev_tools is removed in favor of the devTools plugin which exposes a register method in the setup contract.
+Registering app works mostly the same as registering apps in core.application.register.
+Routing will be handled by the id of the dev tool - your dev tool will be mounted when the URL matches /app/dev_tools#/<YOUR ID>.
+This API doesn't support angular, for registering angular dev tools, bootstrap a local module on mount into the given HTML element.
+
+
+- {kib-repo}blob/{branch}/src/plugins/discover[discover]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/src/plugins/embeddable/README.md[embeddable]
+
+Embeddables are re-usable widgets that can be rendered in any environment or plugin. Developers can embed them directly in their plugin. End users can dynamically add them to any embeddable containers.
+
+
+- {kib-repo}blob/{branch}/src/plugins/es_ui_shared[esUiShared]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/src/plugins/expressions/README.md[expressions]
+
+This plugin provides methods which will parse & execute an expression pipeline
+string for you, as well as a series of registries for advanced users who might
+want to incorporate their own functions, types, and renderers into the service
+for use in their own application.
+
+
+- {kib-repo}blob/{branch}/src/plugins/home/README.md[home]
+
+Moves the legacy ui/registry/feature_catalogue module for registering "features" that should be shown in the home page's feature catalogue to a service within a "home" plugin. The feature catalogue refered to here should not be confused with the "feature" plugin for registering features used to derive UI capabilities for feature controls.
+
+
+- {kib-repo}blob/{branch}/src/plugins/index_pattern_management[indexPatternManagement]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/src/plugins/input_control_vis[inputControlVis]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/src/plugins/inspector/README.md[inspector]
+
+The inspector is a contextual tool to gain insights into different elements
+in Kibana, e.g. visualizations. It has the form of a flyout panel.
+
+
+- {kib-repo}blob/{branch}/src/plugins/kibana_legacy/README.md[kibanaLegacy]
+
+This plugin will contain several helpers and services to integrate pieces of the legacy Kibana app with the new Kibana platform.
+
+
+- {kib-repo}blob/{branch}/src/plugins/kibana_react/README.md[kibanaReact]
+
+Tools for building React applications in Kibana.
+
+
+- {kib-repo}blob/{branch}/src/plugins/kibana_usage_collection/README.md[kibanaUsageCollection]
+
+This plugin registers the basic usage collectors from Kibana:
+
+
+- {kib-repo}blob/{branch}/src/plugins/kibana_utils/README.md[kibanaUtils]
+
+Utilities for building Kibana plugins.
+
+
+- {kib-repo}blob/{branch}/src/plugins/legacy_export[legacyExport]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/src/plugins/management[management]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/src/plugins/maps_legacy[mapsLegacy]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/src/plugins/navigation/README.md[navigation]
+
+The navigation plugins exports the TopNavMenu component.
+It also provides a stateful version of it on the start contract.
+
+
+- {kib-repo}blob/{branch}/src/plugins/newsfeed[newsfeed]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/src/plugins/region_map[regionMap]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/src/plugins/saved_objects[savedObjects]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/src/plugins/saved_objects_management[savedObjectsManagement]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/src/plugins/share/README.md[share]
+
+Replaces the legacy ui/share module for registering share context menus.
+
+
+- {kib-repo}blob/{branch}/src/plugins/status_page[statusPage]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/src/plugins/telemetry/README.md[telemetry]
+
+Telemetry allows Kibana features to have usage tracked in the wild. The general term "telemetry" refers to multiple things:
+
+
+- {kib-repo}blob/{branch}/src/plugins/telemetry_collection_manager/README.md[telemetryCollectionManager]
+
+Telemetry's collection manager to go through all the telemetry sources when fetching it before reporting.
+
+
+- {kib-repo}blob/{branch}/src/plugins/telemetry_management_section/README.md[telemetryManagementSection]
+
+This plugin adds the Advanced Settings section for the Usage Data collection (aka Telemetry).
+
+
+- {kib-repo}blob/{branch}/src/plugins/tile_map[tileMap]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/src/plugins/timelion[timelion]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/src/plugins/ui_actions/README.md[uiActions]
+
+An API for:
+
+
+- {kib-repo}blob/{branch}/src/plugins/usage_collection/README.md[usageCollection]
+
+Usage Collection allows collecting usage data for other services to consume (telemetry and monitoring).
+To integrate with the telemetry services for usage collection of your feature, there are 2 steps:
+
+
+- {kib-repo}blob/{branch}/src/plugins/vis_type_markdown[visTypeMarkdown]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/src/plugins/vis_type_metric[visTypeMetric]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/src/plugins/vis_type_table[visTypeTable]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/src/plugins/vis_type_tagcloud[visTypeTagcloud]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/src/plugins/vis_type_timelion/README.md[visTypeTimelion]
+
+If your grammar was changed in public/chain.peg you need to re-generate the static parser. You could use a grunt task:
+
+
+- {kib-repo}blob/{branch}/src/plugins/vis_type_timeseries[visTypeTimeseries]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/src/plugins/vis_type_vega[visTypeVega]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/src/plugins/vis_type_vislib[visTypeVislib]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/src/plugins/vis_type_xy[visTypeXy]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/src/plugins/visualizations[visualizations]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/src/plugins/visualize[visualize]
+
+WARNING: Missing README.
+
+
+[discrete]
+==== x-pack/plugins
+
+- {kib-repo}blob/{branch}/x-pack/plugins/actions/README.md[actions]
+
+The Kibana actions plugin provides a framework to create executable actions. You can:
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/alerting_builtins/README.md[alertingBuiltins]
+
+This plugin provides alertTypes shipped with Kibana for use with the
+the alerts plugin.  When enabled, it will register
+the built-in alertTypes with the alerting plugin, register associated HTTP
+routes, etc.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/alerts/README.md[alerts]
+
+The Kibana alerting plugin provides a common place to set up alerts. You can:
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/apm/readme.md[apm]
+
+To access an elasticsearch instance that has live data you have two options:
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/audit_trail[auditTrail]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/beats_management[beats_management]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/canvas/README.md[canvas]
+
+"Never look back. The past is done. The future is a blank canvas." ― Suzy Kassem, Rise Up and Salute the Sun
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/case/README.md[case]
+
+Experimental Feature
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/cloud[cloud]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/code[code]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/console_extensions[consoleExtensions]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/cross_cluster_replication/README.md[crossClusterReplication]
+
+You can run a local cluster and simulate a remote cluster within a single Kibana directory.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/dashboard_enhanced/README.md[dashboardEnhanced]
+
+- {kib-repo}blob/{branch}/x-pack/plugins/dashboard_mode[dashboardMode]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/data_enhanced[dataEnhanced]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/discover_enhanced[discoverEnhanced]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/embeddable_enhanced[embeddableEnhanced]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/encrypted_saved_objects/README.md[encryptedSavedObjects]
+
+The purpose of this plugin is to provide a way to encrypt/decrypt attributes on the custom Saved Objects that works with
+security and spaces filtering as well as performing audit logging.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/enterprise_search/README.md[enterpriseSearch]
+
+This plugin's goal is to provide a Kibana user interface to the Enterprise Search solution's products (App Search and Workplace Search). In it's current MVP state, the plugin provides the following with the goal of gathering user feedback and raising product awareness:
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/event_log/README.md[eventLog]
+
+The purpose of this plugin is to provide a way to persist a history of events
+occuring in Kibana, initially just for the Make It Action project - alerts
+and actions.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/features[features]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/file_upload[fileUpload]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/global_search/README.md[globalSearch]
+
+The GlobalSearch plugin provides an easy way to search for various objects, such as applications
+or dashboards from the Kibana instance, from both server and client-side plugins
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/global_search_providers[globalSearchProviders]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/graph/README.md[graph]
+
+This is the main source folder of the Graph plugin. It contains all of the Kibana server and client source code. x-pack/test/functional/apps/graph contains additional functional tests.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/grokdebugger/README.md[grokdebugger]
+
+- {kib-repo}blob/{branch}/x-pack/plugins/index_lifecycle_management/README.md[indexLifecycleManagement]
+
+You can test that the Frozen badge, phase filtering, and lifecycle information is surfaced in
+Index Management by running this series of requests in Console:
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/index_management[indexManagement]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/infra/README.md[infra]
+
+This is the home of the infra plugin, which aims to provide a solution for
+the infrastructure monitoring use-case within Kibana.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/ingest_manager/README.md[ingestManager]
+
+Fleet needs to have Elasticsearch API keys enabled, and also to have TLS enabled on kibana, (if you want to run Kibana without TLS you can provide the following config flag --xpack.ingestManager.fleet.tlsCheckDisabled=false)
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/ingest_pipelines/README.md[ingestPipelines]
+
+The ingest_pipelines plugin provides Kibana support for Elasticsearch's ingest nodes. Please refer to the Elasticsearch documentation for more details.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/lens/readme.md[lens]
+
+Run all tests from the x-pack root directory
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/license_management[licenseManagement]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/licensing/README.md[licensing]
+
+The licensing plugin retrieves license data from Elasticsearch at regular configurable intervals.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/lists/README.md[lists]
+
+README.md for developers working on the backend lists on how to get started
+using the CURL scripts in the scripts folder.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/logstash[logstash]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/maps/README.md[maps]
+
+Visualize geo data from Elasticsearch or 3rd party geo-services.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/maps_legacy_licensing/README.md[mapsLegacyLicensing]
+
+This plugin provides access to the detailed tile map services from Elastic.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/ml[ml]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/monitoring[monitoring]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/observability/README.md[observability]
+
+This plugin provides shared components and services for use across observability solutions, as well as the observability landing page UI.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/oss_telemetry[ossTelemetry]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/painless_lab[painlessLab]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/remote_clusters[remoteClusters]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/reporting/README.md[reporting]
+
+An awesome Kibana reporting plugin
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/rollup/README.md[rollup]
+
+Welcome to the Kibana rollup plugin! This plugin provides Kibana support for Elasticsearch's rollup feature. Please refer to the Elasticsearch documentation to understand rollup indices and how to create rollup jobs.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/searchprofiler[searchprofiler]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/security/README.md[security]
+
+See Configuring security in Kibana.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/security_solution[securitySolution]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/snapshot_restore/README.md[snapshotRestore]
+
+or
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/spaces[spaces]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/task_manager[taskManager]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/telemetry_collection_xpack/README.md[telemetryCollectionXpack]
+
+Gathers all usage collection, retrieving them from both: OSS and X-Pack plugins.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/transform[transform]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/translations[translations]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/triggers_actions_ui/README.md[triggers_actions_ui]
+
+The Kibana alerts and actions UI plugin provides a user interface for managing alerts and actions.
+As a developer you can reuse and extend built-in alerts and actions UI functionality:
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/ui_actions_enhanced/README.md[uiActionsEnhanced]
+
+- {kib-repo}blob/{branch}/x-pack/plugins/upgrade_assistant[upgradeAssistant]
+
+WARNING: Missing README.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/uptime/README.md[uptime]
+
+The purpose of this plugin is to provide users of Heartbeat more visibility of what's happening
+in their infrastructure.
+
+
+- {kib-repo}blob/{branch}/x-pack/plugins/watcher/README.md[watcher]
+
+This plugins adopts some conventions in addition to or in place of conventions in Kibana (at the time of the plugin's creation):
+
diff --git a/docs/developer/architecture/development-visualize-index.asciidoc b/docs/developer/architecture/development-visualize-index.asciidoc
index 551c41833fb72..d41ee32c1fb27 100644
--- a/docs/developer/architecture/development-visualize-index.asciidoc
+++ b/docs/developer/architecture/development-visualize-index.asciidoc
@@ -1,5 +1,5 @@
 [[development-visualize-index]]
-=== Developing Visualizations
+== Developing Visualizations
 
 [IMPORTANT]
 ==============================================
diff --git a/docs/developer/architecture/index.asciidoc b/docs/developer/architecture/index.asciidoc
index d726a8bd3642d..2e6ab1a4ad6ac 100644
--- a/docs/developer/architecture/index.asciidoc
+++ b/docs/developer/architecture/index.asciidoc
@@ -17,9 +17,12 @@ A few notable services are called out below.
 * <<development-security>>
 * <<add-data-tutorials>>
 * <<development-visualize-index>>
+* <<code-exploration>>
 
-include::add-data-tutorials.asciidoc[]
+include::add-data-tutorials.asciidoc[leveloffset=+1]
 
-include::development-visualize-index.asciidoc[]
+include::development-visualize-index.asciidoc[leveloffset=+1]
 
-include::security/index.asciidoc[]
+include::security/index.asciidoc[leveloffset=+1]
+
+include::code-exploration.asciidoc[leveloffset=+1]
diff --git a/docs/developer/architecture/security/feature-registration.asciidoc b/docs/developer/architecture/security/feature-registration.asciidoc
index 164f6d1cf9c74..3724624dbb917 100644
--- a/docs/developer/architecture/security/feature-registration.asciidoc
+++ b/docs/developer/architecture/security/feature-registration.asciidoc
@@ -1,13 +1,13 @@
 [[development-plugin-feature-registration]]
-==== Plugin feature registration
+== Plugin feature registration
 
 If your plugin will be used with {kib}'s default distribution, then you have the ability to register the features that your plugin provides. Features are typically apps in {kib}; once registered, you can toggle them via Spaces, and secure them via Roles when security is enabled.
 
-===== UI Capabilities
+=== UI Capabilities
 
 Registering features also gives your plugin access to “UI Capabilities”. These capabilities are boolean flags that you can use to conditionally render your interface, based on the current user's permissions. For example, you can  hide or disable a Save button if the current user is not authorized.
 
-===== Registering a feature
+=== Registering a feature
 
 Feature registration is controlled via the built-in `xpack_main` plugin. To register a feature, call `xpack_main`'s `registerFeature` function from your plugin's `init` function, and provide the appropriate details:
 
@@ -21,7 +21,7 @@ init(server) {
 }
 -----------
 
-===== Feature details
+=== Feature details
 Registering a feature consists of the following fields. For more information, consult the {kib-repo}blob/{branch}/x-pack/plugins/features/server/feature_registry.ts[feature registry interface].
 
 
@@ -65,12 +65,12 @@ Registering a feature consists of the following fields. For more information, co
 |The ID of the navigation link associated with your feature.
 |===
 
-====== Privilege definition
+==== Privilege definition
 The `privileges` section of feature registration allows plugins to implement read/write and read-only modes for their applications.
 
 For a full explanation of fields and options, consult the {kib-repo}blob/{branch}/x-pack/plugins/features/server/feature_registry.ts[feature registry interface].
 
-===== Using UI Capabilities
+=== Using UI Capabilities
 
 UI Capabilities are available to your public (client) plugin code. These capabilities are read-only, and are used to inform the UI. This object is namespaced by feature id. For example, if your feature id is “foo”, then your UI Capabilities are stored at `uiCapabilities.foo`.
 To access capabilities, import them from `ui/capabilities`:
@@ -86,7 +86,7 @@ if (canUserSave) {
 -----------
 
 [[example-1-canvas]]
-===== Example 1: Canvas Application
+=== Example 1: Canvas Application
 ["source","javascript"]
 -----------
 init(server) {
@@ -141,7 +141,7 @@ if (canUserSave) {
 Because the `read` privilege does not define the `save` capability, users with read-only access will have their `uiCapabilities.canvas.save` flag set to `false`.
 
 [[example-2-dev-tools]]
-===== Example 2: Dev Tools
+=== Example 2: Dev Tools
 
 ["source","javascript"]
 -----------
@@ -176,7 +176,7 @@ init(server) {
     },
     privilegesTooltip: i18n.translate('xpack.features.devToolsPrivilegesTooltip', {
      defaultMessage:
-       'User should also be granted the appropriate Elasticsearch cluster and index privileges',
+       'User should also be granted the appropriate {es} cluster and index privileges',
    }),
   });
 }
@@ -199,7 +199,7 @@ server.route({
 -----------
 
 [[example-3-discover]]
-===== Example 3: Discover
+=== Example 3: Discover
 
 Discover takes advantage of subfeature privileges to allow fine-grained access control. In this example,
 a single "Create Short URLs" subfeature privilege is defined, which allows users to grant access to this feature without having to grant the `all` privilege to Discover. In other words, you can grant `read` access to Discover, and also grant the ability to create short URLs.
diff --git a/docs/developer/architecture/security/index.asciidoc b/docs/developer/architecture/security/index.asciidoc
index 55b2450caf7a7..09739142c8f79 100644
--- a/docs/developer/architecture/security/index.asciidoc
+++ b/docs/developer/architecture/security/index.asciidoc
@@ -1,12 +1,14 @@
 [[development-security]]
-=== Security
+== Security
 
-{kib} has generally been able to implement security transparently to core and plugin developers, and this largely remains the case. {kib} on two methods that the elasticsearch `Cluster` provides: `callWithRequest` and `callWithInternalUser`. 
+{kib} has generally been able to implement security transparently to core and plugin developers, and this largely remains the case. {kib} on two methods that the {es} `Cluster` provides: `callWithRequest` and `callWithInternalUser`. 
 
-`callWithRequest` executes requests against Elasticsearch using the authentication credentials of the {kib} end-user. So, if you log into {kib} with the user of `foo` when `callWithRequest` is used, {kib} execute the request against Elasticsearch as the user `foo`. Historically, `callWithRequest` has been used extensively to perform actions that are initiated at the request of {kib} end-users.
+`callWithRequest` executes requests against {es} using the authentication credentials of the {kib} end-user. So, if you log into {kib} with the user of `foo` when `callWithRequest` is used, {kib} execute the request against {es} as the user `foo`. Historically, `callWithRequest` has been used extensively to perform actions that are initiated at the request of {kib} end-users.
 
-`callWithInternalUser` executes requests against Elasticsearch using the internal {kib} server user, and has historically been used for performing actions that aren't initiated by {kib} end users; for example, creating the initial `.kibana` index or performing health checks against Elasticsearch.
+`callWithInternalUser` executes requests against {es} using the internal {kib} server user, and has historically been used for performing actions that aren't initiated by {kib} end users; for example, creating the initial `.kibana` index or performing health checks against {es}.
 
-However, with the changes that role-based access control (RBAC) introduces, this is no longer cut and dry. {kib} now requires all access to the `.kibana` index goes through the `SavedObjectsClient`. This used to be a best practice, as the `SavedObjectsClient` was responsible for translating the documents stored in Elasticsearch to and from Saved Objects, but RBAC is now taking advantage of this abstraction to implement access control and determine when to use `callWithRequest` versus `callWithInternalUser`.
+However, with the changes that role-based access control (RBAC) introduces, this is no longer cut and dry. {kib} now requires all access to the `.kibana` index goes through the `SavedObjectsClient`. This used to be a best practice, as the `SavedObjectsClient` was responsible for translating the documents stored in {es} to and from Saved Objects, but RBAC is now taking advantage of this abstraction to implement access control and determine when to use `callWithRequest` versus `callWithInternalUser`.
 
-include::rbac.asciidoc[]
+include::rbac.asciidoc[leveloffset=+1]
+
+include::feature-registration.asciidoc[leveloffset=+1]
diff --git a/docs/developer/architecture/security/rbac.asciidoc b/docs/developer/architecture/security/rbac.asciidoc
index ae1979e856e23..7b35a91ca73d0 100644
--- a/docs/developer/architecture/security/rbac.asciidoc
+++ b/docs/developer/architecture/security/rbac.asciidoc
@@ -1,9 +1,9 @@
 [[development-security-rbac]]
-==== Role-based access control
+== Role-based access control
 
 Role-based access control (RBAC) in {kib} relies upon the
 {ref}/security-privileges.html#application-privileges[application privileges]
-that Elasticsearch exposes. This allows {kib} to define the privileges that
+that {es} exposes. This allows {kib} to define the privileges that
 {kib} wishes to grant to users, assign them to the relevant users using roles,
 and then authorize the user to perform a specific action. This is handled within
 a secured instance of the `SavedObjectsClient` and available transparently to
@@ -11,7 +11,7 @@ consumers when using `request.getSavedObjectsClient()` or
 `savedObjects.getScopedSavedObjectsClient()`.
 
 [[development-rbac-privileges]]
-===== {kib} Privileges
+=== {kib} Privileges
 
 When {kib} first starts up, it executes the following `POST` request against {es}. This synchronizes the definition of the privileges with various `actions` which are later used to authorize a user:
 
@@ -56,7 +56,7 @@ The application is created by concatenating the prefix of `kibana-` with the val
 ==============================================
 
 [[development-rbac-assigning-privileges]]
-===== Assigning {kib} Privileges
+=== Assigning {kib} Privileges
 
 {kib} privileges are assigned to specific roles using the `applications` element. For example, the following role assigns the <<kibana-privileges-all, all>> privilege at `*` `resources` (which will in the future be used to secure spaces) to the default {kib} `application`:
 
@@ -81,7 +81,7 @@ Roles that grant <<kibana-privileges>> should be managed using the <<role-manage
 {ref}/security-api.html#security-user-apis[user management APIs].
 
 [[development-rbac-authorization]]
-===== Authorization
+=== Authorization
 
 The {es} {ref}/security-api-has-privileges.html[has privileges API] determines whether the user is authorized to perform a specific action:
 
diff --git a/docs/developer/best-practices/index.asciidoc b/docs/developer/best-practices/index.asciidoc
index 43022c259a592..90b0092d835a8 100644
--- a/docs/developer/best-practices/index.asciidoc
+++ b/docs/developer/best-practices/index.asciidoc
@@ -4,7 +4,7 @@
 Consider these best practices, whether developing code directly to the {kib} repo or building your own plugins.
 They are intended to support our https://github.com/elastic/engineering/blob/master/kibana_dev_principles.md[{kib} development principals].
 
-[float]
+[discrete]
 === Performance
 
 Are you planning with scalability in mind?
@@ -15,7 +15,7 @@ Are you planning with scalability in mind?
 * Do you make lots of requests to the server?
 ** If so, have you considered using the streaming {kib-repo}tree/{branch}/src/plugins/bfetch[bfetch service]?
 
-[float]
+[discrete]
 === Accessibility
 
 Did you know {kib} makes a public statement about our commitment to
@@ -28,7 +28,7 @@ tackles accessibility]
 * If you don’t use EUI, follow the same EUI accessibility standards
 
 [[kibana-localization-best-practices]]
-[float]
+[discrete]
 === Localization
 
 {kib} is translated into other languages. Use our i18n utilities to
@@ -39,7 +39,7 @@ ensure your public facing strings will be translated to ensure all
 {kib-repo}blob/{branch}/packages/kbn-i18n/GUIDELINE.md[i18n
 guidelines]
 
-[float]
+[discrete]
 === Conventions
 
 * Become familiar with our
@@ -58,7 +58,7 @@ them.
 * Use https://elastic.github.io/eui[EUI] for all your basic UI
 components to create a consistent UI experience.
 
-[float]
+[discrete]
 === Re-inventing the wheel
 
 Over-refactoring can be a problem in it’s own right, but it’s still
@@ -96,7 +96,7 @@ for react specific helpers
 Re-using these services will help create a consistent experience across
 {kib} from every solution.
 
-[float]
+[discrete]
 === Backward compatibility
 
 Eventually we want to garauntee to our plugin developers that their plugins will not break from minor to minor.
@@ -122,7 +122,7 @@ In addition, if users are relying on state stored in your app’s URL as
 part of your public contract, keep in mind that you may also need to
 provide backwards compatibility for bookmarked URLs.
 
-[float]
+[discrete]
 === Testing & stability
 
 Review:
@@ -131,6 +131,6 @@ Review:
 * <<stability>>
 * <<security-best-practices>>
 
-include::stability.asciidoc[]
+include::stability.asciidoc[leveloffset=+1]
 
-include::security.asciidoc[]
+include::security.asciidoc[leveloffset=+1]
diff --git a/docs/developer/best-practices/security.asciidoc b/docs/developer/best-practices/security.asciidoc
index 26fcc73ce2b90..79ecb08295064 100644
--- a/docs/developer/best-practices/security.asciidoc
+++ b/docs/developer/best-practices/security.asciidoc
@@ -1,5 +1,5 @@
 [[security-best-practices]]
-=== Security best practices
+== Security best practices
 
 * XSS
 ** Check for usages of `dangerouslySetInnerHtml`, `Element.innerHTML`,
@@ -44,7 +44,7 @@ sensitive information which end up in the HTTP Response
 ** Ensure no sensitive cookies are forwarded to external resources.
 ** Ensure that all user controllable variables that are used in
 constructing a URL are escaped properly. This is relevant when using
-`transport.request` with the Elasticsearch client as no automatic
+`transport.request` with the {es} client as no automatic
 escaping is performed.
 * Reverse tabnabbing -
 https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/HTML5_Security_Cheat_Sheet.md#tabnabbing
diff --git a/docs/developer/best-practices/stability.asciidoc b/docs/developer/best-practices/stability.asciidoc
index 68237a034be52..f4b7ae1229909 100644
--- a/docs/developer/best-practices/stability.asciidoc
+++ b/docs/developer/best-practices/stability.asciidoc
@@ -1,10 +1,10 @@
 [[stability]]
-=== Stability
+== Stability
 
 Ensure your feature will work under all possible {kib} scenarios.
 
-[float]
-==== Environmental configuration scenarios
+[discrete]
+=== Environmental configuration scenarios
 
 * Cloud
 ** Does the feature work on *cloud environment*?
@@ -32,16 +32,16 @@ non-standard {kib} indices. (create their own custom roles)
 sessions. (we have had many discuss/SDH tickets around this)
 * If a proxy/loadbalancer is running between ES and {kib}
 
-[float]
-==== Kibana.yml settings
+[discrete]
+=== Kibana.yml settings
 
 * Using a custom {kib} index alias
 * When optional dependencies are disabled
 ** Ensure all your required dependencies are listed in kibana.json
 dependency list!
 
-[float]
-==== Test coverage
+[discrete]
+=== Test coverage
 
 * Does the feature have sufficient unit test coverage? (does it handle
 storeinSessions?)
@@ -49,16 +49,16 @@ storeinSessions?)
 * Does the feature have sufficient Rest API coverage test coverage?
 * Does the feature have sufficient Integration test coverage?
 
-[float]
-==== Browser coverage
+[discrete]
+=== Browser coverage
 
 Refer to the list of browsers and OS {kib} supports
 https://www.elastic.co/support/matrix
 
 Does the feature work efficiently on the list of supported browsers? 
 
-[float]
-==== Upgrade Scenarios - Migration scenarios- 
+[discrete]
+=== Upgrade Scenarios - Migration scenarios- 
 
 Does the feature affect old
 indices, saved objects ? - Has the feature been tested with {kib}
diff --git a/docs/developer/contributing/development-accessibility-tests.asciidoc b/docs/developer/contributing/development-accessibility-tests.asciidoc
index a3ffefb94cd2a..facf7ff14a6c1 100644
--- a/docs/developer/contributing/development-accessibility-tests.asciidoc
+++ b/docs/developer/contributing/development-accessibility-tests.asciidoc
@@ -1,5 +1,5 @@
 [[development-accessibility-tests]]
-==== Automated Accessibility Testing
+== Automated Accessibility Testing
 
 To run the tests locally:
 
diff --git a/docs/developer/contributing/development-documentation.asciidoc b/docs/developer/contributing/development-documentation.asciidoc
index d9fae42eef87e..99e55963f57af 100644
--- a/docs/developer/contributing/development-documentation.asciidoc
+++ b/docs/developer/contributing/development-documentation.asciidoc
@@ -1,18 +1,18 @@
 [[development-documentation]]
-=== Documentation during development
+== Documentation during development
 
 Docs should be written during development and accompany PRs when relevant. There are multiple types of documentation, and different places to add each.
 
-[float]
-==== Developer services documentation
+[discrete]
+=== Developer services documentation
 
 Documentation about specific services a plugin offers should be encapsulated in:
 
 * README.asciidoc at the base of the plugin folder.
 * Typescript comments for all public services.
 
-[float]
-==== End user documentation
+[discrete]
+=== End user documentation
 
 Documentation about user facing features should be written in http://asciidoc.org/[asciidoc] at
 {kib-repo}/tree/master/docs[https://github.com/elastic/kibana/tree/master/docs]
@@ -27,8 +27,8 @@ README for getting the docs tooling set up.
 node scripts/docs.js --open
 ```
 
-[float]
-==== General developer documentation and guidelines
+[discrete]
+=== General developer documentation and guidelines
 
 General developer guildlines and documentation, like this right here, should be written in http://asciidoc.org/[asciidoc]
 at {kib-repo}/tree/master/docs/developer[https://github.com/elastic/kibana/tree/master/docs/developer]
diff --git a/docs/developer/contributing/development-functional-tests.asciidoc b/docs/developer/contributing/development-functional-tests.asciidoc
index 442fc1ac755d3..580a5a000f391 100644
--- a/docs/developer/contributing/development-functional-tests.asciidoc
+++ b/docs/developer/contributing/development-functional-tests.asciidoc
@@ -1,10 +1,10 @@
 [[development-functional-tests]]
-=== Functional Testing
+== Functional Testing
 
 We use functional tests to make sure the {kib} UI works as expected. It replaces hours of manual testing by automating user interaction. To have better control over our functional test environment, and to make it more accessible to plugin authors, {kib} uses a tool called the `FunctionalTestRunner`.
 
-[float]
-==== Running functional tests
+[discrete]
+=== Running functional tests
 
 The `FunctionalTestRunner` is very bare bones and gets most of its functionality from its config file, located at {blob}test/functional/config.js[test/functional/config.js]. If you’re writing a plugin outside the {kib} repo, you will have your own config file.
  See <<external-plugin-functional-tests>> for more info.
@@ -12,27 +12,27 @@ The `FunctionalTestRunner` is very bare bones and gets most of its functionality
 There are three ways to run the tests depending on your goals:
 
 1. Easiest option:
-** Description: Starts up {kib} & Elasticsearch servers, followed by running tests. This is much slower when running the tests multiple times because slow startup time for the servers. Recommended for single-runs.
+** Description: Starts up {kib} & {es} servers, followed by running tests. This is much slower when running the tests multiple times because slow startup time for the servers. Recommended for single-runs.
 ** `node scripts/functional_tests`
-*** does everything in a single command, including running Elasticsearch and {kib} locally
+*** does everything in a single command, including running {es} and {kib} locally
 *** tears down everything after the tests run
 *** exit code reports success/failure of the tests
 
 2. Best for development:
-** Description: Two commands, run in separate terminals, separate the components that are long-running and slow from those that are ephemeral and fast. Tests can be re-run much faster, and this still runs Elasticsearch & {kib} locally.
+** Description: Two commands, run in separate terminals, separate the components that are long-running and slow from those that are ephemeral and fast. Tests can be re-run much faster, and this still runs {es} & {kib} locally.
 ** `node scripts/functional_tests_server`
-*** starts Elasticsearch and {kib} servers
+*** starts {es} and {kib} servers
 *** slow to start
 *** can be reused for multiple executions of the tests, thereby saving some time when re-running tests
 *** automatically restarts the {kib} server when relevant changes are detected
 ** `node scripts/functional_test_runner`
-*** runs the tests against {kib} & Elasticsearch servers that were started by `node scripts/functional_tests_server`
+*** runs the tests against {kib} & {es} servers that were started by `node scripts/functional_tests_server`
 *** exit code reports success or failure of the tests
 
 3. Custom option:
-** Description: Runs tests against instances of Elasticsearch & {kib} started some other way (like Elastic Cloud, or an instance you are managing in some other way).
+** Description: Runs tests against instances of {es} & {kib} started some other way (like Elastic Cloud, or an instance you are managing in some other way).
 ** just executes the functional tests
-** url, credentials, etc. for Elasticsearch and {kib} are specified via environment variables
+** url, credentials, etc. for {es} and {kib} are specified via environment variables
 ** Here's an example that runs against an Elastic Cloud instance. Note that you must run the same branch of tests as the version of {kib} you're testing.
 +
 ["source","shell"]
@@ -91,15 +91,15 @@ export TEST_THROTTLE_NETWORK=1
 node scripts/functional_test_runner --exclude-tag skipCloud
 ----------
 
-[float]
-===== More about `node scripts/functional_test_runner`
+[discrete]
+==== More about `node scripts/functional_test_runner`
 
 When run without any arguments the `FunctionalTestRunner` automatically loads the configuration in the standard location, but you can override that behavior with the `--config` flag. List configs with multiple --config arguments.
 
-* `--config test/functional/config.js` starts Elasticsearch and {kib} servers with the WebDriver tests configured to run in Chrome.
-* `--config test/functional/config.firefox.js` starts Elasticsearch and {kib} servers with the WebDriver tests configured to run in Firefox.
-* `--config test/api_integration/config.js` starts Elasticsearch and {kib} servers with the api integration tests configuration.
-* `--config test/accessibility/config.ts` starts Elasticsearch and {kib} servers with the WebDriver tests configured to run an accessibility audit using https://www.deque.com/axe/[axe].
+* `--config test/functional/config.js` starts {es} and {kib} servers with the WebDriver tests configured to run in Chrome.
+* `--config test/functional/config.firefox.js` starts {es} and {kib} servers with the WebDriver tests configured to run in Firefox.
+* `--config test/api_integration/config.js` starts {es} and {kib} servers with the api integration tests configuration.
+* `--config test/accessibility/config.ts` starts {es} and {kib} servers with the WebDriver tests configured to run an accessibility audit using https://www.deque.com/axe/[axe].
 
 There are also command line flags for `--bail` and `--grep`, which behave just like their mocha counterparts. For instance, use `--grep=foo` to run only tests that match a regular expression.
 
@@ -108,11 +108,11 @@ Logging can also be customized with `--quiet`, `--debug`, or `--verbose` flags.
 Use the `--help` flag for more options.
 
 
-[float]
-==== Writing functional tests
+[discrete]
+=== Writing functional tests
 
-[float]
-===== Environment
+[discrete]
+==== Environment
 
 The tests are written in https://mochajs.org[mocha] using https://github.com/elastic/kibana/tree/master/packages/kbn-expect[@kbn/expect] for assertions.
 
@@ -120,8 +120,8 @@ We use https://www.w3.org/TR/webdriver1/[WebDriver Protocol] to run tests in bot
 
 The `FunctionalTestRunner` automatically transpiles functional tests using babel, so that tests can use the same ECMAScript features that {kib} source code uses. See {blob}style_guides/js_style_guide.md[style_guides/js_style_guide.md].
 
-[float]
-===== Definitions
+[discrete]
+==== Definitions
 
 **Provider:**
 
@@ -179,8 +179,8 @@ To run tests on Firefox locally, use `config.firefox.js`:
 node scripts/functional_test_runner --config test/functional/config.firefox.js
 -----------
 
-[float]
-===== Using the test_user service
+[discrete]
+==== Using the test_user service
 
 Tests should run at the positive security boundry condition, meaning that they should be run with the mimimum privileges required (and documented) and not as the superuser.
  This prevents the type of regression where additional privleges accidentally become required to perform the same action. 
@@ -198,8 +198,8 @@ Here we are setting the `test_user` to have the `kibana_user` role and also role
 Tests should normally setRoles() in the before() and restoreDefaults() in the after().
 
 
-[float]
-===== Anatomy of a test file
+[discrete]
+==== Anatomy of a test file
 
 This annotated example file shows the basic structure every test suite uses. It starts by importing https://github.com/elastic/kibana/tree/master/packages/kbn-expect[`@kbn/expect`] and defining its default export: an anonymous Test Provider. The test provider then destructures the Provider API for the `getService()` and `getPageObjects()` functions. It uses these functions to collect the dependencies of this suite. The rest of the test file will look pretty normal to mocha.js users. `describe()`, `it()`, `before()` and the lot are used to define suites that happen to automate a browser via services and objects of type `PageObject`.
 
@@ -222,7 +222,7 @@ export default function ({ getService, getPageObject }) {
   describe('My Test Suite', () => {
 
     // most suites start with a before hook that navigates to a specific
-    // app/page and restores some archives into elasticsearch with esArchiver
+    // app/page and restores some archives into {es} with esArchiver
     before(async () => {
       await Promise.all([
         // start with an empty .kibana index
@@ -235,7 +235,7 @@ export default function ({ getService, getPageObject }) {
     });
 
     // right after the before() hook definition, add the teardown steps
-    // that will tidy up elasticsearch for other test suites
+    // that will tidy up {es} for other test suites
     after(async () => {
       // we unload the empty_kibana archive but not the makelogs
       // archive because we don't make any changes to it, and subsequent
@@ -257,9 +257,9 @@ export default function ({ getService, getPageObject }) {
 }
 ----
 
-[float]
+[discrete]
 [[functional_test_runner_provider_api]]
-==== Provider API
+=== Provider API
 
 The first and only argument to all providers is a Provider API Object. This object can be used to load service/page objects and config/test files.
 
@@ -280,11 +280,11 @@ Within a test Provider the API is exactly the same as the service providers API
 [horizontal]
 `loadTestFile(path)`::: Load the test file at path in place. Use this method to nest suites from other files into a higher-level suite
 
-[float]
-==== Service Index
+[discrete]
+=== Service Index
 
-[float]
-===== Built-in Services
+[discrete]
+==== Built-in Services
 
 The `FunctionalTestRunner` comes with three built-in services:
 
@@ -304,8 +304,8 @@ The `FunctionalTestRunner` comes with three built-in services:
 * Exposes lifecycle events for basic coordination. Handlers can return a promise and resolve/fail asynchronously
 * Phases include: `beforeLoadTests`, `beforeTests`, `beforeEachTest`, `cleanup`
 
-[float]
-===== {kib} Services
+[discrete]
+==== {kib} Services
 
 The {kib} functional tests define the vast majority of the actual functionality used by tests.
 
@@ -377,7 +377,7 @@ Full list of services that are used in functional tests can be found here: {blob
 **Low-level utilities:**:::
 * es
 ** Source: {blob}test/common/services/es.ts[test/common/services/es.ts]
-** Elasticsearch client
+** {es} client
 ** Higher level options: `kibanaServer.uiSettings` or `esArchiver`
 * remote
 ** Source: {blob}test/functional/services/remote/remote.ts[test/functional/services/remote/remote.ts]
@@ -387,8 +387,8 @@ Full list of services that are used in functional tests can be found here: {blob
 ** For searching and manipulating with DOM elements, use `testSubjects` and `find` services
 ** See the https://seleniumhq.github.io/selenium/docs/api/javascript/[selenium-webdriver docs] for the full API.
 
-[float]
-===== Custom Services
+[discrete]
+==== Custom Services
 
 Services are intentionally generic. They can be literally anything (even nothing). Some services have helpers for interacting with a specific types of UI elements, like `pointSeriesVis`, and others are more foundational, like `log` or `config`. Whenever you want to provide some functionality in a reusable package, consider making a custom service.
 
@@ -427,8 +427,8 @@ export default function () {
 }
 -----------
 
-[float]
-==== PageObjects
+[discrete]
+=== PageObjects
 
 The purpose for each PageObject is pretty self-explanatory. The visualize PageObject provides helpers for interacting with the visualize app, dashboard is the same for the dashboard app, and so on.
 
@@ -436,13 +436,13 @@ One exception is the "common" PageObject. A holdover from the intern implementat
 
 Please add new methods to existing or new services rather than further expanding the CommonPage class.
 
-[float]
-==== Gotchas
+[discrete]
+=== Gotchas
 
 Remember that you can’t run an individual test in the file (`it` block) because the whole `describe` needs to be run in order. There should only be one top level `describe` in a file.
 
-[float]
-===== Functional Test Timing
+[discrete]
+==== Functional Test Timing
 
 Another important gotcha is writing stable tests by being mindful of timing. All methods on `remote` run asynchronously. It’s better to write interactions that wait for changes on the UI to appear before moving onto the next step.
 
@@ -480,8 +480,8 @@ class AppPage {
 
 Writing in this way will ensure your test timings are not flaky or based on assumptions about UI updates after interactions.
 
-[float]
-==== Debugging
+[discrete]
+=== Debugging
 
 From the command line run:
 
@@ -503,8 +503,8 @@ const log = getService(‘log’);
 log.debug(‘done clicking menu’);
 -----------
 
-[float]
-==== MacOS testing performance tip
+[discrete]
+=== MacOS testing performance tip
 
 macOS users on a machine with a discrete graphics card may see significant speedups (up to 2x) when running tests by changing your terminal emulator's GPU settings. In iTerm2:
 * Open Preferences (Command + ,)
diff --git a/docs/developer/contributing/development-github.asciidoc b/docs/developer/contributing/development-github.asciidoc
index 027b4e73aa9de..a6d4e29940487 100644
--- a/docs/developer/contributing/development-github.asciidoc
+++ b/docs/developer/contributing/development-github.asciidoc
@@ -1,16 +1,16 @@
 [[development-github]]
-=== How we use git and github
+== How we use git and github
 
-[float]
-==== Forking
+[discrete]
+=== Forking
 
 We follow the https://help.github.com/articles/fork-a-repo/[GitHub
 forking model] for collaborating on {kib} code. This model assumes that
 you have a remote called `upstream` which points to the official {kib}
 repo, which we'll refer to in later code snippets.
 
-[float]
-==== Branching
+[discrete]
+=== Branching
 
 * All work on the next major release goes into master.
 * Past major release branches are named `{majorVersion}.x`. They contain
@@ -24,8 +24,8 @@ if the next patch release is `5.3.1`, work for it should go into the
 branches.
 * Where appropriate, we'll backport changes into older release branches.
 
-[float]
-==== Commits and Merging
+[discrete]
+=== Commits and Merging
 
 * Feel free to make as many commits as you want, while working on a
 branch.
@@ -38,8 +38,8 @@ explanation of _why_ you made the changes that you did.
 feature branch, and force-pushing (see below for instructions).
 * When merging, we'll squash your commits into a single commit.
 
-[float]
-===== Rebasing and fixing merge conflicts
+[discrete]
+==== Rebasing and fixing merge conflicts
 
 Rebasing can be tricky, and fixing merge conflicts can be even trickier
 because it involves force pushing. This is all compounded by the fact
@@ -106,7 +106,7 @@ hint: See the 'Note about fast-forwards' in 'git push --help' for details.
 
 Assuming you've successfully rebased and you're happy with the code, you should force push instead.
 
-[float]
-==== Creating a pull request
+[discrete]
+=== Creating a pull request
 
 See <<development-pull-request>> for the next steps on getting your code changes merged into {kib}.
\ No newline at end of file
diff --git a/docs/developer/contributing/development-pull-request.asciidoc b/docs/developer/contributing/development-pull-request.asciidoc
index 5d3c30fec7383..070eff449af5b 100644
--- a/docs/developer/contributing/development-pull-request.asciidoc
+++ b/docs/developer/contributing/development-pull-request.asciidoc
@@ -1,16 +1,16 @@
 [[development-pull-request]]
-=== Submitting a pull request
+== Submitting a pull request
 
-[float]
-==== What Goes Into a Pull Request
+[discrete]
+=== What Goes Into a Pull Request
 
 * Please include an explanation of your changes in your PR description.
 * Links to relevant issues, external resources, or related PRs are very important and useful.
 * Please update any tests that pertain to your code, and add new tests where appropriate.
 * Update or add docs when appropriate. Read more about <<development-documentation>>.
 
-[float]
-==== Submitting a Pull Request
+[discrete]
+=== Submitting a Pull Request
 
  1. Push your local changes to your forked copy of the repository and submit a pull request.
  2. Describe what your changes do and mention the number of the issue where discussion has taken place, e.g., “Closes #123″.
@@ -22,8 +22,8 @@ Always submit your pull against master unless the bug is only present in an olde
 
 Then sit back and wait. There will probably be discussion about the Pull Request and, if any changes are needed, we'll work with you to get your Pull Request merged into {kib}.
 
-[float]
-==== What to expect during the pull request review process
+[discrete]
+=== What to expect during the pull request review process
 
 Most PRs go through several iterations of feedback and updates. Depending on the scope and complexity of the PR, the process can take weeks. Please
 be patient and understand we hold our code base to a high standard.
diff --git a/docs/developer/contributing/development-tests.asciidoc b/docs/developer/contributing/development-tests.asciidoc
index b470ea61669b2..78a2a90b69ce5 100644
--- a/docs/developer/contributing/development-tests.asciidoc
+++ b/docs/developer/contributing/development-tests.asciidoc
@@ -1,10 +1,10 @@
 [[development-tests]]
-=== Testing
+== Testing
 
 To ensure that your changes will not break other functionality, please run the test suite and build (<<building-kibana>>) before submitting your Pull Request.
 
-[float]
-==== Running specific {kib} tests
+[discrete]
+=== Running specific {kib} tests
 
 The following table outlines possible test file locations and how to
 invoke them:
@@ -47,8 +47,8 @@ Examples: - Run the entire elasticsearch_service test suite:
 string: ``` yarn test:ftr:server –config test/api_integration/config.js
 yarn test:ftr:runner –config test/api_integration/config
 
-[float]
-==== Cross-browser compatibility
+[discrete]
+=== Cross-browser compatibility
 
 **Testing IE on OS X**
 
@@ -71,8 +71,8 @@ your computer name).
 `http://computer.local:5601` to test {kib}.
 * Alternatively you can use browserstack
 
-[float]
-==== Running browser automation tests
+[discrete]
+=== Running browser automation tests
 
 Check out <<development-functional-tests>> to learn more about how you can run
 and develop functional tests for {kib} core and plugins.
@@ -80,17 +80,17 @@ and develop functional tests for {kib} core and plugins.
 You can also look into the {kib-repo}tree/{branch}/scripts/README.md[Scripts README.md]
 to learn more about using the node scripts we provide for building
 {kib}, running integration tests, and starting up {kib} and
-Elasticsearch while you develop.
+{es} while you develop.
 
-[float]
+[discrete]
 ==== More testing information:
 
 * <<development-functional-tests>>
 * <<development-unit-tests>>
 * <<development-accessibility-tests>>
 
-include::development-functional-tests.asciidoc[]
+include::development-functional-tests.asciidoc[leveloffset=+1]
 
-include::development-unit-tests.asciidoc[]
+include::development-unit-tests.asciidoc[leveloffset=+1]
 
-include::development-accessibility-tests.asciidoc[]
\ No newline at end of file
+include::development-accessibility-tests.asciidoc[leveloffset=+1]
\ No newline at end of file
diff --git a/docs/developer/contributing/development-unit-tests.asciidoc b/docs/developer/contributing/development-unit-tests.asciidoc
index 0009533c9a7c4..8b4954150bb5b 100644
--- a/docs/developer/contributing/development-unit-tests.asciidoc
+++ b/docs/developer/contributing/development-unit-tests.asciidoc
@@ -1,11 +1,11 @@
 [[development-unit-tests]]
-==== Unit testing frameworks
+== Unit testing frameworks
 
 {kib} is migrating unit testing from `Mocha` to `Jest`. Legacy unit tests
 still exist in Mocha but all new unit tests should be written in Jest.
 
-[float]
-===== Mocha (legacy)
+[discrete]
+=== Mocha (legacy)
 
 Mocha tests are contained in `__tests__` directories.
 
@@ -16,8 +16,8 @@ Mocha tests are contained in `__tests__` directories.
 yarn test:mocha
 -----------
 
-[float]
-==== Jest
+[discrete]
+== Jest
 Jest tests are stored in the same directory as source code files with the `.test.{js,mjs,ts,tsx}` suffix.
 
 *Running Jest Unit Tests*
@@ -27,8 +27,8 @@ Jest tests are stored in the same directory as source code files with the `.test
 yarn test:jest
 -----------
 
-[float]
-====== Writing Jest Unit Tests
+[discrete]
+==== Writing Jest Unit Tests
 
 In order to write those tests there are two main things you need to be aware of.
 The first one is the different between `jest.mock` and `jest.doMock` 
@@ -37,8 +37,8 @@ test files with `babel-jest` both techniques are needed
 specially for the tests implemented on Typescript in order to benefit from the 
 auto-inference types feature.
 
-[float]
-====== Jest.mock vs Jest.doMock
+[discrete]
+==== Jest.mock vs Jest.doMock
 
 Both methods are essentially the same on their roots however the `jest.mock` 
 calls will get hoisted to the top of the file and can only reference variables 
@@ -47,8 +47,8 @@ reference pretty much any variable we want, however we have to assure those refe
 variables are instantiated at the time we need them which lead us to the next 
 section where we'll talk about our jest mock files pattern.
 
-[float]
-====== Jest Mock Files Pattern 
+[discrete]
+==== Jest Mock Files Pattern 
 
 Specially on typescript it is pretty common to have in unit tests 
 `jest.doMock` calls which reference for example imported types. Any error 
@@ -76,9 +76,9 @@ like: `import * as Mocks from './mymodule.test.mocks'`,
 or just `import './mymodule.test.mocks'` if there isn't anything 
 exported to be used.
 
-[float]
+[discrete]
 [[debugging-unit-tests]]
-===== Debugging Unit Tests
+=== Debugging Unit Tests
 
 The standard `yarn test` task runs several sub tasks and can take
 several minutes to complete, making debugging failures pretty painful.
@@ -127,8 +127,8 @@ description.
 
 image:http://i.imgur.com/DwHxgfq.png[Browser test debugging]
 
-[float]
-===== Unit Testing Plugins
+[discrete]
+=== Unit Testing Plugins
 
 This should work super if you’re using the
 https://github.com/elastic/kibana/tree/master/packages/kbn-plugin-generator[Kibana
diff --git a/docs/developer/contributing/index.asciidoc b/docs/developer/contributing/index.asciidoc
index 4f987f31cf1f6..99ab83bc2f073 100644
--- a/docs/developer/contributing/index.asciidoc
+++ b/docs/developer/contributing/index.asciidoc
@@ -23,7 +23,7 @@ Read <<development-getting-started>> to get your environment up and running, the
 
 Please make sure you have signed the [Contributor License Agreement](http://www.elastic.co/contributor-agreement/). We are not asking you to assign copyright to us, but to give us the right to distribute your code without restriction. We ask this of all contributors in order to assure our users of the origin and continuing existence of the code. You only need to sign the CLA once.
 
-[float]
+[discrete]
 [[kibana-localization]]
 === Localization
 
@@ -32,7 +32,7 @@ Read <<kibana-localization-best-practices>> for details on our localization prac
 Note that we cannot support accepting contributions to the translations from any source other than the translators we have engaged to do the work.
 We are still to develop a proper process to accept any contributed translations. We certainly appreciate that people care enough about the localization effort to want to help improve the quality. We aim to build out a more comprehensive localization process for the future and will notify you once contributions can be supported, but for the time being, we are not able to incorporate suggestions.
 
-[float]
+[discrete]
 [[kibana-release-notes-process]]
 === Release Notes Process
 
@@ -43,7 +43,7 @@ access to GitHub labels.
 The Release Notes summarize what the PRs accomplish in language that is meaningful to users.
  To generate the Release Notes, the team runs a script against this repo to collect the merged PRs against the release.
 
-[float]
+[discrete]
 ==== Create the Release Notes text
 
 The text that appears in the Release Notes is pulled directly from your PR title, or a single paragraph of text that you specify in the PR description.
@@ -59,7 +59,7 @@ When you create the Release Notes text, use the following best practices:
 * When you create a bug fix PR, start with `Fixes`.
 * When you create a deprecation PR, start with `Deprecates`.
 
-[float]
+[discrete]
 ==== Add your labels
 
 [arabic]
@@ -72,18 +72,18 @@ When you create the Release Notes text, use the following best practices:
   * To **NOT** include your changes in the Release Notes, use `release_note:skip`.
 
 
-include::development-github.asciidoc[]
+include::development-github.asciidoc[leveloffset=+1]
 
-include::development-tests.asciidoc[]
+include::development-tests.asciidoc[leveloffset=+1]
 
-include::interpreting-ci-failures.asciidoc[]
+include::interpreting-ci-failures.asciidoc[leveloffset=+1]
 
-include::development-documentation.asciidoc[]
+include::development-documentation.asciidoc[leveloffset=+1]
 
-include::development-pull-request.asciidoc[]
+include::development-pull-request.asciidoc[leveloffset=+1]
 
-include::kibana-issue-reporting.asciidoc[]
+include::kibana-issue-reporting.asciidoc[leveloffset=+1]
 
-include::pr-review.asciidoc[]
+include::pr-review.asciidoc[leveloffset=+1]
 
-include::linting.asciidoc[]
+include::linting.asciidoc[leveloffset=+1]
diff --git a/docs/developer/contributing/interpreting-ci-failures.asciidoc b/docs/developer/contributing/interpreting-ci-failures.asciidoc
index ba3999a310198..bb623bc7a541c 100644
--- a/docs/developer/contributing/interpreting-ci-failures.asciidoc
+++ b/docs/developer/contributing/interpreting-ci-failures.asciidoc
@@ -1,19 +1,19 @@
 [[interpreting-ci-failures]]
-=== Interpreting CI Failures
+== Interpreting CI Failures
 
 {kib} CI uses a Jenkins feature called "Pipelines" to automate testing of the code in pull requests and on tracked branches. Pipelines are defined within the repository via the `Jenkinsfile` at the root of the project.
 
 More information about Jenkins Pipelines can be found link:https://jenkins.io/doc/book/pipeline/[in the Jenkins book].
 
-[float]
-==== Github Checks
+[discrete]
+=== Github Checks
 
 When a test fails it will be reported to Github via Github Checks. We currently bucket tests into several categories which run in parallel to make CI faster. Groups like `ciGroup{X}` get a single check in Github, and other tests like linting, or type checks, get their own checks.
 
 Clicking the link next to the check in the conversation tab of a pull request will take you to the log output from that section of the tests. If that log output is truncated, or doesn't clearly identify what happened, you can usually get more complete information by visiting Jenkins directly.
 
-[float]
-==== Viewing Job Executions in Jenkins
+[discrete]
+=== Viewing Job Executions in Jenkins
 
 To view the results of a job execution in Jenkins, either click the link in the comment left by `@elasticmachine` or search for the `kibana-ci` check in the list at the bottom of the PR. This link will take you to the top-level page for the specific job execution that failed.
 
@@ -24,8 +24,8 @@ image::images/job_view.png[]
 3. *Google Cloud Storage (GCS) Upload Report:* Link to the screen which lists out the artifacts uploaded to GCS during this job execution.
 4. *Pipeline Steps:*: A breakdown of the pipline that was executed, along with individual log output for each step in the pipeline.
 
-[float]
-==== Viewing ciGroup/test Logs
+[discrete]
+=== Viewing ciGroup/test Logs
 
 To view the logs for a failed specific ciGroup, jest, mocha, type checkers, linters, etc., click on the *Pipeline Steps* link in from the Job page.
 
diff --git a/docs/developer/contributing/kibana-issue-reporting.asciidoc b/docs/developer/contributing/kibana-issue-reporting.asciidoc
index 36c50b612d675..63366ae2aa6bb 100644
--- a/docs/developer/contributing/kibana-issue-reporting.asciidoc
+++ b/docs/developer/contributing/kibana-issue-reporting.asciidoc
@@ -1,8 +1,8 @@
 [[kibana-issue-reporting]]
-=== Effective issue reporting in {kib}
+== Effective issue reporting in {kib}
 
-[float]
-==== Voicing the importance of an issue
+[discrete]
+=== Voicing the importance of an issue
 
 We seriously appreciate thoughtful comments. If an issue is important to
 you, add a comment with a solid write up of your use case and explain
@@ -17,8 +17,8 @@ https://github.com/blog/2119-add-reactions-to-pull-requests-issues-and-comments[
 thumbs up reaction] on the issue itself and on the comment which best
 summarizes your thoughts.
 
-[float]
-==== "`My issue isn’t getting enough attention`"
+[discrete]
+=== "`My issue isn’t getting enough attention`"
 
 First of all, *sorry about that!* We want you to have a great time with
 {kib}.
@@ -31,8 +31,8 @@ more pressing issues.
 Feel free to bump your issues if you think they’ve been neglected for a
 prolonged period.
 
-[float]
-==== "`I want to help!`"
+[discrete]
+=== "`I want to help!`"
 
 *Now we’re talking*. If you have a bug fix or new feature that you would
 like to contribute to {kib}, please *find or open an issue about it
diff --git a/docs/developer/contributing/linting.asciidoc b/docs/developer/contributing/linting.asciidoc
index 234bd90478907..0d05afa504538 100644
--- a/docs/developer/contributing/linting.asciidoc
+++ b/docs/developer/contributing/linting.asciidoc
@@ -1,5 +1,5 @@
 [[kibana-linting]]
-=== Linting
+== Linting
 
 A note about linting: We use http://eslint.org[eslint] to check that the
 link:STYLEGUIDE.md[styleguide] is being followed. It runs in a
@@ -34,8 +34,8 @@ for your editor, and browse our
 https://github.com/elastic/kibana/blob/master/.editorconfig[`.editorconfig`]
 file to see what config rules we set up.
 
-[float]
-==== Setup Guide for VS Code Users
+[discrete]
+== Setup Guide for VS Code Users
 
 Note that for VSCode, to enable "`live`" linting of TypeScript (and
 other) file types, you will need to modify your local settings, as shown
diff --git a/docs/developer/contributing/pr-review.asciidoc b/docs/developer/contributing/pr-review.asciidoc
index ebab3b24aaaee..885725795b0b9 100644
--- a/docs/developer/contributing/pr-review.asciidoc
+++ b/docs/developer/contributing/pr-review.asciidoc
@@ -1,5 +1,5 @@
 [[pr-review]]
-=== Pull request review guidelines
+== Pull request review guidelines
 
 Every change made to {kib} must be held to a high standard, and while the responsibility for quality in a pull request ultimately lies with the author, {kib} team members have the responsibility as reviewers to verify during their review process.
 
@@ -10,24 +10,24 @@ It is not expected nor intended for a PR review to take the shape of this docume
 While the review process is always done by Elastic staff members, these guidelines apply to all pull requests regardless of whether they are authored by community members or Elastic staff.
 
 
-[float]
-==== Target audience
+[discrete]
+=== Target audience
 
 The target audience for this document are pull request reviewers. For {kib} maintainers, the PR review is the only part of the contributing process in which we have complete control. The author of any given pull request may not be up to speed on the latest expectations we have for pull requests, and they may have never read our guidelines at all. It's our responsibility as reviewers to guide folks through this process, but it's hard to do that consistently without a common set of documented principles.
 
 Pull request authors can benefit from reading this document as well because it'll help establish a common set of expectations between authors and reviewers early.
 
 
-[float]
-==== Reject fast
+[discrete]
+=== Reject fast
 
 Every pull request is different, and before reviewing any given PR, reviewers should consider the optimal way to approach the PR review so that if the change is ultimately rejected, it is done so as early in the process as possible.
 
 For example, a reviewer may want to do a product level review as early as possible for a PR that includes a new UI feature. On the other hand, perhaps the author is submitting a new feature that has been rejected in the past due to key architectural decisions, in which case it may be appropriate for the reviewer to focus on the soundness of the architecture before diving into anything else.
 
 
-[float]
-==== The big three
+[discrete]
+=== The big three
 
 There are a lot of discrete requirements and guidelines we want to follow in all of our pull requests, but three things in particular stand out as important above all the rest.
 
@@ -58,20 +58,20 @@ This isn't simply a question of enough test files. The code in the tests themsel
 
 All of our code should have unit tests that verify its behaviors, including not only the "happy path", but also edge cases, error handling, etc.  When you change an existing API of a module, then there should always be at least one failing unit test, which in turn means we need to verify that all code consuming that API properly handles the change if necessary. For modules at a high enough level, this will mean we have breaking change in the product, which we'll need to handle accordingly.
 
-In addition to extensive unit test coverage, PRs should include relevant functional and integration tests. In some cases, we may simply be testing a programmatic interface (e.g. a service) that is integrating with the file system, the network, Elasticsearch, etc. In other cases, we'll be testing REST APIs over HTTP or comparing screenshots/snapshots with prior known acceptable state. In the worst case, we are doing browser-based functional testing on a running instance of {kib} using selenium.
+In addition to extensive unit test coverage, PRs should include relevant functional and integration tests. In some cases, we may simply be testing a programmatic interface (e.g. a service) that is integrating with the file system, the network, {es}, etc. In other cases, we'll be testing REST APIs over HTTP or comparing screenshots/snapshots with prior known acceptable state. In the worst case, we are doing browser-based functional testing on a running instance of {kib} using selenium.
 
 Enhancements are pretty much always going to have extensive unit tests as a base as well as functional and integration testing. Bug fixes should always include regression tests to ensure that same bug does not manifest again in the future.
 --
 
 
-[float]
-==== Product level review
+[discrete]
+=== Product level review
 
 Reviewers are not simply evaluating the code itself, they are also evaluating the quality of the user-facing change in the product. This generally means they need to check out the branch locally and "play around" with it. In addition to the "do we want this change in the product" details, the reviewer should be looking for bugs and evaluating how approachable and useful the feature is as implemented. Special attention should be given to error scenarios and edge cases to ensure they are all handled well within the product.
 
 
-[float]
-==== Consistency, style, readability
+[discrete]
+=== Consistency, style, readability
 
 Having a relatively consistent codebase is an important part of us building a sustainable project. With dozens of active contributors at any given time, we rely on automation to help ensure consistency - we enforce a comprehensive set of linting rules through CI. We're also rolling out prettier to make this even more automatic.
 
@@ -86,8 +86,8 @@ When in doubt, relying on "prior art" in the codebase, especially in and around
 There may also be times when a person is inspired by a particular contribution to introduce a new way to style code that we already have different style guidelines or "prior art" for. It's OK to bring this up in a pull request, but ultimately that discussion should branch off into a separate issue or pull request to update the appropriate guide. If this change is prompted by a reviewer, then the original PR should not be blocked on this.  If the change is prompted by the author, then they can either update the PR to be consistent with our existing guidelines (preferred) or they can choose to block the PR entirely on that separate styleguide discussion.
 
 
-[float]
-==== Nitpicking
+[discrete]
+=== Nitpicking
 
 Nitpicking is when a reviewer identifies trivial and unimportant details in a pull request and asks the author to change them. This is a completely subjective category that is impossible to define universally, and it's equally impractical to define a blanket policy on nitpicking that everyone will be happy with.
 
@@ -96,14 +96,14 @@ Reviewers should feel comfortable giving any feedback they have on a pull reques
 Often, reviewers have an opinion about whether the feedback they are about to give is a nitpick or not. While not required, it can be really helpful to identify that feedback as such, for example "nit: a newline after this would be helpful". This helps the author understand your intention.
 
 
-[float]
-==== Handling disagreements
+[discrete]
+=== Handling disagreements
 
 Conflicting opinions between reviewers and authors happen, and sometimes it is hard to reconcile those opinions. Ideally folks can work together in the spirit of these guidelines toward a consensus, but if that doesn't work out it may be best to bring a third person into the discussion. Our pull requests generally have two reviewers, so an appropriate third person may already be obvious. Otherwise, reach out to the functional area that is most appropriate or to technical leadership if an area isn't obvious.
 
 
-[float]
-==== Inappropriate review feedback
+[discrete]
+=== Inappropriate review feedback
 
 Whether or not a bit of feedback is appropriate for a pull request is often dependent on the motivation for giving the feedback in the first place.
 
@@ -112,8 +112,8 @@ _Demanding_ an author make changes based primarily on the mindset of "how would
 Inflammatory feedback such as "this is crap" isn't feedback at all. It's both mean and unhelpful, and it is never appropriate.
 
 
-[float]
-==== A checklist
+[discrete]
+=== A checklist
 
 Establishing a comprehensive checklist for all of the things that should happen in all possible pull requests is impractical, but that doesn't mean we lack a concrete set of minimum requirements that we can enumerate. The following items should be double checked for any pull request:
 
diff --git a/docs/developer/getting-started/building-kibana.asciidoc b/docs/developer/getting-started/building-kibana.asciidoc
index e1f1ca336a5da..72054b1628fc2 100644
--- a/docs/developer/getting-started/building-kibana.asciidoc
+++ b/docs/developer/getting-started/building-kibana.asciidoc
@@ -1,5 +1,5 @@
 [[building-kibana]]
-=== Building a {kib} distributable
+== Building a {kib} distributable
 
 The following commands will build a {kib} production distributable.
 
@@ -15,8 +15,8 @@ You can get all build options using the following command:
 yarn build --help
 ----
 
-[float]
-==== Building OS packages
+[discrete]
+=== Building OS packages
 
 Packages are built using fpm, dpkg, and rpm.  Package building has only been tested on Linux and is not supported on any other platform.
 
diff --git a/docs/developer/getting-started/debugging.asciidoc b/docs/developer/getting-started/debugging.asciidoc
index b369dcda748af..a3fb12ec1f6a3 100644
--- a/docs/developer/getting-started/debugging.asciidoc
+++ b/docs/developer/getting-started/debugging.asciidoc
@@ -1,15 +1,15 @@
 [[kibana-debugging]]
-=== Debugging {kib}
+== Debugging {kib}
 
 For information about how to debug unit tests, refer to <<debugging-unit-tests>>.
 
-[float]
-==== Server Code
+[discrete]
+=== Server Code
 
 `yarn debug` will start the server with Node's inspect flag. {kib}'s development mode will start three processes on ports `9229`, `9230`, and `9231`. Chrome's developer tools need to be configured to connect to all three connections. Add `localhost:<port>` for each {kib} process in Chrome's developer tools connection tab.
 
-[float]
-==== Instrumenting with Elastic APM
+[discrete]
+=== Instrumenting with Elastic APM
 
 {kib} ships with the
 https://github.com/elastic/apm-agent-nodejs[Elastic APM Node.js Agent]
@@ -18,7 +18,7 @@ built-in for debugging purposes.
 Its default configuration is meant to be used by core {kib} developers
 only, but it can easily be re-configured to your needs. In its default
 configuration it’s disabled and will, once enabled, send APM data to a
-centrally managed Elasticsearch cluster accessible only to Elastic
+centrally managed {es} cluster accessible only to Elastic
 employees.
 
 To change the location where data is sent, use the
diff --git a/docs/developer/getting-started/development-plugin-resources.asciidoc b/docs/developer/getting-started/development-plugin-resources.asciidoc
index dfe8efc4fef57..8f81138b81ed7 100644
--- a/docs/developer/getting-started/development-plugin-resources.asciidoc
+++ b/docs/developer/getting-started/development-plugin-resources.asciidoc
@@ -1,14 +1,14 @@
 [[development-plugin-resources]]
-=== Plugin Resources
+== Plugin Resources
 
 Here are some resources that are helpful for getting started with plugin development.
 
-[float]
-==== Some light reading
+[discrete]
+=== Some light reading
 If you haven't already, start with <<development-getting-started>>. If you are planning to add your plugin to the {kib} repo, read the <<contributing>> guide, if you are building a plugin externally, read <<external-plugin-development>>. In both cases, read up on our recommended <<development-best-practices>>.
 
-[float]
-==== Creating an empty plugin
+[discrete]
+=== Creating an empty plugin
 
 You can use the <<automatic-plugin-generator>> to get a basic structure for a new plugin. Plugins that are not part of the
 {kib} repo should be developed inside the `plugins` folder.  If you are building a new plugin to check in to the {kib} repo,
@@ -18,15 +18,15 @@ you will choose between a few locations:
  - {kib-repo}tree/{branch}/src/plugins[src/plugins] for open source licensed plugins
  - {kib-repo}tree/{branch}/examples[examples] for developer example plugins (these will not be included in the distributables)
 
-[float]
-==== Elastic UI Framework
+[discrete]
+=== Elastic UI Framework
 If you're developing a plugin that has a user interface, take a look at our https://elastic.github.io/eui[Elastic UI Framework].
 It documents the CSS and React components we use to build {kib}'s user interface.
 
 You're welcome to use these components, but be aware that they are rapidly evolving, and we might introduce breaking changes that will disrupt your plugin's UI.
 
-[float]
-==== TypeScript Support
+[discrete]
+=== TypeScript Support
 We recommend your plugin code is written in http://www.typescriptlang.org/[TypeScript].
 To enable TypeScript support, create a `tsconfig.json` file at the root of your plugin that looks something like this:
 
@@ -48,14 +48,14 @@ TypeScript code is automatically converted into JavaScript during development,
 but not in the distributable version of {kib}. If you use the
 {kib-repo}blob/{branch}/packages/kbn-plugin-helpers[@kbn/plugin-helpers] to build your plugin, then your `.ts` and `.tsx` files will be permanently transpiled before your plugin is archived. If you have your own build process, make sure to run the TypeScript compiler on your source files and ship the compilation output so that your plugin will work with the distributable version of {kib}.
 
-[float]
-==== {kib} platform migration guide
+[discrete]
+=== {kib} platform migration guide
 
 {kib-repo}blob/{branch}/src/core/MIGRATION.md#migrating-legacy-plugins-to-the-new-platform[This guide]
 provides an action plan for moving a legacy plugin to the new platform. 
 
-[float]
-==== Externally developed plugins
+[discrete]
+=== Externally developed plugins
 
 If you are building a plugin outside of the {kib} repo, read <<external-plugin-development>>.
 
diff --git a/docs/developer/getting-started/index.asciidoc b/docs/developer/getting-started/index.asciidoc
index 47c4a52daf303..2ac51b6cf86f8 100644
--- a/docs/developer/getting-started/index.asciidoc
+++ b/docs/developer/getting-started/index.asciidoc
@@ -3,7 +3,7 @@
 
 Get started building your own plugins, or contributing directly to the {kib} repo.
 
-[float]
+[discrete]
 [[get-kibana-code]]
 === Get the code
 
@@ -15,7 +15,7 @@ git clone https://github.com/[YOUR_USERNAME]/kibana.git kibana
 cd kibana
 ----
 
-[float]
+[discrete]
 === Install dependencies
 
 Install the version of Node.js listed in the `.node-version` file. This
@@ -67,11 +67,11 @@ corrupted packages in your yarn cache which you can clean with:
 yarn cache clean
 ----
 
-[float]
+[discrete]
 === Configure environmental settings
 
 [[increase-nodejs-heap-size]]
-[float]
+[discrete]
 ==== Increase node.js heap size
 
 {kib} is a big project and for some commands it can happen that the
@@ -81,10 +81,10 @@ by setting the `--max_old_space_size` option on the command line. To set
 the limit for all commands, simply add the following line to your shell
 config: `export NODE_OPTIONS="--max_old_space_size=2048"`.
 
-[float]
-=== Run Elasticsearch
+[discrete]
+=== Run {es}
 
-Run the latest Elasticsearch snapshot. Specify an optional license with the `--license` flag.
+Run the latest {es} snapshot. Specify an optional license with the `--license` flag.
 
 [source,bash]
 ----
@@ -96,7 +96,7 @@ yarn es snapshot --license trial
 Read about more options for <<running-elasticsearch>>, like connecting to a remote host, running from source,
 preserving data inbetween runs, running remote cluster, etc.
 
-[float]
+[discrete]
 === Run {kib}
 
 In another terminal window, start up {kib}. Include developer examples by adding an optional `--run-examples` flag.
@@ -110,13 +110,13 @@ View all available options by running `yarn start --help`
 
 Read about more advanced options for <<running-kibana-advanced>>.
 
-[float]
+[discrete]
 === Code away!
 
 You are now ready to start developing. Changes to your files should be picked up automatically. Server side changes will
 cause the {kib} server to reboot.
 
-[float]
+[discrete]
 === More information
 
 * <<running-kibana-advanced>>
@@ -129,12 +129,12 @@ cause the {kib} server to reboot.
 
 * <<development-plugin-resources>>
 
-include::running-kibana-advanced.asciidoc[]
+include::running-kibana-advanced.asciidoc[leveloffset=+1]
 
-include::sample-data.asciidoc[]
+include::sample-data.asciidoc[leveloffset=+1]
 
-include::debugging.asciidoc[]
+include::debugging.asciidoc[leveloffset=+1]
 
-include::building-kibana.asciidoc[]
+include::building-kibana.asciidoc[leveloffset=+1]
 
-include::development-plugin-resources.asciidoc[]
\ No newline at end of file
+include::development-plugin-resources.asciidoc[leveloffset=+1]
\ No newline at end of file
diff --git a/docs/developer/getting-started/running-kibana-advanced.asciidoc b/docs/developer/getting-started/running-kibana-advanced.asciidoc
index e36f38de1b366..c3b7847b0f8ba 100644
--- a/docs/developer/getting-started/running-kibana-advanced.asciidoc
+++ b/docs/developer/getting-started/running-kibana-advanced.asciidoc
@@ -1,5 +1,5 @@
 [[running-kibana-advanced]]
-=== Running {kib}
+== Running {kib}
 
 Change to your local {kib} directory. Start the development server.
 
@@ -23,8 +23,8 @@ By default, you can log in with username `elastic` and password
 `changeme`. See the `--help` options on `yarn es <command>` if
 you’d like to configure a different password.
 
-[float]
-==== Running {kib} in Open-Source mode
+[discrete]
+=== Running {kib} in Open-Source mode
 
 If you’re looking to only work with the open-source software, supply the
 license type to `yarn es`:
@@ -41,8 +41,8 @@ And start {kib} with only open-source code:
 yarn start --oss
 ----
 
-[float]
-==== Unsupported URL Type
+[discrete]
+=== Unsupported URL Type
 
 If you’re installing dependencies and seeing an error that looks
 something like
@@ -56,9 +56,9 @@ need to run `yarn kbn bootstrap`. For more info, see
 link:#setting-up-your-development-environment[Setting Up Your
 Development Environment] above.
 
-[float]
+[discrete]
 [[customize-kibana-yml]]
-==== Customizing `config/kibana.dev.yml`
+=== Customizing `config/kibana.dev.yml`
 
 The `config/kibana.yml` file stores user configuration directives.
 Since this file is checked into source control, however, developer
@@ -70,8 +70,8 @@ non-dev version and accepts any of the
 https://www.elastic.co/guide/en/kibana/current/settings.html[standard
 settings].
 
-[float]
-==== Potential Optimization Pitfalls
+[discrete]
+=== Potential Optimization Pitfalls
 
 * Webpack is trying to include a file in the bundle that I deleted and
 is now complaining about it is missing
@@ -79,9 +79,9 @@ is now complaining about it is missing
 directory, but webpack isn’t adapting
 * (if you discover other scenarios, please send a PR!)
 
-[float]
-==== Setting Up SSL
+[discrete]
+=== Setting Up SSL
 
 {kib} includes self-signed certificates that can be used for
 development purposes in the browser and for communicating with
-Elasticsearch: `yarn start --ssl` & `yarn es snapshot --ssl`.
\ No newline at end of file
+{es}: `yarn start --ssl` & `yarn es snapshot --ssl`.
\ No newline at end of file
diff --git a/docs/developer/getting-started/sample-data.asciidoc b/docs/developer/getting-started/sample-data.asciidoc
index 376211ceb2634..0d313cbabe64e 100644
--- a/docs/developer/getting-started/sample-data.asciidoc
+++ b/docs/developer/getting-started/sample-data.asciidoc
@@ -1,17 +1,17 @@
 [[sample-data]]
-=== Installing sample data
+== Installing sample data
 
-There are a couple ways to easily get data ingested into Elasticsearch.
+There are a couple ways to easily get data ingested into {es}.
 
-[float]
-==== Sample data packages available for one click installation
+[discrete]
+=== Sample data packages available for one click installation
 
 The easiest is to install one or more of our vailable sample data packages. If you have no data, you should be 
 prompted to install when running {kib} for the first time. You can also access and install the sample data packages
 by going to the home page and clicking "add sample data".
 
-[float]
-==== makelogs script
+[discrete]
+=== makelogs script
 
 The provided `makelogs` script will generate sample data.
 
@@ -22,10 +22,10 @@ node scripts/makelogs --auth <username>:<password>
 
 The default username and password combination are `elastic:changeme`
 
-Make sure to execute `node scripts/makelogs` *after* elasticsearch is up and running!
+Make sure to execute `node scripts/makelogs` *after* {es} is up and running!
 
-[float]
-==== CSV upload
+[discrete]
+=== CSV upload
 
 If running with a platinum or trial license, you can also use the CSV uploader provided inside the Machine learning app.
 Navigate to the Data visualizer to upload your data from a file.
\ No newline at end of file
diff --git a/docs/developer/plugin/external-plugin-functional-tests.asciidoc b/docs/developer/plugin/external-plugin-functional-tests.asciidoc
index 44f636d627011..706bf6af8ed9b 100644
--- a/docs/developer/plugin/external-plugin-functional-tests.asciidoc
+++ b/docs/developer/plugin/external-plugin-functional-tests.asciidoc
@@ -1,10 +1,10 @@
 [[external-plugin-functional-tests]]
-=== Functional Tests for Plugins outside the {kib} repo
+== Functional Tests for Plugins outside the {kib} repo
 
 Plugins use the `FunctionalTestRunner` by running it out of the {kib} repo. Ensure that your {kib} Development Environment is setup properly before continuing.
 
-[float]
-==== Writing your own configuration
+[discrete]
+=== Writing your own configuration
 
 Every project or plugin should have its own `FunctionalTestRunner` config file. Just like {kib}'s, this config file will define all of the test files to load, providers for Services and PageObjects, as well as configuration options for certain services.
 
@@ -82,8 +82,8 @@ From the root of your repo you should now be able to run the `FunctionalTestRunn
 node ../../kibana/scripts/functional_test_runner
 -----------
 
-[float]
-==== Using esArchiver
+[discrete]
+=== Using esArchiver
 
 We're working on documentation for this, but for now the best place to look is the original {kib-repo}/issues/10359[pull request].
 
diff --git a/docs/developer/plugin/external-plugin-localization.asciidoc b/docs/developer/plugin/external-plugin-localization.asciidoc
index c151832ab53fa..d30dec1a8f46b 100644
--- a/docs/developer/plugin/external-plugin-localization.asciidoc
+++ b/docs/developer/plugin/external-plugin-localization.asciidoc
@@ -1,10 +1,10 @@
 [[external-plugin-localization]]
-=== Localization for plugins outside the {kib} repo
+== Localization for plugins outside the {kib} repo
 
 To introduce localization for your plugin, use our i18n tool to create IDs and default messages. You can then extract these IDs with respective default messages into localization JSON files for {kib} to use when running your plugin.
 
-[float]
-==== Adding localization to your plugin
+[discrete]
+=== Adding localization to your plugin
 
 You must add a `translations` directory at the root of your plugin. This directory will contain the translation files that {kib} uses.
 
@@ -19,8 +19,8 @@ You must add a `translations` directory at the root of your plugin. This directo
 -----------
 
 
-[float]
-==== Using {kib} i18n tooling
+[discrete]
+=== Using {kib} i18n tooling
 To simplify the localization process, {kib} provides tools for the following functions:
 
 * Verify all translations have translatable strings and extract default messages from templates
@@ -51,8 +51,8 @@ An example {kib} `.i18nrc.json` is {blob}.i18nrc.json[here].
 
 Full documentation about i18n tooling is {blob}src/dev/i18n/README.md[here].
 
-[float]
-==== Extracting default messages
+[discrete]
+=== Extracting default messages
 To extract the default messages from your plugin, run the following command:
 
 ["source","shell"]
@@ -62,8 +62,8 @@ node scripts/i18n_extract --output-dir ./translations --include-config ../kibana
 
 This outputs a `en.json` file inside the `translations` directory. To localize other languages, clone the file and translate each string.
 
-[float]
-==== Checking i18n messages
+[discrete]
+=== Checking i18n messages
 
 Checking i18n does the following:
 
@@ -80,8 +80,8 @@ node scripts/i18n_check --fix --include-config ../kibana-extra/myPlugin/.i18nrc.
 -----------
 
 
-[float]
-==== Implementing i18n in the UI
+[discrete]
+=== Implementing i18n in the UI
 
 {kib} relies on several UI frameworks (ReactJS and AngularJS) and
 requires localization in different environments (browser and NodeJS).
@@ -97,8 +97,8 @@ so both React and AngularJS frameworks use the same engine and the same
 message syntax.
 
 
-[float]
-===== i18n for vanilla JavaScript
+[discrete]
+==== i18n for vanilla JavaScript
 
 ["source","js"]
 -----------
@@ -111,8 +111,8 @@ export const HELLO_WORLD = i18n.translate('hello.wonderful.world', {
 
 Full details are {kib-repo}tree/master/packages/kbn-i18n#vanilla-js[here].
 
-[float]
-===== i18n for React
+[discrete]
+==== i18n for React
 
 To localize strings in React, use either `FormattedMessage` or `i18n.translate`.
 
@@ -137,8 +137,8 @@ Full details are {kib-repo}tree/master/packages/kbn-i18n#react[here].
 
 
 
-[float]
-===== i18n for Angular
+[discrete]
+==== i18n for Angular
 
 You are encouraged to use `i18n.translate()` by statically importing `i18n` from `@kbn/i18n` wherever possible in your Angular code. Angular wrappers use the translation `service` with the i18n engine under the hood.
 
@@ -156,8 +156,8 @@ The translation directive has the following syntax:
 Full details are {kib-repo}tree/master/packages/kbn-i18n#angularjs[here].
 
 
-[float]
-==== Resources
+[discrete]
+=== Resources
 
 To learn more about i18n tooling, see {blob}src/dev/i18n/README.md[i18n dev tooling].
 
diff --git a/docs/developer/plugin/index.asciidoc b/docs/developer/plugin/index.asciidoc
index 73f1d2c908fa7..dd83cf234dea4 100644
--- a/docs/developer/plugin/index.asciidoc
+++ b/docs/developer/plugin/index.asciidoc
@@ -9,9 +9,9 @@ The {kib} plugin interfaces are in a state of constant development.  We cannot p
 Most developers who contribute code directly to the {kib} repo are writing code inside plugins, so our <<contributing>> docs are the best place to
 start. However, there are a few differences when developing plugins outside the {kib} repo. These differences are covered here.
 
-[float]
+[discrete]
 [[automatic-plugin-generator]]
-==== Automatic plugin generator
+=== Automatic plugin generator
 
 We recommend that you kick-start your plugin by generating it with the {kib-repo}tree/{branch}/packages/kbn-plugin-generator[Kibana Plugin Generator]. Run the following in the {kib} repo, and you will be asked a couple questions, see some progress bars, and have a freshly generated plugin ready for you to play with in {kib}'s `plugins` folder.
 
@@ -20,7 +20,7 @@ We recommend that you kick-start your plugin by generating it with the {kib-repo
 node scripts/generate_plugin my_plugin_name # replace "my_plugin_name" with your desired plugin name
 -----------
 
-[float]
+[discrete]
 === Plugin location
 
 The {kib} directory must be named `kibana`, and your plugin directory should be located in the root of `kibana` in a `plugins` directory, for example:
@@ -37,6 +37,6 @@ The {kib} directory must be named `kibana`, and your plugin directory should be
 * <<external-plugin-functional-tests>>
 * <<external-plugin-localization>>
 
-include::external-plugin-functional-tests.asciidoc[]
+include::external-plugin-functional-tests.asciidoc[leveloffset=+1]
 
-include::external-plugin-localization.asciidoc[]
+include::external-plugin-localization.asciidoc[leveloffset=+1]
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.embeddable.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.embeddable.md
new file mode 100644
index 0000000000000..027ae4209b77f
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.embeddable.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [ApplyGlobalFilterActionContext](./kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.md) &gt; [embeddable](./kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.embeddable.md)
+
+## ApplyGlobalFilterActionContext.embeddable property
+
+<b>Signature:</b>
+
+```typescript
+embeddable?: IEmbeddable;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.filters.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.filters.md
new file mode 100644
index 0000000000000..6d1d20580fb19
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.filters.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [ApplyGlobalFilterActionContext](./kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.md) &gt; [filters](./kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.filters.md)
+
+## ApplyGlobalFilterActionContext.filters property
+
+<b>Signature:</b>
+
+```typescript
+filters: Filter[];
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.md
new file mode 100644
index 0000000000000..62817cd0a1e33
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.md
@@ -0,0 +1,20 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [ApplyGlobalFilterActionContext](./kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.md)
+
+## ApplyGlobalFilterActionContext interface
+
+<b>Signature:</b>
+
+```typescript
+export interface ApplyGlobalFilterActionContext 
+```
+
+## Properties
+
+|  Property | Type | Description |
+|  --- | --- | --- |
+|  [embeddable](./kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.embeddable.md) | <code>IEmbeddable</code> |  |
+|  [filters](./kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.filters.md) | <code>Filter[]</code> |  |
+|  [timeFieldName](./kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.timefieldname.md) | <code>string</code> |  |
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.timefieldname.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.timefieldname.md
new file mode 100644
index 0000000000000..a5cf58018ec65
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.timefieldname.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [ApplyGlobalFilterActionContext](./kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.md) &gt; [timeFieldName](./kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.timefieldname.md)
+
+## ApplyGlobalFilterActionContext.timeFieldName property
+
+<b>Signature:</b>
+
+```typescript
+timeFieldName?: string;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.md
index 4852ad15781c7..db41936f35cca 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.md
@@ -48,6 +48,7 @@
 |  Interface | Description |
 |  --- | --- |
 |  [AggParamOption](./kibana-plugin-plugins-data-public.aggparamoption.md) |  |
+|  [ApplyGlobalFilterActionContext](./kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.md) |  |
 |  [DataPublicPluginSetup](./kibana-plugin-plugins-data-public.datapublicpluginsetup.md) |  |
 |  [DataPublicPluginStart](./kibana-plugin-plugins-data-public.datapublicpluginstart.md) |  |
 |  [EsQueryConfig](./kibana-plugin-plugins-data-public.esqueryconfig.md) |  |
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.plugin.setup.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.plugin.setup.md
index 7bae595e75ad0..a0c9b38792825 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.plugin.setup.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.plugin.setup.md
@@ -7,14 +7,14 @@
 <b>Signature:</b>
 
 ```typescript
-setup(core: CoreSetup, { expressions, uiActions, usageCollection }: DataSetupDependencies): DataPublicPluginSetup;
+setup(core: CoreSetup<DataStartDependencies, DataPublicPluginStart>, { expressions, uiActions, usageCollection }: DataSetupDependencies): DataPublicPluginSetup;
 ```
 
 ## Parameters
 
 |  Parameter | Type | Description |
 |  --- | --- | --- |
-|  core | <code>CoreSetup</code> |  |
+|  core | <code>CoreSetup&lt;DataStartDependencies, DataPublicPluginStart&gt;</code> |  |
 |  { expressions, uiActions, usageCollection } | <code>DataSetupDependencies</code> |  |
 
 <b>Returns:</b>
diff --git a/docs/drilldowns/explore-underlying-data.asciidoc b/docs/drilldowns/explore-underlying-data.asciidoc
new file mode 100644
index 0000000000000..e0f940f73e96e
--- /dev/null
+++ b/docs/drilldowns/explore-underlying-data.asciidoc
@@ -0,0 +1,41 @@
+[[explore-underlying-data]]
+== Explore the underlying data for a visualization
+
+++++
+<titleabbrev>Explore the underlying data</titleabbrev>
+++++
+
+Dashboard panels have an *Explore underlying data* action that navigates you to *Discover*,
+where you can narrow your documents to the ones you'll most likely use in a  visualization.
+This action is available for visualizations backed by a single index pattern.
+
+You can access *Explore underlying data* in two ways: from the panel context
+menu or from the menu that appears when you interact with the chart.
+
+[float]
+[[explore-data-from-panel-context-menu]]
+=== Explore data from panel context menu
+
+The *Explore underlying data* action in the panel menu navigates you to Discover,
+carrying over the index pattern, filters, query, and time range for the visualization.
+
+[role="screenshot"]
+image::images/explore_data_context_menu.png[Explore underlying data from panel context menu]
+
+[float]
+[[explore-data-from-chart]]
+=== Explore data from chart action
+
+Initiating *Explore underlying data* from the chart also navigates to Discover,
+carrying over the current context for the visualization. In addition, this action
+applies the filters and time range created by the events that triggered the action.
+
+[role="screenshot"]
+image::images/explore_data_in_chart.png[Explore underlying data from chart]
+
+You can disable this action by adding the following line to your `kibana.yml` config.
+
+["source","yml"]
+-----------
+xpack.discoverEnhanced.actions.exploreDataInChart.enabled: false
+-----------
diff --git a/docs/drilldowns/images/explore_data_context_menu.png b/docs/drilldowns/images/explore_data_context_menu.png
new file mode 100644
index 0000000000000..5742991030c89
Binary files /dev/null and b/docs/drilldowns/images/explore_data_context_menu.png differ
diff --git a/docs/drilldowns/images/explore_data_in_chart.png b/docs/drilldowns/images/explore_data_in_chart.png
new file mode 100644
index 0000000000000..05d4f5fac9b2f
Binary files /dev/null and b/docs/drilldowns/images/explore_data_in_chart.png differ
diff --git a/docs/management/advanced-options.asciidoc b/docs/management/advanced-options.asciidoc
index 9a94c25bcdf6e..7dc360fd721f4 100644
--- a/docs/management/advanced-options.asciidoc
+++ b/docs/management/advanced-options.asciidoc
@@ -228,7 +228,7 @@ might increase the search time. This setting is off by default. Users must opt-i
 `siem:defaultAnomalyScore`:: The threshold above which Machine Learning job anomalies are displayed in the SIEM app.
 `siem:defaultIndex`:: A comma-delimited list of Elasticsearch indices from which the SIEM app collects events.
 `siem:ipReputationLinks`:: A JSON array containing links for verifying the reputation of an IP address. The links are displayed on
-{siem-guide}/siem-ui-overview.html#network-ui[IP detail] pages.
+{security-guide}/siem-ui-overview.html#network-ui[IP detail] pages.
 `siem:enableNewsFeed`:: Enables the security news feed on the SIEM *Overview*
 page.
 `siem:newsFeedUrl`:: The URL from which the security news feed content is
diff --git a/docs/siem/index.asciidoc b/docs/siem/index.asciidoc
index 9d17b5209304f..ceb4ac2bf1f34 100644
--- a/docs/siem/index.asciidoc
+++ b/docs/siem/index.asciidoc
@@ -19,7 +19,7 @@ image::siem/images/overview-ui.png[SIEM Overview in Kibana]
 == Add data
 
 Kibana provides step-by-step instructions to help you add data. The
-{siem-guide}[SIEM Guide] is a good source for more
+{security-guide}[Security Guide] is a good source for more
 detailed information and instructions.
 
 [float]
diff --git a/docs/siem/siem-ui.asciidoc b/docs/siem/siem-ui.asciidoc
index 21a2ed55fdfdc..1caa13dc6c903 100644
--- a/docs/siem/siem-ui.asciidoc
+++ b/docs/siem/siem-ui.asciidoc
@@ -43,7 +43,7 @@ for creating signals. The SIEM app comes with prebuilt rules that search for
 suspicious activity on your network and hosts. Additionally, you can
 create your own rules.
 
-See {siem-guide}/detection-engine-overview.html[Detections] in the SIEM 
+See {security-guide}/detection-engine-overview.html[Detections] in the SIEM 
 Guide for information on managing detection rules and signals via the UI 
 or the Detections API.
 
@@ -61,7 +61,7 @@ saved Timelines. Additionally, you can send cases to external systems from
 within SIEM (currently ServiceNow and Jira).
 
 For information about opening, updating, and closing cases, see
-{siem-guide}/cases-overview.html[Cases] in the SIEM Guide.
+{security-guide}/cases-overview.html[Cases] in the SIEM Guide.
 
 [role="screenshot"]
 image::siem/images/cases-ui.png[]
@@ -82,7 +82,7 @@ Hosts and Network pages, or even from within Timeline itself.
 A timeline is responsive and persists as you move through the SIEM app
 collecting data. 
 
-See the {siem-guide}[SIEM Guide] for more details on data sources and an
+See the {security-guide}[Security Guide] for more details on data sources and an
 overview of UI elements and capabilities.
 
 [float]
diff --git a/docs/user/alerting/action-types.asciidoc b/docs/user/alerting/action-types.asciidoc
index e8dcf689df8e4..1743edb10f92b 100644
--- a/docs/user/alerting/action-types.asciidoc
+++ b/docs/user/alerting/action-types.asciidoc
@@ -23,6 +23,10 @@ a| <<server-log-action-type, ServerLog>>
 
 | Add a message to a Kibana log.
 
+a| <<servicenow-action-type, ServiceNow>>
+
+| Push or update data to a new incident in ServiceNow.
+
 a| <<slack-action-type, Slack>>
 
 | Send a message to a Slack channel or user.
@@ -55,3 +59,4 @@ include::action-types/server-log.asciidoc[]
 include::action-types/slack.asciidoc[]
 include::action-types/webhook.asciidoc[]
 include::action-types/pre-configured-connectors.asciidoc[]
+include::action-types/servicenow.asciidoc[]
diff --git a/docs/user/alerting/action-types/servicenow.asciidoc b/docs/user/alerting/action-types/servicenow.asciidoc
new file mode 100644
index 0000000000000..32f828aea2357
--- /dev/null
+++ b/docs/user/alerting/action-types/servicenow.asciidoc
@@ -0,0 +1,72 @@
+[role="xpack"]
+[[servicenow-action-type]]
+=== ServiceNow action
+
+The ServiceNow action type uses the https://developer.servicenow.com/app.do#!/rest_api_doc?v=orlando&id=c_TableAPI[V2 Table API] to create ServiceNow incidents.
+
+[float]
+[[servicenow-connector-configuration]]
+==== Connector configuration
+
+ServiceNow connectors have the following configuration properties:
+
+Name::      The name of the connector. The name is used to identify a  connector in the management UI connector listing, or in the connector list when configuring an action.
+URL::       ServiceNow instance URL.
+Username::  Username for HTTP Basic authentication.
+Password::  Password for HTTP Basic authentication.
+
+[float]
+[[Preconfigured-servicenow-configuration]]
+==== Preconfigured action type
+
+[source,text]
+--
+ my-servicenow:
+   name: preconfigured-servicenow-action-type
+   actionTypeId: .servicenow
+   config:
+     apiUrl: https://dev94428.service-now.com/
+   secrets:
+     username: testuser
+     password: passwordkeystorevalue
+--
+
+`config` defines the action type specific to the configuration and contains the following properties:
+
+[cols="2*<"]
+|===
+
+| `apiUrl`
+| An address that corresponds to *Sender*.
+
+|===
+
+`secrets` defines sensitive information for the action type:
+
+[cols="2*<"]
+|===
+
+| `username`
+| A string that corresponds to *User*.
+
+| `password`
+| A string that corresponds to *Password*. Should be stored in the <<creating-keystore, {kib} keystore>>.
+
+|===
+
+[[servicenow-action-configuration]]
+==== Action configuration
+
+ServiceNow actions have the following configuration properties:
+
+Urgency::              The extent to which the incident resolution can delay.
+Severity::             The severity of the incident.
+Impact::               The effect an incident has on business. Can be measured by the number of affected users or by how critical it is to the business in question.
+Short description::    A short description of the incident, used for searching the contents of the knowledge base. 
+Description::          The details about the incident.
+Additional comments::  Additional information for the client, such as how to troubleshoot the issue.
+
+[[configuring-servicenow]]
+==== Configuring and testing ServiceNow
+
+ServiceNow offers free https://developer.servicenow.com/dev.do#!/guides/madrid/now-platform/pdi-guide/obtaining-a-pdi[Personal Developer Instances], which you can use to test incidents.
diff --git a/docs/user/dashboard.asciidoc b/docs/user/dashboard.asciidoc
index a812d4e3bdd2d..b812af7e981bf 100644
--- a/docs/user/dashboard.asciidoc
+++ b/docs/user/dashboard.asciidoc
@@ -160,6 +160,7 @@ When you're finished adding and arranging the panels, save the dashboard.
 . Enter the dashboard *Title* and optional *Description*, then *Save* the dashboard.
 
 include::{kib-repo-dir}/drilldowns/drilldowns.asciidoc[]
+include::{kib-repo-dir}/drilldowns/explore-underlying-data.asciidoc[]
 
 [[sharing-dashboards]]
 == Share the dashboard
diff --git a/docs/user/ml/images/ml-annotations-list.jpg b/docs/user/ml/images/ml-annotations-list.jpg
deleted file mode 100644
index 8b1194dd20c0f..0000000000000
Binary files a/docs/user/ml/images/ml-annotations-list.jpg and /dev/null differ
diff --git a/docs/user/ml/images/ml-annotations-list.png b/docs/user/ml/images/ml-annotations-list.png
new file mode 100644
index 0000000000000..f1a0b66241126
Binary files /dev/null and b/docs/user/ml/images/ml-annotations-list.png differ
diff --git a/docs/user/ml/images/ml-job-management.jpg b/docs/user/ml/images/ml-job-management.jpg
deleted file mode 100644
index efdf7923c0faa..0000000000000
Binary files a/docs/user/ml/images/ml-job-management.jpg and /dev/null differ
diff --git a/docs/user/ml/images/ml-job-management.png b/docs/user/ml/images/ml-job-management.png
new file mode 100644
index 0000000000000..4589c7093a7cf
Binary files /dev/null and b/docs/user/ml/images/ml-job-management.png differ
diff --git a/docs/user/ml/images/ml-settings.jpg b/docs/user/ml/images/ml-settings.jpg
deleted file mode 100644
index 3713be005924d..0000000000000
Binary files a/docs/user/ml/images/ml-settings.jpg and /dev/null differ
diff --git a/docs/user/ml/images/ml-settings.png b/docs/user/ml/images/ml-settings.png
new file mode 100644
index 0000000000000..f5c9fca647389
Binary files /dev/null and b/docs/user/ml/images/ml-settings.png differ
diff --git a/docs/user/ml/images/ml-single-metric-viewer.jpg b/docs/user/ml/images/ml-single-metric-viewer.jpg
deleted file mode 100644
index 2fbb9387d1e29..0000000000000
Binary files a/docs/user/ml/images/ml-single-metric-viewer.jpg and /dev/null differ
diff --git a/docs/user/ml/images/ml-single-metric-viewer.png b/docs/user/ml/images/ml-single-metric-viewer.png
new file mode 100644
index 0000000000000..04c21d9bc533a
Binary files /dev/null and b/docs/user/ml/images/ml-single-metric-viewer.png differ
diff --git a/docs/user/ml/images/outliers.png b/docs/user/ml/images/outliers.png
index 3f4c5f6c6bbf0..874ebbc79201c 100644
Binary files a/docs/user/ml/images/outliers.png and b/docs/user/ml/images/outliers.png differ
diff --git a/docs/user/ml/index.asciidoc b/docs/user/ml/index.asciidoc
index 1bc74ce87de08..214dae2b96e04 100644
--- a/docs/user/ml/index.asciidoc
+++ b/docs/user/ml/index.asciidoc
@@ -47,20 +47,20 @@ create {anomaly-jobs} and manage jobs and {dfeeds} from the *Job Management*
 pane: 
 
 [role="screenshot"]
-image::user/ml/images/ml-job-management.jpg[Job Management]
+image::user/ml/images/ml-job-management.png[Job Management]
 
 You can use the *Settings* pane to create and edit 
 {ml-docs}/ml-calendars.html[calendars] and the filters that are used in 
 {ml-docs}/ml-rules.html[custom rules]:
 
 [role="screenshot"]
-image::user/ml/images/ml-settings.jpg[Calendar Management]
+image::user/ml/images/ml-settings.png[Calendar Management]
 
 The *Anomaly Explorer* and *Single Metric Viewer* display the results of your
 {anomaly-jobs}. For example:
 
 [role="screenshot"]
-image::user/ml/images/ml-single-metric-viewer.jpg[Single Metric Viewer]
+image::user/ml/images/ml-single-metric-viewer.png[Single Metric Viewer]
 
 You can optionally add annotations by drag-selecting a period of time in
 the *Single Metric Viewer* and adding a description. For example, you can add an
@@ -68,7 +68,7 @@ explanation for anomalies in that time period or provide notes about what is
 occurring in your operational environment at that time:
 
 [role="screenshot"]
-image::user/ml/images/ml-annotations-list.jpg[Single Metric Viewer with annotations]
+image::user/ml/images/ml-annotations-list.png[Single Metric Viewer with annotations]
 
 In some circumstances, annotations are also added automatically. For example, if
 the {anomaly-job} detects that there is missing data, it annotates the affected 
@@ -94,8 +94,8 @@ The Elastic {ml} {dfanalytics} feature enables you to analyze your data using
 indices that contain the results alongside your source data. 
 
 If you have a license that includes the {ml-features}, you can create
-{dfanalytics-jobs} and view their results on the *Analytics* page
-in {kib}. For example:
+{dfanalytics-jobs} and view their results on the *Data Frame Analytics* page in
+{kib}. For example:
 
 [role="screenshot"]
 image::user/ml/images/outliers.png[{oldetection-cap} results in {kib}]
diff --git a/docs/visualize/images/vega_lite_tutorial_1.png b/docs/visualize/images/vega_lite_tutorial_1.png
new file mode 100644
index 0000000000000..4e8d0aba3635b
Binary files /dev/null and b/docs/visualize/images/vega_lite_tutorial_1.png differ
diff --git a/docs/visualize/images/vega_lite_tutorial_2.png b/docs/visualize/images/vega_lite_tutorial_2.png
new file mode 100644
index 0000000000000..523ae91514a11
Binary files /dev/null and b/docs/visualize/images/vega_lite_tutorial_2.png differ
diff --git a/docs/visualize/images/vega_tutorial_3.png b/docs/visualize/images/vega_tutorial_3.png
new file mode 100644
index 0000000000000..e025ecc585807
Binary files /dev/null and b/docs/visualize/images/vega_tutorial_3.png differ
diff --git a/docs/visualize/images/vega_tutorial_4.png b/docs/visualize/images/vega_tutorial_4.png
new file mode 100644
index 0000000000000..c8ee311e9bf5e
Binary files /dev/null and b/docs/visualize/images/vega_tutorial_4.png differ
diff --git a/docs/visualize/vega.asciidoc b/docs/visualize/vega.asciidoc
index 24bd3a44bebba..3a1c57da93f07 100644
--- a/docs/visualize/vega.asciidoc
+++ b/docs/visualize/vega.asciidoc
@@ -3,71 +3,1287 @@
 
 experimental[]
 
-Build custom visualizations from multiple data sources using Vega
-and Vega-Lite.
+Build custom visualizations using Vega and Vega-Lite, backed by one or more
+data sources including {es}, Elastic Map Service, URL,
+or static data. Use the {kib} extensions to Vega to embed Vega into
+your dashboard, and to add interactivity to the visualizations.
 
-* *Vega* &mdash; A declarative format to create visualizations using JSON.
-  Generate interactive displays using D3.
+Vega and Vega-Lite are both declarative formats to create visualizations
+using JSON. Both use a different syntax for declaring visualizations,
+and are not fully interchangeable.
 
-* *Vega-Lite* &mdash; An easier format to use than Vega that enables more rapid
-  data analysis. Compiles into Vega.
+[float]
+[[when-to-vega]]
+=== When to use Vega
 
-For more information about Vega and Vega-Lite, refer to
-<<vega-useful-links, Resources and examples>>.
+Vega and Vega-Lite are capable of building most of the visualizations
+that {kib} provides, but with higher complexity. The most common reason
+to use Vega in {kib} is that {kib} is missing support for the query or
+visualization, for example:
 
-[float]
-[[create-vega-viz]]
-=== Create Vega visualizations
+* Aggregations using the `nested` or `parent/child` mapping
+* Aggregations without a {kib} index pattern
+* Queries using custom time filters
+* Complex calculations
+* Extracting data from _source instead of aggregation
+* Scatter charts
+* Sankey charts
+* Custom maps
+* Using a visual theme that {kib} does not provide
+
+[[vega-lite-tutorial]]
+=== Tutorial: First visualization in Vega-Lite
 
-You create Vega visualizations by using the text editor, which is
-preconfigured with the options you need.
+In this tutorial, you will learn about how to edit Vega-Lite in {kib} to create
+a stacked area chart from an {es} search query. It will give you a starting point
+for a more comprehensive
+https://vega.github.io/vega-lite/tutorials/getting_started.html[introduction to Vega-Lite],
+while only covering the basics.
+
+In this tutorial, you will build a stacked area chart from one of the {kib} sample data
+sets.
 
 [role="screenshot"]
-image::images/vega_lite_default.png[]
+image::visualize/images/vega_lite_tutorial_1.png[]
 
-[float]
-[[vega-schema]]
-==== Change the Vega version
+Before beginning this tutorial, install the <<add-sample-data, eCommerce sample data>>
+set.
+
+When you first open the Vega editor in {kib}, you will see a pre-populated
+line chart which shows the total number of documents across all your indices
+within the time range.
 
-The default visualization uses Vega-Lite version 2. To use Vega version 4, edit
-the `schema`.
+[role="screenshot"]
+image::visualize/images/vega_lite_default.png[]
+
+The text editor contains a Vega-Lite spec written in https://hjson.github.io/[HJSON],
+which is similar to JSON but optimized for human editing. HJSON supports:
 
-Go to `$schema`, enter `https://vega.github.io/schema/vega/v5.json`, then click
-*Update*.
+* Comments using // or /* syntax
+* Object keys without quotes
+* String values without quotes
+* Optional commas
+* Double or single quotes
+* Multiline strings
 
 [float]
-[[vega-type]]
-==== Change the visualization type
+==== Small steps
 
-The default visualization is a line chart. To change the visualization type,
-change the `mark` value. The supported visualization types are listed in the
-text editor.
+Always work on Vega in the smallest steps possible, and save your work frequently.
+Small changes will cause unexpected results. Click the "Save" button now.
 
-Go to `mark`, change the value to a different visualization type, then click
-*Update*.
+The first step is to change the index to one of the <<add-sample-data, sample data>>
+sets. Change
+
+```yaml
+index: _all
+```
+
+to:
+
+```yaml
+index: kibana_sample_data_ecommerce
+```
+
+Click "Update". The result is probably not what you expect. You should see a flat
+line with 0 results.
+
+You've only changed the index, so the difference must be the query is returning
+no results. You can try the <<vega-browser-debugging-console, Vega debugging process>>,
+but intuition may be faster for this particular problem.
+
+In this case, the problem is that you are querying the field `@timestamp`,
+which does not exist in the `kibana_sample_data_ecommerce` data. Find and replace
+`@timestamp` with `order_date`. This fixes the problem, leaving you with this spec:
+
+.Expand Vega-Lite spec
+[%collapsible%closed]
+====
+[source,yaml]
+----
+{
+  $schema: https://vega.github.io/schema/vega-lite/v4.json
+  title: Event counts from ecommerce
+  data: {
+    url: {
+      %context%: true
+      %timefield%: order_date
+      index: kibana_sample_data_ecommerce
+      body: {
+        aggs: {
+          time_buckets: {
+            date_histogram: {
+              field: order_date
+              interval: {%autointerval%: true}
+              extended_bounds: {
+                min: {%timefilter%: "min"}
+                max: {%timefilter%: "max"}
+              }
+              min_doc_count: 0
+            }
+          }
+        }
+        size: 0
+      }
+    }
+    format: {property: "aggregations.time_buckets.buckets" }
+  }
+
+  mark: line
+
+  encoding: {
+    x: {
+      field: key
+      type: temporal
+      axis: { title: null }
+    }
+    y: {
+      field: doc_count
+      type: quantitative
+      axis: { title: "Document count" }
+    }
+  }
+}
+----
+
+====
+
+Now, let's make the visualization more interesting by adding another aggregation
+to create a stacked area chart. To verify that you have constructed the right
+query, it is easiest to use the {kib} Dev Tools in a separate tab from the
+Vega editor. Open the Dev Tools from the Management section of the navigation.
+
+This query is roughly equivalent to the one that is used in the default
+Vega-Lite spec. Copy it into the Dev Tools:
+
+```js
+POST kibana_sample_data_ecommerce/_search
+{
+  "query": {
+    "range": {
+      "order_date": {
+        "gte": "now-7d"
+      }
+    }
+  },
+  "aggs": {
+    "time_buckets": {
+      "date_histogram": {
+        "field": "order_date",
+        "fixed_interval": "1d",
+        "extended_bounds": {
+          "min": "now-7d"
+        },
+        "min_doc_count": 0
+      }
+    }
+  },
+  "size": 0
+}
+```
+
+There's not enough data to create a stacked bar in the original query, so we
+will add a new
+{ref}/search-aggregations-bucket-terms-aggregation.html[terms aggregation]:
+
+```js
+POST kibana_sample_data_ecommerce/_search
+{
+  "query": {
+    "range": {
+      "order_date": {
+        "gte": "now-7d"
+      }
+    }
+  },
+  "aggs": {
+    "categories": {
+      "terms": { "field": "category.keyword" },
+      "aggs": {
+        "time_buckets": {
+          "date_histogram": {
+            "field": "order_date",
+            "fixed_interval": "1d",
+            "extended_bounds": {
+              "min": "now-7d"
+            },
+            "min_doc_count": 0
+          }
+        }
+      }
+    }
+  },
+  "size": 0
+}
+```
+
+You'll see that the response format looks different from the previous query:
+
+```json
+{
+  "aggregations" : {
+    "categories" : {
+      "doc_count_error_upper_bound" : 0,
+      "sum_other_doc_count" : 0,
+      "buckets" : [{
+        "key" : "Men's Clothing",
+        "doc_count" : 1661,
+        "time_buckets" : {
+          "buckets" : [{
+            "key_as_string" : "2020-06-30T00:00:00.000Z",
+            "key" : 1593475200000,
+            "doc_count" : 19
+          }, {
+            "key_as_string" : "2020-07-01T00:00:00.000Z",
+            "key" : 1593561600000,
+            "doc_count" : 71
+          }]
+        }
+      }]
+    }
+  }
+}
+```
+
+Now that we have data that we're happy with, it's time to convert from an
+isolated {es} query into a query with {kib} integration. Looking at the
+<<vega-queries, reference for writing {es} queries in Vega>>, you will
+see the full list of special tokens that are used in this query, such
+as `%context: true`. This query has also replaced `"fixed_interval": "1d"`
+with `interval: {%autointerval%: true}`. Copy the final query into
+your spec:
+
+```yaml
+  data: {
+    url: {
+      %context%: true
+      %timefield%: order_date
+      index: kibana_sample_data_ecommerce
+      body: {
+        aggs: {
+          categories: {
+            terms: { field: "category.keyword" }
+            aggs: {
+              time_buckets: {
+                date_histogram: {
+                  field: order_date
+                  interval: {%autointerval%: true}
+                  extended_bounds: {
+                    min: {%timefilter%: "min"}
+                    max: {%timefilter%: "max"}
+                  }
+                  min_doc_count: 0
+                }
+              }
+            }
+          }
+        }
+        size: 0
+      }
+    }
+    format: {property: "aggregations.categories.buckets" }
+  }
+```
+
+If you copy and paste that into your Vega-Lite spec, and click "Update",
+you will see a warning saying `Infinite extent for field "key": [Infinity, -Infinity]`.
+Let's use our <<vega-browser-debugging-console, Vega debugging skills>> to understand why.
+
+Vega-Lite generates data using the names `source_0` and `data_0`. `source_0` contains
+the results from the {es} query, and `data_0` contains the visually encoded results
+which are shown in the chart. To debug this problem, you need to compare both.
+
+To look at the source, open the browser dev tools console and type
+`VEGA_DEBUG.view.data('source_0')`. You will see:
+
+```js
+[{
+  doc_count: 454
+  key: "Men's Clothing"
+  time_buckets: {buckets: Array(57)}
+  Symbol(vega_id): 12822
+}, ...]
+```
+
+To compare to the visually encoded data, open the browser dev tools console and type
+`VEGA_DEBUG.view.data('data_0')`. You will see:
+
+```js
+[{
+  doc_count: 454
+  key: NaN
+  time_buckets: {buckets: Array(57)}
+  Symbol(vega_id): 13879
+}]
+```
+
+The issue seems to be that the `key` property is not being converted the right way,
+which makes sense because the `key` is now `Men's Clothing` instead of a timestamp.
+
+To fix this, try updating the `encoding` of your Vega-Lite spec to:
+
+```yaml
+  encoding: {
+    x: {
+      field: time_buckets.buckets.key
+      type: temporal
+      axis: { title: null }
+    }
+    y: {
+      field: time_buckets.buckets.doc_count
+      type: quantitative
+      axis: { title: "Document count" }
+    }
+  }
+```
+
+This will show more errors, and you can inspect `VEGA_DEBUG.view.data('data_0')` to
+understand why. This now shows:
+
+```js
+[{
+  doc_count: 454
+  key: "Men's Clothing"
+  time_buckets: {buckets: Array(57)}
+  time_buckets.buckets.doc_count: undefined
+  time_buckets.buckets.key: null
+  Symbol(vega_id): 14094
+}]
+```
+
+It looks like the problem is that the `time_buckets` inner array is not being
+extracted by Vega. The solution is to use a Vega-lite
+https://vega.github.io/vega-lite/docs/flatten.html[flatten transformation], available in {kib} 7.9 and later.
+If using an older version of Kibana, the flatten transformation is available in Vega
+but not Vega-Lite.
+
+Add this section in between the `data` and `encoding` section:
+
+```yaml
+  transform: [{
+    flatten: ["time_buckets.buckets"]
+  }]
+```
+
+This does not yet produce the results you expect. Inspect the transformed data
+by typing `VEGA_DEBUG.view.data('data_0')` into the console again:
+
+```js
+[{
+  doc_count: 453
+  key: "Men's Clothing"
+  time_bucket.buckets.doc_count: undefined
+  time_buckets: {buckets: Array(57)}
+  time_buckets.buckets: {
+    key_as_string: "2020-06-30T15:00:00.000Z",
+    key: 1593529200000,
+    doc_count: 2
+  }
+  time_buckets.buckets.key: null
+  Symbol(vega_id): 21564
+}]
+```
+
+The debug view shows `undefined` values where you would expect to see numbers, and
+the cause is that there are duplicate names which are confusing Vega-Lite. This can
+be fixed by making this change to the `transform` and `encoding` blocks:
+
+```yaml
+  transform: [{
+    flatten: ["time_buckets.buckets"],
+    as: ["buckets"]
+  }]
+
+  mark: area
+
+  encoding: {
+    x: {
+      field: buckets.key
+      type: temporal
+      axis: { title: null }
+    }
+    y: {
+      field: buckets.doc_count
+      type: quantitative
+      axis: { title: "Document count" }
+    }
+    color: {
+      field: key
+      type: nominal
+    }
+  }
+```
+
+At this point, you have a stacked area chart that shows the top categories,
+but the chart is still missing some common features that we expect from a {kib}
+visualization. Let's add hover states and tooltips next.
+
+Hover states are handled differently in Vega-Lite and Vega. In Vega-Lite this is
+done using a concept called `selection`, which has many permutations that are not
+covered in this tutorial. We will be adding a simple tooltip and hover state.
+
+Because {kib} has enabled the https://vega.github.io/vega-lite/docs/tooltip.html[Vega tooltip plugin],
+tooltips can be defined in several ways:
+
+* Automatic tooltip based on the data, via `{ content: "data" }`
+* Array of fields, like `[{ field: "key", type: "nominal" }]`
+* Defining a custom Javascript object using the `calculate` transform
+
+For the simple tooltip, add this to your encoding:
+
+```yaml
+  encoding: {
+    tooltip: [{
+      field: buckets.key
+      type: temporal
+      title: "Date"
+    }, {
+      field: key
+      type: nominal
+      title: "Category"
+    }, {
+      field: buckets.doc_count
+      type: quantitative
+      title: "Count"
+    }]
+  }
+```
+
+As you hover over the area series in your chart, a multi-line tooltip will
+appear, but it won't indicate the nearest point that it's pointing to. To
+indicate the nearest point, we need to add a second layer.
+
+The first step is to remove the `mark: area` from your visualization.
+Once you've removed the previous mark, add a composite mark at the end of
+the Vega-Lite spec:
+
+```yaml
+  layer: [{
+    mark: area
+  }, {
+    mark: point
+  }]
+```
+
+You'll see that the points are not appearing to line up with the area chart,
+and the reason is that the points are not being stacked. Change your Y encoding
+to this:
+
+```yaml
+    y: {
+      field: buckets.doc_count
+      type: quantitative
+      axis: { title: "Document count" }
+      stack: true
+    }
+```
+
+Now, we will add a `selection` block inside the point mark:
+
+```yaml
+  layer: [{
+    mark: area
+  }, {
+    mark: point
+    
+    selection: {
+      pointhover: {
+        type: single
+        on: mouseover
+        clear: mouseout
+        empty: none
+        fields: ["buckets.key", "key"]
+        nearest: true
+      }
+    }
+
+    encoding: {
+      size: {
+        condition: {
+          selection: pointhover
+          value: 100
+        }
+        value: 5
+      }
+      fill: {
+        condition: {
+          selection: pointhover
+          value: white
+        }
+      }
+    }
+  }]
+```
+
+Now that you've enabled a selection, try moving the mouse around the visualization
+and seeing the points respond to the nearest position:
+
+[role="screenshot"]
+image::visualize/images/vega_lite_tutorial_2.png[]
+
+The final result of this tutorial is this spec:
+
+.Expand final Vega-Lite spec
+[%collapsible%closed]
+====
+[source,yaml]
+----
+{
+  $schema: https://vega.github.io/schema/vega-lite/v4.json
+  title: Event counts from ecommerce
+  data: {
+    url: {
+      %context%: true
+      %timefield%: order_date
+      index: kibana_sample_data_ecommerce
+      body: {
+        aggs: {
+          categories: {
+            terms: { field: "category.keyword" }
+            aggs: {
+              time_buckets: {
+                date_histogram: {
+                  field: order_date
+                  interval: {%autointerval%: true}
+                  extended_bounds: {
+                    min: {%timefilter%: "min"}
+                    max: {%timefilter%: "max"}
+                  }
+                  min_doc_count: 0
+                }
+              }
+            }
+          }
+        }
+        size: 0
+      }
+    }
+    format: {property: "aggregations.categories.buckets" }
+  }
+  
+  transform: [{
+    flatten: ["time_buckets.buckets"]
+    as: ["buckets"]
+  }]
+
+  encoding: {
+    x: {
+      field: buckets.key
+      type: temporal
+      axis: { title: null }
+    }
+    y: {
+      field: buckets.doc_count
+      type: quantitative
+      axis: { title: "Document count" }
+      stack: true
+    }
+    color: {
+      field: key
+      type: nominal
+      title: "Category"
+    }
+    tooltip: [{
+      field: buckets.key
+      type: temporal
+      title: "Date"
+    }, {
+      field: key
+      type: nominal
+      title: "Category"
+    }, {
+      field: buckets.doc_count
+      type: quantitative
+      title: "Count"
+    }]
+  }
+  
+  layer: [{
+    mark: area
+  }, {
+    mark: point
+    
+    selection: {
+      pointhover: {
+        type: single
+        on: mouseover
+        clear: mouseout
+        empty: none
+        fields: ["buckets.key", "key"]
+        nearest: true
+      }
+    }
+
+    encoding: {
+      size: {
+        condition: {
+          selection: pointhover
+          value: 100
+        }
+        value: 5
+      }
+      fill: {
+        condition: {
+          selection: pointhover
+          value: white
+        }
+      }
+    }
+  }]
+}
+----
+
+====
+
+[[vega-tutorial]]
+=== Tutorial: Updating {kib} filters from Vega
+
+In this tutorial you will build an area chart in Vega using an {es} search query,
+and add a click handler and drag handler to update {kib} filters.
+This tutorial is not a full https://vega.github.io/vega/tutorials/[Vega tutorial],
+but will cover the basics of creating Vega visualizations into {kib}.
+
+First, create an almost-blank Vega chart by pasting this into the editor:
+
+```yaml
+{
+  $schema: "https://vega.github.io/schema/vega/v5.json"
+  data: [{
+    name: source_0
+  }]
+  
+  scales: [{
+    name: x
+    type: time
+    range: width
+  }, {
+    name: y
+    type: linear
+    range: height
+  }]
+  
+  axes: [{
+    orient: bottom
+    scale: x
+  }, {
+    orient: left
+    scale: y
+  }]
+  
+  marks: [
+    {
+      type: area
+      from: {
+        data: source_0
+      }
+      encode: {
+        update: {
+        }
+      }
+    }
+  ]
+}
+```
+
+Despite being almost blank, this Vega spec still contains the minimum requirements:
+
+* Data
+* Scales
+* Marks
+* (optional) Axes
+
+Next, add a valid {es} search query in the `data` block:
+
+```yaml
+  data: [
+    {
+      name: source_0
+      url: {
+        %context%: true
+        %timefield%: order_date
+        index: kibana_sample_data_ecommerce
+        body: {
+          aggs: {
+            time_buckets: {
+              date_histogram: {
+                field: order_date
+                fixed_interval: "3h"
+                extended_bounds: {
+                  min: {%timefilter%: "min"}
+                  max: {%timefilter%: "max"}
+                }
+                min_doc_count: 0
+              }
+            }
+          }
+          size: 0
+        }
+      }
+      format: { property: "aggregations.time_buckets.buckets" }
+    }
+  ]
+```
+
+Click "Update", and nothing will change in the visualization. The first step
+is to change the X and Y scales based on the data:
+
+```yaml
+  scales: [{
+    name: x
+    type: time
+    range: width
+    domain: {
+      data: source_0
+      field: key
+    }
+  }, {
+    name: y
+    type: linear
+    range: height
+    domain: {
+      data: source_0
+      field: doc_count
+    }
+  }]
+```
+
+Click "Update", and you will see that the X and Y axes are now showing labels based
+on the real data.
+
+Next, encode the fields `key` and `doc_count` as the X and Y values:
+
+```yaml
+  marks: [
+    {
+      type: area
+      from: {
+        data: source_0
+      }
+      encode: {
+        update: {
+          x: {
+            scale: x
+            field: key
+          }
+          y: {
+            scale: y
+            value: 0
+          }
+          y2: {
+            scale: y
+            field: doc_count
+          }
+        }
+      }
+    }
+  ]
+```
+
+Click "Update" and you will get a basic area chart:
+
+[role="screenshot"]
+image::visualize/images/vega_tutorial_3.png[]
+
+Next, add a new block to the `marks` section. This will show clickable points to filter for a specific
+date:
+
+```yaml
+  {
+    name: point
+    type: symbol
+    style: ["point"]
+    from: {
+      data: source_0
+    }
+    encode: {
+      update: {
+        x: {
+          scale: x
+          field: key
+        }
+        y: {
+          scale: y
+          field: doc_count
+        }
+        size: {
+          value: 100
+        }
+        fill: {
+          value: black
+        }
+      }
+    }
+  }
+```
+
+Next, we will create a Vega signal to make the points clickable. You can access
+the clicked `datum` in the expression used to update. In this case, you want
+clicks on points to add a time filter with the 3-hour interval defined above.
+
+```yaml
+  signals: [
+    {
+      name: point_click
+      on: [{
+        events: {
+          source: scope
+          type: click
+          markname: point
+        }
+        update: '''kibanaSetTimeFilter(datum.key, datum.key + 3 * 60 * 60 * 1000)'''
+      }]
+    }
+  ]
+```
+
+This event is using the {kib} custom function `kibanaSetTimeFilter` to generate a filter that
+gets applied to the entire dashboard on click.
+
+The mouse cursor does not currently indicate that the chart is interactive. Find the `marks` section,
+and update the mark named `point` by adding `cursor: { value: "pointer" }` to
+the `encoding` section like this:
+
+```yaml
+  {
+    name: point
+    type: symbol
+    style: ["point"]
+    from: {
+      data: source_0
+    }
+    encode: {
+      update: {
+        ...
+        cursor: { value: "pointer" }
+      }
+    }
+  }
+```
+
+Next, we will add a drag interaction which will allow the user to narrow into
+a specific time range in the visualization. This will require adding more signals, and
+adding a rectangle overlay:
+
+[role="screenshot"]
+image::visualize/images/vega_tutorial_4.png[]
+
+The first step is to add a new `signal` to track the X position of the cursor:
+
+```yaml
+    {
+      name: currentX
+      value: -1
+      on: [{
+        events: {
+          type: mousemove
+          source: view
+        },
+        update: "clamp(x(), 0, width)"
+      }, {
+        events: {
+          type: mouseout
+          source: view
+        }
+        update: "-1"
+      }]
+    }
+```
+
+Now add a new `mark` to indicate the current cursor position:
+
+```yaml
+    {
+      type: rule
+      interactive: false
+      encode: {
+        update: {
+          y: {value: 0}
+          y2: {signal: "height"}
+          stroke: {value: "gray"}
+          strokeDash: {
+            value: [2, 1]
+          }
+          x: {signal: "max(currentX,0)"}
+          defined: {signal: "currentX > 0"}
+        }
+      }
+    }
+```
+
+Next, add a signal to track the current selected range, which will update
+until the user releases the mouse button or uses the escape key:
+
+
+```yaml
+    {
+      name: selected
+      value: [0, 0]
+      on: [{
+        events: {
+          type: mousedown
+          source: view
+        }
+        update: "[clamp(x(), 0, width), clamp(x(), 0, width)]"
+      }, {
+        events: {
+          type: mousemove
+          source: window
+          consume: true
+          between: [{
+            type: mousedown
+            source: view
+          }, {
+            merge: [{
+              type: mouseup
+              source: window
+            }, {
+              type: keydown
+              source: window
+              filter: "event.key === 'Escape'"
+            }]
+          }]
+        }
+        update: "[selected[0], clamp(x(), 0, width)]"
+      }, {
+        events: {
+          type: keydown
+          source: window
+          filter: "event.key === 'Escape'"
+        }
+        update: "[0, 0]"
+      }]
+    }
+```
+
+Now that there is a signal which tracks the time range from the user, we need to indicate
+the range visually by adding a new mark which only appears conditionally:
+
+```yaml
+    {
+      type: rect
+      name: selectedRect
+      encode: {
+        update: {
+          height: {signal: "height"}
+          fill: {value: "#333"}
+          fillOpacity: {value: 0.2}
+          x: {signal: "selected[0]"}
+          x2: {signal: "selected[1]"}
+          defined: {signal: "selected[0] !== selected[1]"}
+        }
+      }
+    }
+```
+
+Finally, add a new signal which will update the {kib} time filter when the mouse is released while
+dragging:
+
+```yaml
+    {
+      name: applyTimeFilter
+      value: null
+      on: [{
+        events: {
+          type: mouseup
+          source: view
+        }
+        update: '''selected[0] !== selected[1] ? kibanaSetTimeFilter(
+               invert('x',selected[0]),
+               invert('x',selected[1])) : null'''
+      }]
+    }
+```
+
+Putting this all together, your visualization now supports the main features of
+standard visualizations in {kib}, but with the potential to add even more control.
+The final Vega spec for this tutorial is here:
+
+.Expand final Vega spec
+[%collapsible%closed]
+====
+[source,yaml]
+----
+{
+  $schema: "https://vega.github.io/schema/vega/v5.json"
+  data: [
+    {
+      name: source_0
+      url: {
+        %context%: true
+        %timefield%: order_date
+        index: kibana_sample_data_ecommerce
+        body: {
+          aggs: {
+            time_buckets: {
+              date_histogram: {
+                field: order_date
+                fixed_interval: "3h"
+                extended_bounds: {
+                  min: {%timefilter%: "min"}
+                  max: {%timefilter%: "max"}
+                }
+                min_doc_count: 0
+              }
+            }
+          }
+          size: 0
+        }
+      }
+      format: { property: "aggregations.time_buckets.buckets" }
+    }
+  ]
+  
+  scales: [{
+    name: x
+    type: time
+    range: width
+    domain: {
+      data: source_0
+      field: key
+    }
+  }, {
+    name: y
+    type: linear
+    range: height
+    domain: {
+      data: source_0
+      field: doc_count
+    }
+  }]
+  
+  axes: [{
+    orient: bottom
+    scale: x
+  }, {
+    orient: left
+    scale: y
+  }]
+  
+  marks: [
+    {
+      type: area
+      from: {
+        data: source_0
+      }
+      encode: {
+        update: {
+          x: {
+            scale: x
+            field: key
+          }
+          y: {
+            scale: y
+            value: 0
+          }
+          y2: {
+            scale: y
+            field: doc_count
+          }
+        }
+      }
+    },
+    {
+      name: point
+      type: symbol
+      style: ["point"]
+      from: {
+        data: source_0
+      }
+      encode: {
+        update: {
+          x: {
+            scale: x
+            field: key
+          }
+          y: {
+            scale: y
+            field: doc_count
+          }
+          size: {
+            value: 100
+          }
+          fill: {
+            value: black
+          }
+          cursor: { value: "pointer" }
+        }
+      }
+    },
+    {
+      type: rule
+      interactive: false
+      encode: {
+        update: {
+          y: {value: 0}
+          y2: {signal: "height"}
+          stroke: {value: "gray"}
+          strokeDash: {
+            value: [2, 1]
+          }
+          x: {signal: "max(currentX,0)"}
+          defined: {signal: "currentX > 0"}
+        }
+      }
+    },
+    {
+      type: rect
+      name: selectedRect
+      encode: {
+        update: {
+          height: {signal: "height"}
+          fill: {value: "#333"}
+          fillOpacity: {value: 0.2}
+          x: {signal: "selected[0]"}
+          x2: {signal: "selected[1]"}
+          defined: {signal: "selected[0] !== selected[1]"}
+        }
+      }
+    }
+  ]
+  
+  signals: [
+    {
+      name: point_click
+      on: [{
+        events: {
+          source: scope
+          type: click
+          markname: point
+        }
+        update: '''kibanaSetTimeFilter(datum.key, datum.key + 3 * 60 * 60 * 1000)'''
+      }]
+    }
+    {
+      name: currentX
+      value: -1
+      on: [{
+        events: {
+          type: mousemove
+          source: view
+        },
+        update: "clamp(x(), 0, width)"
+      }, {
+        events: {
+          type: mouseout
+          source: view
+        }
+        update: "-1"
+      }]
+    }
+    {
+      name: selected
+      value: [0, 0]
+      on: [{
+        events: {
+          type: mousedown
+          source: view
+        }
+        update: "[clamp(x(), 0, width), clamp(x(), 0, width)]"
+      }, {
+        events: {
+          type: mousemove
+          source: window
+          consume: true
+          between: [{
+            type: mousedown
+            source: view
+          }, {
+            merge: [{
+              type: mouseup
+              source: window
+            }, {
+              type: keydown
+              source: window
+              filter: "event.key === 'Escape'"
+            }]
+          }]
+        }
+        update: "[selected[0], clamp(x(), 0, width)]"
+      }, {
+        events: {
+          type: keydown
+          source: window
+          filter: "event.key === 'Escape'"
+        }
+        update: "[0, 0]"
+      }]
+    }
+    {
+      name: applyTimeFilter
+      value: null
+      on: [{
+        events: {
+          type: mouseup
+          source: view
+        }
+        update: '''selected[0] !== selected[1] ? kibanaSetTimeFilter(
+               invert('x',selected[0]),
+               invert('x',selected[1])) : null'''
+      }]
+    }
+  ]
+}
+
+----
+====
+
+[[vega-reference]]
+=== Reference for {kib} extensions
+
+{kib} has extended Vega and Vega-Lite with extensions that support:
+
+* Default height and width
+* Default theme to match {kib}
+* Writing {es} queries using the time range and filters from dashboards
+* Using the Elastic Map Service in Vega maps
+* Additional tooltip styling
+* Advanced setting to enable URL loading from any domain
+* Limited debugging support using the browser dev tools
+* (Vega only) Expression functions which can update the time range and dashboard filters
 
-[float]
 [[vega-sizing-and-positioning]]
-==== Change the layout
+==== Default height and width
 
 By default, Vega visualizations use the `autosize = { type: 'fit', contains: 'padding' }` layout.
 `fit` uses all available space, ignores `width` and `height` values,
 and respects the padding values. To override this behavior, change the
 `autosize` value.
 
-[[vega-querying-elasticsearch]]
-=== Query {es}
+[[vega-theme]]
+==== Default theme to match {kib}
+
+{kib} registers a default https://vega.github.io/vega/docs/schemes/[Vega color scheme]
+with the id `elastic`, and sets a default color for each `mark` type.
+Override it by providing a different `stroke`, `fill`, or `color` (Vega-Lite) value.
+
+[[vega-queries]]
+==== Writing {es} queries in Vega
+
+experimental[] {kib} extends the Vega https://vega.github.io/vega/docs/data/[data] elements
+with support for direct {es} queries specified as a `url`.
 
-experimental[] Vega https://vega.github.io/vega/docs/data/[data] elements
-use embedded and external data with a `"url"` parameter. {kib} adds support for
-direct {es} queries by overloading
-the `"url"` value.
+Because of this, {kib} is **unable to support dynamically loaded data**,
+which would otherwise work in Vega. All data is fetched before it's passed to
+the Vega renderer.
 
-NOTE: With Vega, you dynamically load your data by setting signals as data URLs.
-Since {kib} is unable to support dynamically loaded data, all data is fetched
-before it's passed to the Vega renderer.
+To define an {es} query in Vega, set the `url` to an object. {kib} will parse
+the object looking for special tokens that allow your query to integrate with {kib}.
+These tokens are:
 
-For example, count the number of documents in all indices:
+* `%context%: true`: Set at the top level, and replaces the `query` section with filters from dashboard
+* `%timefield%: <name>`: Set at the top level, integrates the query with the dashboard time filter
+* `{%timefilter%: true}`: Replaced by an {es} range query with upper and lower bounds
+* `{%timefilter%: "min" | "max"}`: Replaced only by the upper or lower bounds
+* `{%timefilter: true, shift: -1, unit: 'hour'}`: Generates a time range query one hour in the past
+* `{%autointerval%: true}`: Replaced by the string which contains the automatic {kib} time interval, such as `1h`
+* `{%autointerval%: 10}`: Replaced by a string which is approximately dividing the time into 10 ranges, allowing
+  you to influence the automatic interval
+* `"%dashboard_context-must_clause%"`: String replaced by object containing filters
+* `"%dashboard_context-filter_clause%"`: String replaced by an object containing filters
+* `"%dashboard_context-must_not_clause%"`: String replaced by an object containing filters
+
+Putting this together, an example query that counts the number of documents in 
+a specific index:
 
 [source,yaml]
 ----
@@ -80,8 +1296,8 @@ url: {
   %context%: true
 
   // Which indexes to search
-  index: _all
-  // The body element may contain "aggs" and "query" subfields
+  index: kibana_sample_data_logs
+  // The body element may contain "aggs" and "query" keys
   body: {
     aggs: {
       time_buckets: {
@@ -183,7 +1399,7 @@ except that the time range is shifted back by 10 minutes:
 }
 ----
 
-NOTE: When using `"%context%": true` or defining a value for "%timefield%"` the body cannot contain a query. To customize the query within the VEGA specification (e.g. add an additional filter, or shift the timefilter), define your query and use the placeholders as in the example above. The placeholders will be replaced by the actual context of the dashboard or visualization once parsed.
+NOTE: When using `"%context%": true` or defining a value for `"%timefield%"` the body cannot contain a query. To customize the query within the VEGA specification (e.g. add an additional filter, or shift the timefilter), define your query and use the placeholders as in the example above. The placeholders will be replaced by the actual context of the dashboard or visualization once parsed.
 
 The `"%timefilter%"` can also be used to specify a single min or max
 value. The date_histogram's `extended_bounds` can be set
@@ -194,6 +1410,7 @@ also supported. The `"interval"` can also be set dynamically, depending
 on the currently picked range: `"interval": {"%autointerval%": 10}` will
 try to get about 10-15 data points (buckets).
 
+[float]
 [[vega-esmfiles]]
 === Access Elastic Map Service files
 
@@ -260,21 +1477,44 @@ Additionally, you can use `latitude`, `longitude`, and `zoom` signals.
 These signals can be used in the graph, or can be updated to modify the
 position of the map.
 
-Vega visualization ignore the `autosize`, `width`, `height`, and `padding`
-values, using `fit` model with zero padding.
+[float]
+[[vega-tooltip]]
+==== Additional tooltip styling
+
+{kib} has installed the https://vega.github.io/vega-lite/docs/tooltip.html[Vega tooltip plugin],
+so tooltips can be defined in the ways documented there. Beyond that, {kib} also supports
+a configuration option for changing the tooltip position and padding:
+
+```js
+{
+  config: {
+    kibana: {
+      tooltips: {
+        position: 'top',
+        padding: 15
+      }
+    }
+  }
+}
+```
+
+[[vega-url-loading]]
+==== Advanced setting to enable URL loading from any domain
 
-[[vega-debugging]]
-=== Debugging Vega
+Vega can load data from any URL, but this is disabled by default in {kib}. 
+To change this, set `vis_type_vega.enableExternalUrls: true` in `kibana.yml`,
+then restart {kib}.
 
 [[vega-browser-debugging-console]]
 ==== Browser debugging console
 
 experimental[] Use browser debugging tools (for example, F12 or Ctrl+Shift+J in Chrome) to
 inspect the `VEGA_DEBUG` variable:
-+
+
 * `view` &mdash; Access to the Vega View object. See https://vega.github.io/vega/docs/api/debugging/[Vega Debugging Guide]
-on how to inspect data and signals at runtime. For Vega-Lite, `VEGA_DEBUG.view.data('source_0')` gets the main data set.
-For Vega, it uses the data name as defined in your Vega spec.
+on how to inspect data and signals at runtime. For Vega-Lite,
+`VEGA_DEBUG.view.data('source_0')` gets the pre-transformed data, and `VEGA_DEBUG.view.data('data_0')`
+gets the encoded data. For Vega, it uses the data name as defined in your Vega spec.
 
 * `vega_spec` &mdash; Vega JSON graph specification after some modifications by {kib}. In case
 of Vega-Lite, this is the output of the Vega-Lite compiler.
@@ -283,7 +1523,7 @@ of Vega-Lite, this is the output of the Vega-Lite compiler.
 Vega-Lite compilation.
 
 [[vega-data]]
-==== Data
+==== Debugging data
 
 experimental[] If you are using an {es} query, make sure your resulting data is
 what you expected. The easiest way to view it is by using the "networking"
@@ -294,45 +1534,52 @@ https://www.elastic.co/guide/en/kibana/current/console-kibana.html[Dev Tools]. P
 `GET <INDEX_NAME>/_search`, then add your query as the following lines
 (just the value of the `"query"` field).
 
-If you need to share your graph with someone, copy the
-raw data response to https://gist.github.com/[gist.github.com], possibly
-with a `.json` extension, use the `[raw]` button, and use that url
-directly in your graph.
+[[vega-getting-help]]
+==== Asking for help with a Vega spec
 
-To restrict Vega from using non-ES data sources, add `vega.enableExternalUrls: false`
-to your kibana.yml file.
+Because of the dynamic nature of the data in {es}, it is hard to help you with
+Vega specs unless you can share a dataset. To do this, use the browser developer
+tools and type:
 
-[[vega-notes]]
-[[vega-useful-links]]
-=== Resources and examples
+`JSON.stringify(VEGA_DEBUG.vegalite_spec, null, 2)`
 
-experimental[] To learn more about Vega and Vega-List, refer to the resources and examples.
+Copy the response to https://gist.github.com/[gist.github.com], possibly
+with a `.json` extension, use the `[raw]` button, and share that when
+asking for help.
 
-==== Vega editor
-The https://vega.github.io/editor/[Vega Editor] includes examples for Vega & Vega-Lite, but does not support any
-{kib}-specific features like {es} requests and interactive base maps.
+[float]
+[[vega-expression-functions]]
+==== (Vega only) Expression functions which can update the time range and dashboard filters
 
-==== Vega-Lite resources
-* https://vega.github.io/vega-lite/tutorials/getting_started.html[Tutorials]
-* https://vega.github.io/vega-lite/docs/[Docs]
-* https://vega.github.io/vega-lite/examples/[Examples]
+{kib} has extended the Vega expression language with these functions:
 
-==== Vega resources
-* https://vega.github.io/vega/tutorials/[Tutorials]
-* https://vega.github.io/vega/docs/[Docs]
-* https://vega.github.io/vega/examples/[Examples]
+```js
+/**
+  * @param {object} query Elastic Query DSL snippet, as used in the query DSL editor
+  * @param {string} [index] as defined in Kibana, or default if missing
+  */
+kibanaAddFilter(query, index)
 
-TIP: When you use the examples, you may
-need to modify the "data" section to use absolute URL. For example,
-replace `"url": "data/world-110m.json"` with
-`"url": "https://vega.github.io/editor/data/world-110m.json"`.
+/**
+  * @param {object} query Elastic Query DSL snippet, as used in the query DSL editor
+  * @param {string} [index] as defined in Kibana, or default if missing
+  */
+kibanaRemoveFilter(query, index)
+
+kibanaRemoveAllFilters()
 
+/**
+  * Update dashboard time filter to the new values
+  * @param {number|string|Date} start
+  * @param {number|string|Date} end
+  */
+kibanaSetTimeFilter(start, end)
+```
+
+[float]
 [[vega-additional-configuration-options]]
 ==== Additional configuration options
 
-These options are specific to the {kib}. link:#vega-with-a-map[Map support] has
-additional configuration options.
-
 [source,yaml]
 ----
 {
@@ -343,12 +1590,37 @@ additional configuration options.
       controlsLocation: top
       // Can be `vertical` or `horizontal` (default).
       controlsDirection: vertical
-      // If true, hides most of Vega and VegaLite warnings
+      // If true, hides most of Vega and Vega-Lite warnings
       hideWarnings: true
       // Vega renderer to use: `svg` or `canvas` (default)
       renderer: canvas
     }
   }
-  /* the rest of Vega code */
 }
 ----
+
+
+[[vega-notes]]
+[[vega-useful-links]]
+=== Resources and examples
+
+experimental[] To learn more about Vega and Vega-Lite, refer to the resources and examples.
+
+==== Vega editor
+The https://vega.github.io/editor/[Vega Editor] includes examples for Vega & Vega-Lite, but does not support any
+{kib}-specific features like {es} requests and interactive base maps.
+
+==== Vega-Lite resources
+* https://vega.github.io/vega-lite/tutorials/getting_started.html[Tutorials]
+* https://vega.github.io/vega-lite/docs/[Docs]
+* https://vega.github.io/vega-lite/examples/[Examples]
+
+==== Vega resources
+* https://vega.github.io/vega/tutorials/[Tutorials]
+* https://vega.github.io/vega/docs/[Docs]
+* https://vega.github.io/vega/examples/[Examples]
+
+TIP: When you use the examples in {kib}, you may
+need to modify the "data" section to use absolute URL. For example,
+replace `"url": "data/world-110m.json"` with
+`"url": "https://vega.github.io/editor/data/world-110m.json"`.
diff --git a/examples/README.md b/examples/README.asciidoc
similarity index 68%
rename from examples/README.md
rename to examples/README.asciidoc
index 2b214a8d1eb52..d33c5e825ce12 100644
--- a/examples/README.md
+++ b/examples/README.asciidoc
@@ -1,7 +1,9 @@
-## Example plugins
+[[example-plugins]]
+== Example plugins
 
 This folder contains example plugins.  To run the plugins in this folder, use the `--run-examples` flag, via
 
-```
+[source,bash]
+----
 yarn start --run-examples
-```
+----
diff --git a/examples/routing_example/README.md b/examples/routing_example/README.md
new file mode 100644
index 0000000000000..0a88707bf70bb
--- /dev/null
+++ b/examples/routing_example/README.md
@@ -0,0 +1,9 @@
+Team owner: Platform
+
+A working example of a plugin that registers and uses multiple custom routes.
+
+Read more:
+
+- [IRouter API Docs](../../docs/development/core/server/kibana-plugin-core-server.irouter.md)
+- [HttpHandler (core.http.fetch) API Docs](../../docs/development/core/public/kibana-plugin-core-public.httphandler.md)
+- [Routing Conventions](../../STYLEGUIDE.md#api-endpoints)
\ No newline at end of file
diff --git a/examples/routing_example/common/index.ts b/examples/routing_example/common/index.ts
new file mode 100644
index 0000000000000..5aa47b1f69cdf
--- /dev/null
+++ b/examples/routing_example/common/index.ts
@@ -0,0 +1,27 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+export const RANDOM_NUMBER_ROUTE_PATH = '/api/random_number';
+
+export const RANDOM_NUMBER_BETWEEN_ROUTE_PATH = '/api/random_number_between';
+
+export const POST_MESSAGE_ROUTE_PATH = '/api/post_message';
+
+// Internal APIs should use the `internal` prefix, instead of the `api` prefix.
+export const INTERNAL_GET_MESSAGE_BY_ID_ROUTE = '/internal/get_message';
diff --git a/examples/routing_example/kibana.json b/examples/routing_example/kibana.json
new file mode 100644
index 0000000000000..37851a0da5a85
--- /dev/null
+++ b/examples/routing_example/kibana.json
@@ -0,0 +1,9 @@
+{
+  "id": "routingExample",
+  "version": "0.0.1",
+  "kibanaVersion": "kibana",
+  "server": true,
+  "ui": true,
+  "requiredPlugins": ["developerExamples"],
+  "optionalPlugins": []
+}
diff --git a/examples/routing_example/public/app.tsx b/examples/routing_example/public/app.tsx
new file mode 100644
index 0000000000000..3b33cb33ccb01
--- /dev/null
+++ b/examples/routing_example/public/app.tsx
@@ -0,0 +1,105 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import React from 'react';
+import ReactDOM from 'react-dom';
+import { AppMountParameters } from 'kibana/public';
+import {
+  EuiPage,
+  EuiPageBody,
+  EuiPageContent,
+  EuiText,
+  EuiHorizontalRule,
+  EuiPageContentHeader,
+  EuiListGroup,
+} from '@elastic/eui';
+import { RandomNumberRouteExample } from './random_number_example';
+import { RandomNumberBetweenRouteExample } from './random_number_between_example';
+import { Services } from './services';
+import { PostMessageRouteExample } from './post_message_example';
+import { GetMessageRouteExample } from './get_message_example';
+
+type Props = Services;
+
+function RoutingExplorer({
+  fetchRandomNumber,
+  fetchRandomNumberBetween,
+  addSuccessToast,
+  postMessage,
+  getMessageById,
+}: Props) {
+  return (
+    <EuiPage>
+      <EuiPageBody>
+        <EuiPageContent>
+          <EuiPageContentHeader>
+            <EuiText>
+              <h1>Routing examples</h1>
+            </EuiText>
+          </EuiPageContentHeader>
+          <EuiText>
+            <EuiListGroup
+              listItems={[
+                {
+                  label: 'IRouter API docs',
+                  href:
+                    'https://github.com/elastic/kibana/blob/master/docs/development/core/server/kibana-plugin-core-server.irouter.md',
+                  iconType: 'logoGithub',
+                  target: '_blank',
+                  size: 's',
+                },
+                {
+                  label: 'HttpHandler (core.http.fetch) API docs',
+                  href:
+                    'https://github.com/elastic/kibana/blob/master/docs/development/core/public/kibana-plugin-core-public.httphandler.md',
+                  iconType: 'logoGithub',
+                  target: '_blank',
+                  size: 's',
+                },
+                {
+                  label: 'Conventions',
+                  href: 'https://github.com/elastic/kibana/tree/master/STYLEGUIDE.md#api-endpoints',
+                  iconType: 'logoGithub',
+                  target: '_blank',
+                  size: 's',
+                },
+              ]}
+            />
+          </EuiText>
+          <EuiHorizontalRule />
+          <RandomNumberRouteExample fetchRandomNumber={fetchRandomNumber} />
+          <EuiHorizontalRule />
+          <RandomNumberBetweenRouteExample fetchRandomNumberBetween={fetchRandomNumberBetween} />
+
+          <EuiHorizontalRule />
+          <PostMessageRouteExample addSuccessToast={addSuccessToast} postMessage={postMessage} />
+
+          <EuiHorizontalRule />
+          <GetMessageRouteExample getMessageById={getMessageById} />
+        </EuiPageContent>
+      </EuiPageBody>
+    </EuiPage>
+  );
+}
+
+export const renderApp = (props: Props, element: AppMountParameters['element']) => {
+  ReactDOM.render(<RoutingExplorer {...props} />, element);
+
+  return () => ReactDOM.unmountComponentAtNode(element);
+};
diff --git a/examples/routing_example/public/get_message_example.tsx b/examples/routing_example/public/get_message_example.tsx
new file mode 100644
index 0000000000000..3c34326564d2b
--- /dev/null
+++ b/examples/routing_example/public/get_message_example.tsx
@@ -0,0 +1,96 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import React, { useCallback } from 'react';
+import { useState } from 'react';
+import {
+  EuiText,
+  EuiButton,
+  EuiLoadingSpinner,
+  EuiFieldText,
+  EuiCallOut,
+  EuiFormRow,
+} from '@elastic/eui';
+import { HttpFetchError } from '../../../src/core/public';
+import { isError } from './is_error';
+import { Services } from './services';
+
+interface Props {
+  getMessageById: Services['getMessageById'];
+}
+
+export function GetMessageRouteExample({ getMessageById }: Props) {
+  const [error, setError] = useState<HttpFetchError | undefined>();
+  const [isFetching, setIsFetching] = useState<boolean>(false);
+  const [message, setMessage] = useState<string>('');
+  const [id, setId] = useState<string>('');
+
+  const doFetch = useCallback(async () => {
+    if (isFetching) return;
+    setIsFetching(true);
+    const response = await getMessageById(id);
+
+    if (isError(response)) {
+      setError(response);
+      setMessage('');
+    } else {
+      setError(undefined);
+      setMessage(response);
+    }
+
+    setIsFetching(false);
+  }, [isFetching, getMessageById, setMessage, id]);
+
+  return (
+    <React.Fragment>
+      <EuiText>
+        <h2>GET example with param</h2>
+
+        <p>This examples uses a simple GET route that takes an id as a param in the route path.</p>
+        <EuiFormRow label="Message Id">
+          <EuiFieldText
+            value={id}
+            onChange={(e) => setId(e.target.value)}
+            data-test-subj="routingExampleGetMessageId"
+          />
+        </EuiFormRow>
+
+        <EuiFormRow hasEmptyLabelSpace={true}>
+          <EuiButton
+            data-test-subj="routingExampleFetchMessage"
+            disabled={isFetching || id === ''}
+            onClick={() => doFetch()}
+          >
+            {isFetching ? <EuiLoadingSpinner /> : 'Get message'}
+          </EuiButton>
+        </EuiFormRow>
+
+        {error !== undefined ? (
+          <EuiCallOut color="danger" iconType="alert">
+            {error.message}
+          </EuiCallOut>
+        ) : null}
+        {message !== '' ? (
+          <p>
+            Message is: <pre data-test-subj="routingExampleGetMessage">{message}</pre>
+          </p>
+        ) : null}
+      </EuiText>
+    </React.Fragment>
+  );
+}
diff --git a/packages/kbn-babel-code-parser/src/index.js b/examples/routing_example/public/index.ts
similarity index 79%
rename from packages/kbn-babel-code-parser/src/index.js
rename to examples/routing_example/public/index.ts
index 70e4eb18068b0..2bb703e71cbef 100644
--- a/packages/kbn-babel-code-parser/src/index.js
+++ b/examples/routing_example/public/index.ts
@@ -17,6 +17,7 @@
  * under the License.
  */
 
-export { dependenciesParseStrategy } from './strategies';
-export { dependenciesVisitorsGenerator } from './visitors';
-export { parseSingleFile, parseSingleFileSync, parseEntries } from './code_parser';
+import { PluginInitializer } from 'kibana/public';
+import { RoutingExamplePlugin } from './plugin';
+
+export const plugin: PluginInitializer<{}, {}> = () => new RoutingExamplePlugin();
diff --git a/src/dev/build/tasks/nodejs_modules/get_dependencies.js b/examples/routing_example/public/is_error.ts
similarity index 69%
rename from src/dev/build/tasks/nodejs_modules/get_dependencies.js
rename to examples/routing_example/public/is_error.ts
index 5a39448f57d14..528cca5b50d5d 100644
--- a/src/dev/build/tasks/nodejs_modules/get_dependencies.js
+++ b/examples/routing_example/public/is_error.ts
@@ -17,11 +17,8 @@
  * under the License.
  */
 
-import { parseEntries, dependenciesParseStrategy } from '@kbn/babel-code-parser';
+import { HttpFetchError } from '../../../src/core/public';
 
-export async function getDependencies(cwd, entries) {
-  // Return the dependencies retrieve from the
-  // provided code entries (sanitized) and
-  // parseStrategy (dependencies one)
-  return Object.keys(await parseEntries(cwd, entries, dependenciesParseStrategy, {}));
+export function isError<T>(error: T | HttpFetchError): error is HttpFetchError {
+  return error instanceof HttpFetchError;
 }
diff --git a/examples/routing_example/public/plugin.tsx b/examples/routing_example/public/plugin.tsx
new file mode 100644
index 0000000000000..eabdd2ade05b2
--- /dev/null
+++ b/examples/routing_example/public/plugin.tsx
@@ -0,0 +1,78 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import {
+  CoreStart,
+  Plugin,
+  CoreSetup,
+  AppMountParameters,
+  AppNavLinkStatus,
+} from '../../../src/core/public';
+import { DeveloperExamplesSetup } from '../../developer_examples/public';
+import { getServices } from './services';
+
+interface SetupDeps {
+  developerExamples: DeveloperExamplesSetup;
+}
+
+export class RoutingExamplePlugin implements Plugin<{}, {}, SetupDeps, {}> {
+  public setup(core: CoreSetup, { developerExamples }: SetupDeps) {
+    core.application.register({
+      id: 'routingExample',
+      title: 'Routing',
+      navLinkStatus: AppNavLinkStatus.hidden,
+      async mount(params: AppMountParameters) {
+        const [coreStart] = await core.getStartServices();
+        const startServices = getServices(coreStart);
+        const { renderApp } = await import('./app');
+        return renderApp(startServices, params.element);
+      },
+    });
+
+    developerExamples.register({
+      appId: 'routingExample',
+      title: 'Routing',
+      description: `Examples show how to use core routing and fetch services to register and query your own custom routes.`,
+      links: [
+        {
+          label: 'IRouter',
+          href:
+            'https://github.com/elastic/kibana/blob/master/docs/development/core/server/kibana-plugin-core-server.irouter.md',
+          iconType: 'logoGithub',
+          target: '_blank',
+          size: 's',
+        },
+        {
+          label: 'HttpHandler (core.http.fetch)',
+          href:
+            'https://github.com/elastic/kibana/blob/master/docs/development/core/public/kibana-plugin-core-public.httphandler.md',
+          iconType: 'logoGithub',
+          target: '_blank',
+          size: 's',
+        },
+      ],
+    });
+    return {};
+  }
+
+  public start(core: CoreStart) {
+    return {};
+  }
+
+  public stop() {}
+}
diff --git a/examples/routing_example/public/post_message_example.tsx b/examples/routing_example/public/post_message_example.tsx
new file mode 100644
index 0000000000000..3004d66c4aa97
--- /dev/null
+++ b/examples/routing_example/public/post_message_example.tsx
@@ -0,0 +1,103 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import React, { useCallback } from 'react';
+import { useState } from 'react';
+import {
+  EuiText,
+  EuiButton,
+  EuiLoadingSpinner,
+  EuiFieldText,
+  EuiCallOut,
+  EuiFormRow,
+  EuiTextArea,
+} from '@elastic/eui';
+import { HttpFetchError } from '../../../src/core/public';
+import { isError } from './is_error';
+import { Services } from './services';
+
+interface Props {
+  postMessage: Services['postMessage'];
+  addSuccessToast: Services['addSuccessToast'];
+}
+
+export function PostMessageRouteExample({ postMessage, addSuccessToast }: Props) {
+  const [error, setError] = useState<HttpFetchError | undefined>();
+  const [isPosting, setIsPosting] = useState<boolean>(false);
+  const [message, setMessage] = useState<string>('');
+  const [id, setId] = useState<string>('');
+
+  const doFetch = useCallback(async () => {
+    if (isPosting) return;
+    setIsPosting(true);
+    const response = await postMessage(message, id);
+
+    if (response && isError(response)) {
+      setError(response);
+    } else {
+      setError(undefined);
+      addSuccessToast('Message was added!');
+      setMessage('');
+      setId('');
+    }
+
+    setIsPosting(false);
+  }, [isPosting, postMessage, addSuccessToast, setMessage, message, id]);
+
+  return (
+    <React.Fragment>
+      <EuiText>
+        <h2>POST example with body</h2>
+        <p>
+          This examples uses a simple POST route that takes a body parameter and an id as a param in
+          the route path.
+        </p>
+        <EuiFormRow label="Message Id">
+          <EuiFieldText
+            value={id}
+            onChange={(e) => setId(e.target.value)}
+            data-test-subj="routingExampleSetMessageId"
+          />
+        </EuiFormRow>
+        <EuiFormRow label="Message">
+          <EuiTextArea
+            data-test-subj="routingExampleSetMessage"
+            value={message}
+            onChange={(e) => setMessage(e.target.value)}
+          />
+        </EuiFormRow>
+
+        <EuiFormRow hasEmptyLabelSpace={true}>
+          <EuiButton
+            data-test-subj="routingExamplePostMessage"
+            disabled={isPosting || id === '' || message === ''}
+            onClick={() => doFetch()}
+          >
+            {isPosting ? <EuiLoadingSpinner /> : 'Post message'}
+          </EuiButton>
+        </EuiFormRow>
+
+        {error !== undefined ? (
+          <EuiCallOut color="danger" iconType="alert">
+            {error.message}
+          </EuiCallOut>
+        ) : null}
+      </EuiText>
+    </React.Fragment>
+  );
+}
diff --git a/examples/routing_example/public/random_number_between_example.tsx b/examples/routing_example/public/random_number_between_example.tsx
new file mode 100644
index 0000000000000..9f75060193114
--- /dev/null
+++ b/examples/routing_example/public/random_number_between_example.tsx
@@ -0,0 +1,98 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import React, { useCallback } from 'react';
+import { useState } from 'react';
+import {
+  EuiText,
+  EuiButton,
+  EuiLoadingSpinner,
+  EuiFieldText,
+  EuiCallOut,
+  EuiFormRow,
+} from '@elastic/eui';
+import { HttpFetchError } from '../../../src/core/public';
+import { isError } from './is_error';
+import { Services } from './services';
+
+interface Props {
+  fetchRandomNumberBetween: Services['fetchRandomNumberBetween'];
+}
+
+export function RandomNumberBetweenRouteExample({ fetchRandomNumberBetween }: Props) {
+  const [error, setError] = useState<HttpFetchError | undefined>();
+  const [randomNumber, setRandomNumber] = useState<number>(0);
+  const [isFetching, setIsFetching] = useState<boolean>(false);
+  const [maxInput, setMaxInput] = useState<string>('10');
+
+  const doFetch = useCallback(async () => {
+    if (isFetching) return;
+    setIsFetching(true);
+    const response = await fetchRandomNumberBetween(Number.parseInt(maxInput, 10));
+
+    if (isError(response)) {
+      setError(response);
+    } else {
+      setRandomNumber(response);
+    }
+
+    setIsFetching(false);
+  }, [isFetching, maxInput, fetchRandomNumberBetween]);
+
+  return (
+    <React.Fragment>
+      <EuiText>
+        <h2>GET example with query</h2>
+        <p>
+          This examples uses a simple GET route that takes a query parameter in the request and
+          returns a single number.
+        </p>
+        <EuiFormRow label="Generate a random number between 0 and">
+          <EuiFieldText
+            data-test-subj="routingExampleMaxRandomNumberBetween"
+            value={maxInput}
+            onChange={(e) => setMaxInput(e.target.value)}
+            isInvalid={isNaN(Number(maxInput))}
+          />
+        </EuiFormRow>
+
+        <EuiFormRow hasEmptyLabelSpace={true}>
+          <EuiButton
+            data-test-subj="routingExampleFetchRandomNumberBetween"
+            disabled={isFetching || isNaN(Number(maxInput))}
+            onClick={() => doFetch()}
+          >
+            {isFetching ? <EuiLoadingSpinner /> : 'Generate random number'}
+          </EuiButton>
+        </EuiFormRow>
+
+        {error !== undefined ? (
+          <EuiCallOut color="danger" iconType="alert">
+            {error.message}
+          </EuiCallOut>
+        ) : null}
+        {randomNumber > -1 ? (
+          <h2>
+            Random number is
+            <div data-test-subj="routingExampleRandomNumberBetween">{randomNumber}</div>
+          </h2>
+        ) : null}
+      </EuiText>
+    </React.Fragment>
+  );
+}
diff --git a/examples/routing_example/public/random_number_example.tsx b/examples/routing_example/public/random_number_example.tsx
new file mode 100644
index 0000000000000..6b073826c854f
--- /dev/null
+++ b/examples/routing_example/public/random_number_example.tsx
@@ -0,0 +1,78 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import React, { useCallback } from 'react';
+import { useState } from 'react';
+import { EuiText, EuiButton, EuiLoadingSpinner, EuiCallOut } from '@elastic/eui';
+import { HttpFetchError } from '../../../src/core/public';
+import { Services } from './services';
+import { isError } from './is_error';
+
+interface Props {
+  fetchRandomNumber: Services['fetchRandomNumber'];
+}
+
+export function RandomNumberRouteExample({ fetchRandomNumber }: Props) {
+  const [error, setError] = useState<HttpFetchError | undefined>(undefined);
+  const [randomNumber, setRandomNumber] = useState<number>(0);
+  const [isFetching, setIsFetching] = useState<boolean>(false);
+
+  const doFetch = useCallback(async () => {
+    if (isFetching) return;
+    setIsFetching(true);
+    const response = await fetchRandomNumber();
+
+    if (isError(response)) {
+      setError(response);
+    } else {
+      setRandomNumber(response);
+    }
+
+    setIsFetching(false);
+  }, [isFetching, fetchRandomNumber]);
+
+  return (
+    <React.Fragment>
+      <EuiText>
+        <h2>GET example</h2>
+        <p>
+          This examples uses a simple GET route that takes no parameters or body in the request and
+          returns a single number.
+        </p>
+        <EuiButton
+          data-test-subj="routingExampleFetchRandomNumber"
+          disabled={isFetching}
+          onClick={() => doFetch()}
+        >
+          {isFetching ? <EuiLoadingSpinner /> : 'Generate a random number'}
+        </EuiButton>
+
+        {error !== undefined ? (
+          <EuiCallOut color="danger" iconType="alert">
+            {error}
+          </EuiCallOut>
+        ) : null}
+        {randomNumber > -1 ? (
+          <h2>
+            Random number is <div data-test-subj="routingExampleRandomNumber">{randomNumber}</div>
+          </h2>
+        ) : null}
+      </EuiText>
+    </React.Fragment>
+  );
+}
diff --git a/examples/routing_example/public/services.ts b/examples/routing_example/public/services.ts
new file mode 100644
index 0000000000000..08a79270372fd
--- /dev/null
+++ b/examples/routing_example/public/services.ts
@@ -0,0 +1,78 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { CoreStart, HttpFetchError } from 'kibana/public';
+import {
+  RANDOM_NUMBER_ROUTE_PATH,
+  RANDOM_NUMBER_BETWEEN_ROUTE_PATH,
+  POST_MESSAGE_ROUTE_PATH,
+  INTERNAL_GET_MESSAGE_BY_ID_ROUTE,
+} from '../common';
+
+export interface Services {
+  fetchRandomNumber: () => Promise<number | HttpFetchError>;
+  fetchRandomNumberBetween: (max: number) => Promise<number | HttpFetchError>;
+  postMessage: (message: string, id: string) => Promise<undefined | HttpFetchError>;
+  getMessageById: (id: string) => Promise<string | HttpFetchError>;
+  addSuccessToast: (message: string) => void;
+}
+
+export function getServices(core: CoreStart): Services {
+  return {
+    addSuccessToast: (message: string) => core.notifications.toasts.addSuccess(message),
+    fetchRandomNumber: async () => {
+      try {
+        const response = await core.http.fetch<{ randomNumber: number }>(RANDOM_NUMBER_ROUTE_PATH);
+        return response.randomNumber;
+      } catch (e) {
+        return e;
+      }
+    },
+    fetchRandomNumberBetween: async (max: number) => {
+      try {
+        const response = await core.http.fetch<{ randomNumber: number }>(
+          RANDOM_NUMBER_BETWEEN_ROUTE_PATH,
+          { query: { max } }
+        );
+        return response.randomNumber;
+      } catch (e) {
+        return e;
+      }
+    },
+    postMessage: async (message: string, id: string) => {
+      try {
+        await core.http.post(`${POST_MESSAGE_ROUTE_PATH}/${id}`, {
+          body: JSON.stringify({ message }),
+        });
+      } catch (e) {
+        return e;
+      }
+    },
+    getMessageById: async (id: string) => {
+      try {
+        const response = await core.http.get<{ message: string }>(
+          `${INTERNAL_GET_MESSAGE_BY_ID_ROUTE}/${id}`
+        );
+        return response.message;
+      } catch (e) {
+        return e;
+      }
+    },
+  };
+}
diff --git a/examples/routing_example/server/index.ts b/examples/routing_example/server/index.ts
new file mode 100644
index 0000000000000..77a0d9bb95549
--- /dev/null
+++ b/examples/routing_example/server/index.ts
@@ -0,0 +1,24 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { PluginInitializer } from 'kibana/server';
+
+import { RoutingExamplePlugin } from './plugin';
+
+export const plugin: PluginInitializer<{}, {}> = () => new RoutingExamplePlugin();
diff --git a/examples/routing_example/server/plugin.ts b/examples/routing_example/server/plugin.ts
new file mode 100644
index 0000000000000..8e92fafc7b30c
--- /dev/null
+++ b/examples/routing_example/server/plugin.ts
@@ -0,0 +1,37 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { Plugin, CoreSetup, CoreStart } from 'kibana/server';
+import { registerRoutes } from './routes';
+
+export class RoutingExamplePlugin implements Plugin<{}, {}> {
+  public setup(core: CoreSetup) {
+    const router = core.http.createRouter();
+
+    registerRoutes(router);
+
+    return {};
+  }
+
+  public start(core: CoreStart) {
+    return {};
+  }
+
+  public stop() {}
+}
diff --git a/examples/routing_example/server/routes/index.ts b/examples/routing_example/server/routes/index.ts
new file mode 100644
index 0000000000000..ea575cf371bb7
--- /dev/null
+++ b/examples/routing_example/server/routes/index.ts
@@ -0,0 +1,19 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+export { registerRoutes } from './register_routes';
diff --git a/examples/routing_example/server/routes/message_routes.ts b/examples/routing_example/server/routes/message_routes.ts
new file mode 100644
index 0000000000000..2b4ec5e11fb4a
--- /dev/null
+++ b/examples/routing_example/server/routes/message_routes.ts
@@ -0,0 +1,90 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { schema } from '@kbn/config-schema';
+import { POST_MESSAGE_ROUTE_PATH, INTERNAL_GET_MESSAGE_BY_ID_ROUTE } from '../../common';
+
+import { IRouter } from '../../../../src/core/server';
+
+/**
+ *
+ * NOTE: DON'T USE IN MEMORY DATA STRUCTURES TO STORE DATA!
+ *
+ * That won't work in a system with multiple Kibanas, which is a setup we recommend for
+ * load balancing. I'm only doing so here to simplify the routing example. In real life,
+ * Elasticsearch should be used to persist data that can be shared across multiple Kibana
+ * instances.
+ */
+
+const messages: { [key: string]: string } = {};
+
+/**
+ * @param router Pushes a message with an id onto an in memory map.
+ */
+export function registerPostMessageRoute(router: IRouter) {
+  router.post(
+    {
+      path: `${POST_MESSAGE_ROUTE_PATH}/{id}`,
+      validate: {
+        params: schema.object({
+          // This parameter name matches the one in POST_MESSAGE_ROUTE_PATH: `api/post_message/{id}`.
+          // Params are often used for ids like this.
+          id: schema.string(),
+        }),
+        body: schema.object({
+          message: schema.string({ maxLength: 100 }),
+        }),
+      },
+    },
+    async (context, request, response) => {
+      if (messages[request.params.id]) {
+        return response.badRequest({
+          body: `Message with id ${request.params.id} already exists`,
+        });
+      }
+
+      // See note above. NEVER DO THIS IN REAL CODE! Data should only be persisted in Elasticsearch.
+      messages[request.params.id] = request.body.message;
+
+      return response.ok();
+    }
+  );
+}
+
+/**
+ * @param router Returns the message with the given id from an in memory array.
+ */
+export function registerGetMessageByIdRoute(router: IRouter) {
+  router.get(
+    {
+      path: `${INTERNAL_GET_MESSAGE_BY_ID_ROUTE}/{id}`,
+      validate: {
+        params: schema.object({
+          id: schema.string(),
+        }),
+      },
+    },
+    async (context, request, response) => {
+      if (!messages[request.params.id]) {
+        return response.notFound();
+      }
+      return response.ok({ body: { message: messages[request.params.id] } });
+    }
+  );
+}
diff --git a/examples/routing_example/server/routes/random_number_between_generator.ts b/examples/routing_example/server/routes/random_number_between_generator.ts
new file mode 100644
index 0000000000000..9481578e540fe
--- /dev/null
+++ b/examples/routing_example/server/routes/random_number_between_generator.ts
@@ -0,0 +1,47 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { schema } from '@kbn/config-schema';
+import { RANDOM_NUMBER_BETWEEN_ROUTE_PATH } from '../../common';
+
+import { IRouter } from '../../../../src/core/server';
+
+/**
+ *
+ * @param router Registers a get route that returns a random number between one and another number suplied by the user.
+ */
+export function registerGetRandomNumberBetweenRoute(router: IRouter) {
+  router.get(
+    {
+      path: RANDOM_NUMBER_BETWEEN_ROUTE_PATH,
+      validate: {
+        query: schema.object({
+          max: schema.number({ defaultValue: 10 }),
+        }),
+      },
+    },
+    async (context, request, response) => {
+      return response.ok({
+        body: {
+          randomNumber: Math.random() * request.query.max,
+        },
+      });
+    }
+  );
+}
diff --git a/src/optimize/dynamic_dll_plugin/dll_allowed_modules.js b/examples/routing_example/server/routes/random_number_generator.ts
similarity index 57%
rename from src/optimize/dynamic_dll_plugin/dll_allowed_modules.js
rename to examples/routing_example/server/routes/random_number_generator.ts
index 4314cebd3b7e9..2cfce45b957ae 100644
--- a/src/optimize/dynamic_dll_plugin/dll_allowed_modules.js
+++ b/examples/routing_example/server/routes/random_number_generator.ts
@@ -17,20 +17,27 @@
  * under the License.
  */
 
-import path from 'path';
+import { RANDOM_NUMBER_ROUTE_PATH } from '../../common';
 
-export function notInNodeModules(checkPath) {
-  return !checkPath.includes(`${path.sep}node_modules${path.sep}`);
-}
-
-export function notInNodeModulesOrWebpackShims(checkPath) {
-  return notInNodeModules(checkPath) && !checkPath.includes(`${path.sep}webpackShims${path.sep}`);
-}
+import { IRouter } from '../../../../src/core/server';
 
-export function inPluginNodeModules(checkPath) {
-  return checkPath.match(/[\/\\]plugins.*[\/\\]node_modules/);
-}
-
-export function inDllPluginPublic(checkPath) {
-  return checkPath.includes(`${path.sep}dynamic_dll_plugin${path.sep}public${path.sep}`);
+/**
+ *
+ * @param router Registers a get route that returns a random number between one and ten. It has no input
+ * parameters, and returns a random number in the body.
+ */
+export function registerGetRandomNumberRoute(router: IRouter) {
+  router.get(
+    {
+      path: RANDOM_NUMBER_ROUTE_PATH,
+      validate: {},
+    },
+    async (context, request, response) => {
+      return response.ok({
+        body: {
+          randomNumber: Math.random() * 10,
+        },
+      });
+    }
+  );
 }
diff --git a/examples/routing_example/server/routes/register_routes.ts b/examples/routing_example/server/routes/register_routes.ts
new file mode 100644
index 0000000000000..f556c0ed2c2fd
--- /dev/null
+++ b/examples/routing_example/server/routes/register_routes.ts
@@ -0,0 +1,30 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { IRouter } from 'kibana/server';
+import { registerGetRandomNumberRoute } from './random_number_generator';
+import { registerGetRandomNumberBetweenRoute } from './random_number_between_generator';
+import { registerGetMessageByIdRoute, registerPostMessageRoute } from './message_routes';
+
+export function registerRoutes(router: IRouter) {
+  registerGetRandomNumberRoute(router);
+  registerGetRandomNumberBetweenRoute(router);
+  registerGetMessageByIdRoute(router);
+  registerPostMessageRoute(router);
+}
diff --git a/examples/routing_example/tsconfig.json b/examples/routing_example/tsconfig.json
new file mode 100644
index 0000000000000..9bbd9021b2e0a
--- /dev/null
+++ b/examples/routing_example/tsconfig.json
@@ -0,0 +1,16 @@
+{
+  "extends": "../../tsconfig.json",
+  "compilerOptions": {
+    "outDir": "./target",
+    "skipLibCheck": true
+  },
+  "include": [
+    "index.ts",
+    "public/**/*.ts",
+    "public/**/*.tsx",
+    "server/**/*.ts",
+    "common/**/*.ts",
+    "../../typings/**/*",
+  ],
+  "exclude": []
+}
diff --git a/examples/ui_actions_explorer/public/actions/actions.tsx b/examples/ui_actions_explorer/public/actions/actions.tsx
index 4ef8d5bf4d9c6..6d83362e998bc 100644
--- a/examples/ui_actions_explorer/public/actions/actions.tsx
+++ b/examples/ui_actions_explorer/public/actions/actions.tsx
@@ -31,7 +31,7 @@ export const ACTION_VIEW_IN_MAPS = 'ACTION_VIEW_IN_MAPS';
 export const ACTION_TRAVEL_GUIDE = 'ACTION_TRAVEL_GUIDE';
 export const ACTION_CALL_PHONE_NUMBER = 'ACTION_CALL_PHONE_NUMBER';
 export const ACTION_EDIT_USER = 'ACTION_EDIT_USER';
-export const ACTION_PHONE_USER = 'ACTION_PHONE_USER';
+export const ACTION_TRIGGER_PHONE_USER = 'ACTION_TRIGGER_PHONE_USER';
 export const ACTION_SHOWCASE_PLUGGABILITY = 'ACTION_SHOWCASE_PLUGGABILITY';
 
 export const showcasePluggability = createAction<typeof ACTION_SHOWCASE_PLUGGABILITY>({
@@ -120,19 +120,13 @@ export interface UserContext {
   update: (user: User) => void;
 }
 
-export const createPhoneUserAction = (getUiActionsApi: () => Promise<UiActionsStart>) =>
-  createAction<typeof ACTION_PHONE_USER>({
-    type: ACTION_PHONE_USER,
+export const createTriggerPhoneTriggerAction = (getUiActionsApi: () => Promise<UiActionsStart>) =>
+  createAction<typeof ACTION_TRIGGER_PHONE_USER>({
+    type: ACTION_TRIGGER_PHONE_USER,
     getDisplayName: () => 'Call phone number',
+    shouldAutoExecute: async () => true,
     isCompatible: async ({ user }) => user.phone !== undefined,
     execute: async ({ user }) => {
-      // One option - execute the more specific action directly.
-      // makePhoneCallAction.execute({ phone: user.phone });
-
-      // Another option - emit the trigger and automatically get *all* the actions attached
-      // to the phone number trigger.
-      // TODO: we need to figure out the best way to handle these nested actions however, since
-      // we don't want multiple context menu's to pop up.
       if (user.phone !== undefined) {
         (await getUiActionsApi()).executeTriggerActions(PHONE_TRIGGER, { phone: user.phone });
       }
diff --git a/examples/ui_actions_explorer/public/plugin.tsx b/examples/ui_actions_explorer/public/plugin.tsx
index 670138b43b9c4..b28e5e7a9f692 100644
--- a/examples/ui_actions_explorer/public/plugin.tsx
+++ b/examples/ui_actions_explorer/public/plugin.tsx
@@ -23,7 +23,6 @@ import {
   PHONE_TRIGGER,
   USER_TRIGGER,
   COUNTRY_TRIGGER,
-  createPhoneUserAction,
   lookUpWeatherAction,
   viewInMapsAction,
   createEditUserAction,
@@ -37,7 +36,8 @@ import {
   ACTION_CALL_PHONE_NUMBER,
   ACTION_TRAVEL_GUIDE,
   ACTION_VIEW_IN_MAPS,
-  ACTION_PHONE_USER,
+  ACTION_TRIGGER_PHONE_USER,
+  createTriggerPhoneTriggerAction,
 } from './actions/actions';
 import { DeveloperExamplesSetup } from '../../developer_examples/public';
 import image from './ui_actions.png';
@@ -64,7 +64,7 @@ declare module '../../../src/plugins/ui_actions/public' {
     [ACTION_CALL_PHONE_NUMBER]: PhoneContext;
     [ACTION_TRAVEL_GUIDE]: CountryContext;
     [ACTION_VIEW_IN_MAPS]: CountryContext;
-    [ACTION_PHONE_USER]: UserContext;
+    [ACTION_TRIGGER_PHONE_USER]: UserContext;
   }
 }
 
@@ -84,7 +84,7 @@ export class UiActionsExplorerPlugin implements Plugin<void, void, {}, StartDeps
 
     deps.uiActions.addTriggerAction(
       USER_TRIGGER,
-      createPhoneUserAction(async () => (await startServices)[1].uiActions)
+      createTriggerPhoneTriggerAction(async () => (await startServices)[1].uiActions)
     );
     deps.uiActions.addTriggerAction(
       USER_TRIGGER,
diff --git a/package.json b/package.json
index 53aa6b25f190b..a22871e314bae 100644
--- a/package.json
+++ b/package.json
@@ -125,7 +125,7 @@
     "@elastic/apm-rum": "^5.2.0",
     "@elastic/charts": "19.8.1",
     "@elastic/datemath": "5.0.3",
-    "@elastic/elasticsearch": "7.8.0",
+    "@elastic/elasticsearch": "7.9.0-rc.1",
     "@elastic/ems-client": "7.9.3",
     "@elastic/eui": "26.3.1",
     "@elastic/filesaver": "1.1.2",
@@ -137,7 +137,6 @@
     "@hapi/good-squeeze": "5.2.1",
     "@hapi/wreck": "^15.0.2",
     "@kbn/analytics": "1.0.0",
-    "@kbn/babel-code-parser": "1.0.0",
     "@kbn/babel-preset": "1.0.0",
     "@kbn/config-schema": "1.0.0",
     "@kbn/i18n": "1.0.0",
@@ -237,7 +236,7 @@
     "pug": "^2.0.4",
     "query-string": "5.1.1",
     "raw-loader": "3.1.0",
-    "re2": "1.14.0",
+    "re2": "^1.15.4",
     "react": "^16.12.0",
     "react-color": "^2.13.8",
     "react-dom": "^16.12.0",
diff --git a/packages/kbn-babel-code-parser/.babelrc b/packages/kbn-babel-code-parser/.babelrc
deleted file mode 100644
index 7da72d1779128..0000000000000
--- a/packages/kbn-babel-code-parser/.babelrc
+++ /dev/null
@@ -1,3 +0,0 @@
-{
-  "presets": ["@kbn/babel-preset/node_preset"]
-}
diff --git a/packages/kbn-babel-code-parser/README.md b/packages/kbn-babel-code-parser/README.md
deleted file mode 100755
index f99d01541ee22..0000000000000
--- a/packages/kbn-babel-code-parser/README.md
+++ /dev/null
@@ -1,19 +0,0 @@
-# @kbn/babel-code-parser
-
-Simple abstraction over the `@babel/parser` and the `@babel/traverse` in order 
-to build a code parser on top.
-
-We have two main functions `parseSingleFile` (sync and sync version) and the 
-`parseEntries` (only async version). The first one just parse one entry file
-and the second one parses recursively all the files from a list of 
-start entry points.
-
-Then we have `visitors` and `strategies`. The first ones are basically the
-`visitors` to use into the ast from the `@babel/traverse`. They are the only
-way to collect info when using the `parseSingleFile`. The `strategies` are
-meant to be used with the `parseEntries` and configures the info we want
-to collect from our parsed code. After each loop, one per entry file, the
-`parseEntries` method will call the given `strategy` expecting that 
-`strategy` would call the desired visitors, assemble the important 
-information to collect and adds them to the final results.
-
diff --git a/packages/kbn-babel-code-parser/package.json b/packages/kbn-babel-code-parser/package.json
deleted file mode 100755
index 6f42c086ecaab..0000000000000
--- a/packages/kbn-babel-code-parser/package.json
+++ /dev/null
@@ -1,26 +0,0 @@
-{
-  "name": "@kbn/babel-code-parser",
-  "description": "babel code parser for Kibana",
-  "private": true,
-  "version": "1.0.0",
-  "main": "./target/index.js",
-  "license": "Apache-2.0",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/elastic/kibana/tree/master/packages/kbn-babel-code-parser"
-  },
-  "scripts": {
-    "build": "babel src --out-dir target",
-    "kbn:bootstrap": "yarn build --quiet",
-    "kbn:watch": "yarn build --watch"
-  },
-  "devDependencies": {
-    "@babel/cli": "^7.10.1"
-  },
-  "dependencies": {
-    "@kbn/babel-preset": "1.0.0",
-    "@babel/parser": "^7.10.2",
-    "@babel/traverse": "^7.10.1",
-    "lodash": "^4.17.15"
-  }
-}
diff --git a/packages/kbn-babel-code-parser/src/code_parser.js b/packages/kbn-babel-code-parser/src/code_parser.js
deleted file mode 100644
index 91927780363ac..0000000000000
--- a/packages/kbn-babel-code-parser/src/code_parser.js
+++ /dev/null
@@ -1,105 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { canRequire } from './can_require';
-import { readFile, readFileSync } from 'fs';
-import { extname } from 'path';
-import { promisify } from 'util';
-import * as parser from '@babel/parser';
-import traverse from '@babel/traverse';
-import * as babelParserOptions from '@kbn/babel-preset/common_babel_parser_options';
-
-const read = promisify(readFile);
-
-function _cannotParseFile(filePath) {
-  return extname(filePath) !== '.js';
-}
-
-function _parseAndTraverseFileContent(fileContent, visitorsGenerator) {
-  const results = [];
-
-  // Parse and get the code AST
-  // All the babel parser plugins
-  // were enabled
-  const ast = parser.parse(fileContent, babelParserOptions);
-
-  // Loop through the code AST with
-  // the defined visitors
-  traverse(ast, visitorsGenerator(results));
-
-  return results;
-}
-
-export async function parseSingleFile(filePath, visitorsGenerator) {
-  // Don't parse any other files than .js ones
-  if (_cannotParseFile(filePath)) {
-    return [];
-  }
-
-  // Read the file
-  const content = await read(filePath, { encoding: 'utf8' });
-
-  // return the results found on parse and traverse
-  // the file content with the given visitors
-  return _parseAndTraverseFileContent(content, visitorsGenerator);
-}
-
-export function parseSingleFileSync(filePath, visitorsGenerator) {
-  // Don't parse any other files than .js ones
-  if (_cannotParseFile(filePath)) {
-    return [];
-  }
-
-  // Read the file
-  const content = readFileSync(filePath, { encoding: 'utf8' });
-
-  // return the results found on parse and traverse
-  // the file content with the given visitors
-  return _parseAndTraverseFileContent(content, visitorsGenerator);
-}
-
-export async function parseEntries(cwd, entries, strategy, results, wasParsed = {}) {
-  // Assure that we always have a cwd
-  const sanitizedCwd = cwd || process.cwd();
-
-  // Test each entry against canRequire function
-  const entriesQueue = entries.map((entry) => canRequire(entry));
-
-  while (entriesQueue.length) {
-    // Get the first element in the queue as
-    // select it as our current entry to parse
-    const mainEntry = entriesQueue.shift();
-
-    // Avoid parse the current entry if it is not valid
-    // or it was already parsed
-    if (typeof mainEntry !== 'string' || wasParsed[mainEntry]) {
-      continue;
-    }
-
-    // Find new entries and adds them to the end of the queue
-    entriesQueue.push(
-      ...(await strategy(sanitizedCwd, parseSingleFile, mainEntry, wasParsed, results))
-    );
-
-    // Mark the current main entry as already parsed
-    wasParsed[mainEntry] = true;
-  }
-
-  return results;
-}
diff --git a/packages/kbn-babel-code-parser/src/strategies.js b/packages/kbn-babel-code-parser/src/strategies.js
deleted file mode 100644
index 2369692ad434b..0000000000000
--- a/packages/kbn-babel-code-parser/src/strategies.js
+++ /dev/null
@@ -1,103 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { canRequire } from './can_require';
-import { dependenciesVisitorsGenerator } from './visitors';
-import { dirname, isAbsolute, resolve } from 'path';
-import { builtinModules } from 'module';
-
-export function _calculateTopLevelDependency(inputDep, outputDep = '') {
-  // The path separator will be always the forward slash
-  // as at this point we only have the found entries into
-  // the provided source code entries where we just use it
-  const pathSeparator = '/';
-  const depSplitPaths = inputDep.split(pathSeparator);
-  const firstPart = depSplitPaths.shift();
-  const outputDepFirstArgAppend = outputDep ? pathSeparator : '';
-
-  outputDep += `${outputDepFirstArgAppend}${firstPart}`;
-
-  // In case our dependency isn't started by @
-  // we are already done and we can return the
-  // dependency value we already have
-  if (firstPart.charAt(0) !== '@') {
-    return outputDep;
-  }
-
-  // Otherwise we need to keep constructing the dependency
-  // value because dependencies starting with @ points to
-  // folders of dependencies. For example, in case we found
-  // dependencies values with '@the-deps/a' and '@the-deps/a/b'
-  // we don't want to map it to '@the-deps' but also to @'the-deps/a'
-  // because inside '@the-deps' we can also have '@the-dep/b'
-  return _calculateTopLevelDependency(depSplitPaths.join(pathSeparator), outputDep);
-}
-
-export async function dependenciesParseStrategy(
-  cwd,
-  parseSingleFile,
-  mainEntry,
-  wasParsed,
-  results
-) {
-  // Get dependencies from a single file and filter
-  // out node native modules from the result
-  const dependencies = (await parseSingleFile(mainEntry, dependenciesVisitorsGenerator)).filter(
-    (dep) => !builtinModules.includes(dep)
-  );
-
-  // Return the list of all the new entries found into
-  // the current mainEntry that we could use to look for
-  // new dependencies
-  return dependencies.reduce((filteredEntries, entry) => {
-    const absEntryPath = resolve(cwd, dirname(mainEntry), entry);
-
-    // NOTE: cwd for following canRequires is absEntryPath
-    // because we should start looking from there
-    const requiredPath = canRequire(absEntryPath, absEntryPath);
-    const requiredRelativePath = canRequire(entry, absEntryPath);
-
-    const isRelativeFile = !isAbsolute(entry);
-    const isNodeModuleDep = isRelativeFile && !requiredPath && requiredRelativePath;
-    const isNewEntry = isRelativeFile && requiredPath;
-
-    // If it is a node_module add it to the results and also
-    // add the resolved path for the node_module main file
-    // as an entry point to look for dependencies it was
-    // not already parsed
-    if (isNodeModuleDep) {
-      // Save the result as the top level dependency
-      results[_calculateTopLevelDependency(entry)] = true;
-
-      if (!wasParsed[requiredRelativePath]) {
-        filteredEntries.push(requiredRelativePath);
-      }
-    }
-
-    // If a new, not yet parsed, relative entry were found
-    // add it to the list of entries to be parsed
-    if (isNewEntry && !wasParsed[requiredPath]) {
-      if (!wasParsed[requiredPath]) {
-        filteredEntries.push(requiredPath);
-      }
-    }
-
-    return filteredEntries;
-  }, []);
-}
diff --git a/packages/kbn-babel-code-parser/src/strategies.test.js b/packages/kbn-babel-code-parser/src/strategies.test.js
deleted file mode 100644
index e61c784cdcd54..0000000000000
--- a/packages/kbn-babel-code-parser/src/strategies.test.js
+++ /dev/null
@@ -1,108 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { readFile } from 'fs';
-import { canRequire } from './can_require';
-import { parseSingleFile } from './code_parser';
-import { _calculateTopLevelDependency, dependenciesParseStrategy } from './strategies';
-
-jest.mock('./can_require', () => ({
-  canRequire: jest.fn(),
-}));
-
-jest.mock('fs', () => ({
-  readFile: jest.fn(),
-}));
-
-const mockCwd = '/tmp/project/dir/';
-
-describe('Code Parser Strategies', () => {
-  it('should calculate the top level dependencies correctly', () => {
-    const plainDep = 'dep1/file';
-    const foldedDep = '@kbn/es/file';
-    const otherFoldedDep = '@kbn/es';
-
-    expect(_calculateTopLevelDependency(plainDep)).toEqual('dep1');
-    expect(_calculateTopLevelDependency(foldedDep)).toEqual('@kbn/es');
-    expect(_calculateTopLevelDependency(otherFoldedDep)).toEqual('@kbn/es');
-  });
-
-  it('should exclude native modules', async () => {
-    readFile.mockImplementationOnce((path, options, cb) => {
-      cb(null, `require('fs')`);
-    });
-
-    const results = [];
-    await dependenciesParseStrategy(mockCwd, parseSingleFile, 'dep1/file.js', {}, results);
-
-    expect(results.length).toBe(0);
-  });
-
-  it('should return a dep from_modules', async () => {
-    readFile.mockImplementationOnce((path, options, cb) => {
-      cb(null, `require('dep_from_node_modules')`);
-    });
-
-    canRequire.mockImplementation((entry, cwd) => {
-      if (entry === `${cwd}dep1/dep_from_node_modules`) {
-        return false;
-      }
-
-      if (entry === 'dep_from_node_modules') {
-        return `${mockCwd}node_modules/dep_from_node_modules/index.js`;
-      }
-    });
-
-    const results = await dependenciesParseStrategy(
-      mockCwd,
-      parseSingleFile,
-      'dep1/file.js',
-      {},
-      {}
-    );
-    expect(results[0]).toBe(`${mockCwd}node_modules/dep_from_node_modules/index.js`);
-  });
-
-  it('should return a relative dep file', async () => {
-    readFile.mockImplementationOnce((path, options, cb) => {
-      cb(null, `require('./relative_dep')`);
-    });
-
-    canRequire.mockImplementation((entry) => {
-      if (entry === `${mockCwd}dep1/relative_dep`) {
-        return `${entry}/index.js`;
-      }
-
-      return false;
-    });
-
-    const results = await dependenciesParseStrategy(
-      mockCwd,
-      parseSingleFile,
-      'dep1/file.js',
-      {},
-      {}
-    );
-    expect(results[0]).toBe(`${mockCwd}dep1/relative_dep/index.js`);
-  });
-
-  afterAll(() => {
-    jest.clearAllMocks();
-  });
-});
diff --git a/packages/kbn-babel-code-parser/src/visitors.js b/packages/kbn-babel-code-parser/src/visitors.js
deleted file mode 100644
index b159848d424fa..0000000000000
--- a/packages/kbn-babel-code-parser/src/visitors.js
+++ /dev/null
@@ -1,124 +0,0 @@
-/* eslint-disable @kbn/eslint/require-license-header */
-
-import { matches } from 'lodash';
-
-/* @notice
- *
- * This product has relied on ASTExplorer that is licensed under MIT.
- */
-export function dependenciesVisitorsGenerator(dependenciesAcc) {
-  return (() => {
-    // This was built with help on an ast explorer and some ESTree docs
-    // like the babel parser ast spec and the main docs for the Esprima
-    // which is a complete and useful docs for the ESTree spec.
-    //
-    // https://astexplorer.net
-    // https://github.com/babel/babel/blob/master/packages/babel-parser/ast/spec.md
-    // https://esprima.readthedocs.io/en/latest/syntax-tree-format.html
-    // https://github.com/estree/estree
-    return {
-      // Visitors to traverse and found dependencies
-      // raw values on require + require.resolve
-      CallExpression: ({ node }) => {
-        // AST check for require expressions
-        const isRequire = (node) => {
-          return matches({
-            callee: {
-              type: 'Identifier',
-              name: 'require',
-            },
-          })(node);
-        };
-
-        // AST check for require.resolve expressions
-        const isRequireResolve = (node) => {
-          return matches({
-            callee: {
-              type: 'MemberExpression',
-              object: {
-                type: 'Identifier',
-                name: 'require',
-              },
-              property: {
-                type: 'Identifier',
-                name: 'resolve',
-              },
-            },
-          })(node);
-        };
-
-        // Get string values inside the expressions
-        // whether they are require or require.resolve
-        if (isRequire(node) || isRequireResolve(node)) {
-          const nodeArguments = node.arguments;
-          const reqArg = Array.isArray(nodeArguments) ? nodeArguments.shift() : null;
-
-          if (!reqArg) {
-            return;
-          }
-
-          if (reqArg.type === 'StringLiteral') {
-            dependenciesAcc.push(reqArg.value);
-          }
-        }
-      },
-      // Visitors to traverse and found dependencies
-      // raw values on import
-      ImportDeclaration: ({ node }) => {
-        // AST check for supported import expressions
-        const isImport = (node) => {
-          return matches({
-            type: 'ImportDeclaration',
-            source: {
-              type: 'StringLiteral',
-            },
-          })(node);
-        };
-
-        // Get string values from import expressions
-        if (isImport(node)) {
-          const importSource = node.source;
-          dependenciesAcc.push(importSource.value);
-        }
-      },
-      // Visitors to traverse and found dependencies
-      // raw values on export from
-      ExportNamedDeclaration: ({ node }) => {
-        // AST check for supported export from expressions
-        const isExportFrom = (node) => {
-          return matches({
-            type: 'ExportNamedDeclaration',
-            source: {
-              type: 'StringLiteral',
-            },
-          })(node);
-        };
-
-        // Get string values from export from expressions
-        if (isExportFrom(node)) {
-          const exportFromSource = node.source;
-          dependenciesAcc.push(exportFromSource.value);
-        }
-      },
-      // Visitors to traverse and found dependencies
-      // raw values on export * from
-      ExportAllDeclaration: ({ node }) => {
-        // AST check for supported export * from expressions
-        const isExportAllFrom = (node) => {
-          return matches({
-            type: 'ExportAllDeclaration',
-            source: {
-              type: 'StringLiteral',
-            },
-          })(node);
-        };
-
-        // Get string values from export * from expressions
-        if (isExportAllFrom(node)) {
-          const exportAllFromSource = node.source;
-          dependenciesAcc.push(exportAllFromSource.value);
-        }
-      },
-    };
-  })();
-}
diff --git a/packages/kbn-babel-code-parser/src/visitors.test.js b/packages/kbn-babel-code-parser/src/visitors.test.js
deleted file mode 100644
index d2704fa9dfb72..0000000000000
--- a/packages/kbn-babel-code-parser/src/visitors.test.js
+++ /dev/null
@@ -1,68 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import * as parser from '@babel/parser';
-import traverse from '@babel/traverse';
-import { dependenciesVisitorsGenerator } from './visitors';
-
-const visitorsApplier = (code) => {
-  const result = [];
-  traverse(
-    parser.parse(code, {
-      sourceType: 'unambiguous',
-      plugins: ['exportDefaultFrom'],
-    }),
-    dependenciesVisitorsGenerator(result)
-  );
-  return result;
-};
-
-describe('Code Parser Visitors', () => {
-  it('should get values from require', () => {
-    const rawCode = `/*foo*/require('dep1'); const bar = 1;`;
-    const foundDeps = visitorsApplier(rawCode);
-    expect(foundDeps[0] === 'dep1');
-  });
-
-  it('should get values from require.resolve', () => {
-    const rawCode = `/*foo*/require.resolve('dep2'); const bar = 1;`;
-    const foundDeps = visitorsApplier(rawCode);
-    expect(foundDeps[0] === 'dep2');
-  });
-
-  it('should get values from import', () => {
-    const rawCode = `/*foo*/import dep1 from 'dep1'; import dep2 from 'dep2';const bar = 1;`;
-    const foundDeps = visitorsApplier(rawCode);
-    expect(foundDeps[0] === 'dep1');
-    expect(foundDeps[1] === 'dep2');
-  });
-
-  it('should get values from export from', () => {
-    const rawCode = `/*foo*/export dep1 from 'dep1'; import dep2 from 'dep2';const bar = 1;`;
-    const foundDeps = visitorsApplier(rawCode);
-    expect(foundDeps[0] === 'dep1');
-  });
-
-  it('should get values from export * from', () => {
-    const rawCode = `/*foo*/export * from 'dep1'; export dep2 from 'dep2';const bar = 1;`;
-    const foundDeps = visitorsApplier(rawCode);
-    expect(foundDeps[0] === 'dep1');
-    expect(foundDeps[1] === 'dep2');
-  });
-});
diff --git a/packages/kbn-babel-code-parser/yarn.lock b/packages/kbn-babel-code-parser/yarn.lock
deleted file mode 120000
index 3f82ebc9cdbae..0000000000000
--- a/packages/kbn-babel-code-parser/yarn.lock
+++ /dev/null
@@ -1 +0,0 @@
-../../yarn.lock
\ No newline at end of file
diff --git a/packages/kbn-dev-utils/package.json b/packages/kbn-dev-utils/package.json
index d95cd1d404a1b..b307bd41bb4dd 100644
--- a/packages/kbn-dev-utils/package.json
+++ b/packages/kbn-dev-utils/package.json
@@ -17,6 +17,7 @@
     "exit-hook": "^2.2.0",
     "getopts": "^2.2.5",
     "load-json-file": "^6.2.0",
+    "normalize-path": "^3.0.0",
     "moment": "^2.24.0",
     "rxjs": "^6.5.5",
     "tree-kill": "^1.2.2",
diff --git a/packages/kbn-dev-utils/src/index.ts b/packages/kbn-dev-utils/src/index.ts
index fad5f85ab5890..3e9e6238df9dc 100644
--- a/packages/kbn-dev-utils/src/index.ts
+++ b/packages/kbn-dev-utils/src/index.ts
@@ -39,3 +39,5 @@ export { KbnClient } from './kbn_client';
 export * from './axios';
 export * from './stdio';
 export * from './ci_stats_reporter';
+export * from './plugin_list';
+export * from './simple_kibana_platform_plugin_discovery';
diff --git a/packages/kbn-dev-utils/src/plugin_list/discover_plugins.ts b/packages/kbn-dev-utils/src/plugin_list/discover_plugins.ts
new file mode 100644
index 0000000000000..733b9f23a5394
--- /dev/null
+++ b/packages/kbn-dev-utils/src/plugin_list/discover_plugins.ts
@@ -0,0 +1,69 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import Path from 'path';
+import Fs from 'fs';
+
+import MarkdownIt from 'markdown-it';
+import cheerio from 'cheerio';
+
+import { REPO_ROOT } from '../repo_root';
+import { simpleKibanaPlatformPluginDiscovery } from '../simple_kibana_platform_plugin_discovery';
+
+export interface Plugin {
+  id: string;
+  relativeDir?: string;
+  relativeReadmePath?: string;
+  readmeSnippet?: string;
+}
+
+export type Plugins = Plugin[];
+
+const getReadmeName = (directory: string) =>
+  Fs.readdirSync(directory).find((name) => name.toLowerCase() === 'readme.md');
+
+export const discoverPlugins = (pluginsRootDir: string): Plugins =>
+  simpleKibanaPlatformPluginDiscovery([pluginsRootDir], []).map(
+    ({ directory, manifest: { id } }): Plugin => {
+      const readmeName = getReadmeName(directory);
+
+      let relativeReadmePath: string | undefined;
+      let readmeSnippet: string | undefined;
+      if (readmeName) {
+        const readmePath = Path.resolve(directory, readmeName);
+        relativeReadmePath = Path.relative(REPO_ROOT, readmePath);
+
+        const md = new MarkdownIt();
+        const parsed = md.render(Fs.readFileSync(readmePath, 'utf8'));
+        const $ = cheerio.load(parsed);
+
+        const firstParagraph = $('p')[0];
+        if (firstParagraph) {
+          readmeSnippet = $(firstParagraph).text();
+        }
+      }
+
+      return {
+        id,
+        relativeReadmePath,
+        relativeDir: relativeReadmePath || Path.relative(REPO_ROOT, directory),
+        readmeSnippet,
+      };
+    }
+  );
diff --git a/packages/kbn-dev-utils/src/plugin_list/generate_plugin_list.ts b/packages/kbn-dev-utils/src/plugin_list/generate_plugin_list.ts
new file mode 100644
index 0000000000000..f0f799862e24e
--- /dev/null
+++ b/packages/kbn-dev-utils/src/plugin_list/generate_plugin_list.ts
@@ -0,0 +1,84 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import Path from 'path';
+
+import normalizePath from 'normalize-path';
+
+import { REPO_ROOT } from '../repo_root';
+import { Plugins } from './discover_plugins';
+
+function* printPlugins(plugins: Plugins) {
+  for (const plugin of plugins) {
+    const path = plugin.relativeReadmePath || plugin.relativeDir;
+    yield '';
+    yield `- {kib-repo}blob/{branch}/${path}[${plugin.id}]`;
+
+    if (!plugin.relativeReadmePath || plugin.readmeSnippet) {
+      yield '';
+      yield plugin.readmeSnippet || 'WARNING: Missing README.';
+      yield '';
+    }
+  }
+}
+
+export function generatePluginList(ossPlugins: Plugins, xpackPlugins: Plugins) {
+  return `////
+
+NOTE:
+  This is an automatically generated file. Please do not edit directly. Instead, run the
+  following from within the kibana repository:
+
+    node scripts/build_plugin_list_docs
+
+  You can update the template within ${normalizePath(
+    Path.relative(REPO_ROOT, Path.resolve(__dirname, __filename))
+  )}
+
+////
+
+[[code-exploration]]
+== Exploring Kibana code
+
+The goals of our folder heirarchy are:
+
+- Easy for developers to know where to add new services, plugins and applications.
+- Easy for developers to know where to find the code from services, plugins and applications.
+- Easy to browse and understand our folder structure.
+
+To that aim, we strive to:
+
+- Avoid too many files in any given folder.
+- Choose clear, unambigious folder names.
+- Organize by domain.
+- Every folder should contain a README that describes the contents of that folder.
+
+[discrete]
+[[kibana-services-applications]]
+=== Services and Applications
+
+[discrete]
+==== src/plugins
+${Array.from(printPlugins(ossPlugins)).join('\n')}
+
+[discrete]
+==== x-pack/plugins
+${Array.from(printPlugins(xpackPlugins)).join('\n')}
+`;
+}
diff --git a/src/dev/build/tasks/nodejs_modules/index.js b/packages/kbn-dev-utils/src/plugin_list/index.ts
similarity index 90%
rename from src/dev/build/tasks/nodejs_modules/index.js
rename to packages/kbn-dev-utils/src/plugin_list/index.ts
index 1c5392662ad13..7e964f92b089b 100644
--- a/src/dev/build/tasks/nodejs_modules/index.js
+++ b/packages/kbn-dev-utils/src/plugin_list/index.ts
@@ -17,4 +17,4 @@
  * under the License.
  */
 
-export { CleanClientModulesOnDLLTask } from './clean_client_modules_on_dll_task';
+export * from './run_plugin_list_cli';
diff --git a/packages/kbn-dev-utils/src/plugin_list/run_plugin_list_cli.ts b/packages/kbn-dev-utils/src/plugin_list/run_plugin_list_cli.ts
new file mode 100644
index 0000000000000..817534ba5b154
--- /dev/null
+++ b/packages/kbn-dev-utils/src/plugin_list/run_plugin_list_cli.ts
@@ -0,0 +1,49 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import Path from 'path';
+import Fs from 'fs';
+
+import { run } from '../run';
+import { REPO_ROOT } from '../repo_root';
+
+import { discoverPlugins } from './discover_plugins';
+import { generatePluginList } from './generate_plugin_list';
+
+const OSS_PLUGIN_DIR = Path.resolve(REPO_ROOT, 'src/plugins');
+const XPACK_PLUGIN_DIR = Path.resolve(REPO_ROOT, 'x-pack/plugins');
+const OUTPUT_PATH = Path.resolve(
+  REPO_ROOT,
+  'docs/developer/architecture/code-exploration.asciidoc'
+);
+
+export function runPluginListCli() {
+  run(async ({ log }) => {
+    log.info('looking for oss plugins');
+    const ossPlugins = discoverPlugins(OSS_PLUGIN_DIR);
+    log.success(`found ${ossPlugins.length} plugins`);
+
+    log.info('looking for x-pack plugins');
+    const xpackPlugins = discoverPlugins(XPACK_PLUGIN_DIR);
+    log.success(`found ${xpackPlugins.length} plugins`);
+
+    log.info('writing plugin list to', OUTPUT_PATH);
+    Fs.writeFileSync(OUTPUT_PATH, generatePluginList(ossPlugins, xpackPlugins));
+  });
+}
diff --git a/packages/kbn-dev-utils/src/simple_kibana_platform_plugin_discovery.ts b/packages/kbn-dev-utils/src/simple_kibana_platform_plugin_discovery.ts
new file mode 100644
index 0000000000000..c7155b2b3c51b
--- /dev/null
+++ b/packages/kbn-dev-utils/src/simple_kibana_platform_plugin_discovery.ts
@@ -0,0 +1,86 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import Path from 'path';
+
+import globby from 'globby';
+import loadJsonFile from 'load-json-file';
+
+export interface KibanaPlatformPlugin {
+  readonly directory: string;
+  readonly manifestPath: string;
+  readonly manifest: {
+    id: string;
+    [key: string]: unknown;
+  };
+}
+
+/**
+ * Helper to find the new platform plugins.
+ */
+export function simpleKibanaPlatformPluginDiscovery(scanDirs: string[], paths: string[]) {
+  const patterns = Array.from(
+    new Set([
+      // find kibana.json files up to 5 levels within the scan dir
+      ...scanDirs.reduce(
+        (acc: string[], dir) => [
+          ...acc,
+          `${dir}/*/kibana.json`,
+          `${dir}/*/*/kibana.json`,
+          `${dir}/*/*/*/kibana.json`,
+          `${dir}/*/*/*/*/kibana.json`,
+          `${dir}/*/*/*/*/*/kibana.json`,
+        ],
+        []
+      ),
+      ...paths.map((path) => `${path}/kibana.json`),
+    ])
+  );
+
+  const manifestPaths = globby.sync(patterns, { absolute: true }).map((path) =>
+    // absolute paths returned from globby are using normalize or something so the path separators are `/` even on windows, Path.resolve solves this
+    Path.resolve(path)
+  );
+
+  return manifestPaths.map(
+    (manifestPath): KibanaPlatformPlugin => {
+      if (!Path.isAbsolute(manifestPath)) {
+        throw new TypeError('expected new platform manifest path to be absolute');
+      }
+
+      const manifest = loadJsonFile.sync(manifestPath);
+      if (!manifest || typeof manifest !== 'object' || Array.isArray(manifest)) {
+        throw new TypeError('expected new platform plugin manifest to be a JSON encoded object');
+      }
+
+      if (typeof manifest.id !== 'string') {
+        throw new TypeError('expected new platform plugin manifest to have a string id');
+      }
+
+      return {
+        directory: Path.dirname(manifestPath),
+        manifestPath,
+        manifest: {
+          ...manifest,
+          id: manifest.id,
+        },
+      };
+    }
+  );
+}
diff --git a/packages/kbn-es/package.json b/packages/kbn-es/package.json
index 271b4a3dc661b..f53eb694ec712 100644
--- a/packages/kbn-es/package.json
+++ b/packages/kbn-es/package.json
@@ -5,7 +5,7 @@
   "license": "Apache-2.0",
   "private": true,
   "dependencies": {
-    "@elastic/elasticsearch": "^7.4.0",
+    "@elastic/elasticsearch": "7.9.0-rc.1",
     "@kbn/dev-utils": "1.0.0",
     "abort-controller": "^2.0.3",
     "chalk": "^2.4.2",
diff --git a/packages/kbn-optimizer/src/optimizer/kibana_platform_plugins.ts b/packages/kbn-optimizer/src/optimizer/kibana_platform_plugins.ts
index b489c53be47b9..a848d779dc9a2 100644
--- a/packages/kbn-optimizer/src/optimizer/kibana_platform_plugins.ts
+++ b/packages/kbn-optimizer/src/optimizer/kibana_platform_plugins.ts
@@ -17,10 +17,7 @@
  * under the License.
  */
 
-import Path from 'path';
-
-import globby from 'globby';
-import loadJsonFile from 'load-json-file';
+import { simpleKibanaPlatformPluginDiscovery } from '@kbn/dev-utils';
 
 export interface KibanaPlatformPlugin {
   readonly directory: string;
@@ -30,72 +27,32 @@ export interface KibanaPlatformPlugin {
   readonly extraPublicDirs: string[];
 }
 
+const isArrayOfStrings = (input: any): input is string[] =>
+  Array.isArray(input) && input.every((p) => typeof p === 'string');
+
 /**
  * Helper to find the new platform plugins.
  */
 export function findKibanaPlatformPlugins(scanDirs: string[], paths: string[]) {
-  return globby
-    .sync(
-      Array.from(
-        new Set([
-          ...scanDirs.map(nestedScanDirPaths).reduce((dirs, current) => [...dirs, ...current], []),
-          ...paths.map((path) => `${path}/kibana.json`),
-        ])
-      ),
-      {
-        absolute: true,
+  return simpleKibanaPlatformPluginDiscovery(scanDirs, paths).map(
+    ({ directory, manifestPath, manifest }): KibanaPlatformPlugin => {
+      let extraPublicDirs: string[] | undefined;
+      if (manifest.extraPublicDirs) {
+        if (!isArrayOfStrings(manifest.extraPublicDirs)) {
+          throw new TypeError(
+            'expected new platform plugin manifest to have an array of strings `extraPublicDirs` property'
+          );
+        }
+        extraPublicDirs = manifest.extraPublicDirs;
       }
-    )
-    .map((path) =>
-      // absolute paths returned from globby are using normalize or something so the path separators are `/` even on windows, Path.resolve solves this
-      readKibanaPlatformPlugin(Path.resolve(path))
-    );
-}
-
-function nestedScanDirPaths(dir: string): string[] {
-  // down to 5 level max
-  return [
-    `${dir}/*/kibana.json`,
-    `${dir}/*/*/kibana.json`,
-    `${dir}/*/*/*/kibana.json`,
-    `${dir}/*/*/*/*/kibana.json`,
-    `${dir}/*/*/*/*/*/kibana.json`,
-  ];
-}
 
-function readKibanaPlatformPlugin(manifestPath: string): KibanaPlatformPlugin {
-  if (!Path.isAbsolute(manifestPath)) {
-    throw new TypeError('expected new platform manifest path to be absolute');
-  }
-
-  const manifest = loadJsonFile.sync(manifestPath);
-  if (!manifest || typeof manifest !== 'object' || Array.isArray(manifest)) {
-    throw new TypeError('expected new platform plugin manifest to be a JSON encoded object');
-  }
-
-  if (typeof manifest.id !== 'string') {
-    throw new TypeError('expected new platform plugin manifest to have a string id');
-  }
-
-  let extraPublicDirs: string[] | undefined;
-  if (manifest.extraPublicDirs) {
-    if (
-      !Array.isArray(manifest.extraPublicDirs) ||
-      !manifest.extraPublicDirs.every((p) => typeof p === 'string')
-    ) {
-      throw new TypeError(
-        'expected new platform plugin manifest to have an array of strings `extraPublicDirs` property'
-      );
+      return {
+        directory,
+        manifestPath,
+        id: manifest.id,
+        isUiPlugin: !!manifest.ui,
+        extraPublicDirs: extraPublicDirs || [],
+      };
     }
-
-    extraPublicDirs = manifest.extraPublicDirs as string[];
-  }
-
-  return {
-    directory: Path.dirname(manifestPath),
-    manifestPath,
-    id: manifest.id,
-    isUiPlugin: !!manifest.ui,
-    extraPublicDirs: extraPublicDirs || [],
-  };
+  );
 }
diff --git a/packages/kbn-optimizer/src/report_optimizer_stats.ts b/packages/kbn-optimizer/src/report_optimizer_stats.ts
index 2f92f3d648ab7..5057c717efcc3 100644
--- a/packages/kbn-optimizer/src/report_optimizer_stats.ts
+++ b/packages/kbn-optimizer/src/report_optimizer_stats.ts
@@ -35,6 +35,8 @@ interface Entry {
   stats: Fs.Stats;
 }
 
+const IGNORED_EXTNAME = ['.map', '.br', '.gz'];
+
 const getFiles = (dir: string, parent?: string) =>
   flatten(
     Fs.readdirSync(dir).map((name): Entry | Entry[] => {
@@ -51,7 +53,19 @@ const getFiles = (dir: string, parent?: string) =>
         stats,
       };
     })
-  );
+  ).filter((file) => {
+    const filename = Path.basename(file.relPath);
+    if (filename.startsWith('.')) {
+      return false;
+    }
+
+    const ext = Path.extname(filename);
+    if (IGNORED_EXTNAME.includes(ext)) {
+      return false;
+    }
+
+    return true;
+  });
 
 export function reportOptimizerStats(reporter: CiStatsReporter, config: OptimizerConfig) {
   return pipeClosure((update$: OptimizerUpdate$) => {
@@ -70,10 +84,7 @@ export function reportOptimizerStats(reporter: CiStatsReporter, config: Optimize
                 // make the cache read from the cache file since it was likely updated by the worker
                 bundle.cache.refresh();
 
-                const outputFiles = getFiles(bundle.outputDir).filter(
-                  (file) => !(file.relPath.startsWith('.') || file.relPath.endsWith('.map'))
-                );
-
+                const outputFiles = getFiles(bundle.outputDir);
                 const entryName = `${bundle.id}.${bundle.type}.js`;
                 const entry = outputFiles.find((f) => f.relPath === entryName);
                 if (!entry) {
diff --git a/renovate.json5 b/renovate.json5
index 1ba6dc0ff7e1b..ae32043daaf5f 100644
--- a/renovate.json5
+++ b/renovate.json5
@@ -25,7 +25,7 @@
     'Team:Operations',
     'renovate',
     'v8.0.0',
-    'v7.9.0',
+    'v7.10.0',
   ],
   major: {
     labels: [
@@ -33,7 +33,7 @@
       'Team:Operations',
       'renovate',
       'v8.0.0',
-      'v7.9.0',
+      'v7.10.0',
       'renovate:major',
     ],
   },
@@ -254,7 +254,7 @@
           'Team:Operations',
           'renovate',
           'v8.0.0',
-          'v7.9.0',
+          'v7.10.0',
           ':ml',
         ],
       },
@@ -418,6 +418,14 @@
           '@types/has-ansi',
         ],
       },
+      {
+        groupSlug: 'he',
+        groupName: 'he related packages',
+        packageNames: [
+          'he',
+          '@types/he',
+        ],
+      },
       {
         groupSlug: 'history',
         groupName: 'history related packages',
diff --git a/src/optimize/dynamic_dll_plugin/index.js b/scripts/build_plugin_list_docs.js
similarity index 88%
rename from src/optimize/dynamic_dll_plugin/index.js
rename to scripts/build_plugin_list_docs.js
index 347811b5356b7..54821a1b10ee8 100644
--- a/src/optimize/dynamic_dll_plugin/index.js
+++ b/scripts/build_plugin_list_docs.js
@@ -17,5 +17,5 @@
  * under the License.
  */
 
-export { DynamicDllPlugin } from './dynamic_dll_plugin';
-export { DllCompiler } from './dll_compiler';
+require('../src/setup_node_env/prebuilt_dev_only_entry');
+require('@kbn/dev-utils').runPluginListCli();
diff --git a/scripts/load_team_assignment.js b/scripts/load_team_assignment.js
new file mode 100644
index 0000000000000..b8f5edc833634
--- /dev/null
+++ b/scripts/load_team_assignment.js
@@ -0,0 +1,21 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+require('../src/setup_node_env');
+require('../src/dev/code_coverage/ingest_coverage/team_assignment').uploadTeamAssignmentJson();
diff --git a/src/core/public/doc_links/doc_links_service.ts b/src/core/public/doc_links/doc_links_service.ts
index 0662586797164..70b25cb78787a 100644
--- a/src/core/public/doc_links/doc_links_service.ts
+++ b/src/core/public/doc_links/doc_links_service.ts
@@ -111,8 +111,8 @@ export class DocLinksService {
         },
         kibana: `${ELASTIC_WEBSITE_URL}guide/en/kibana/${DOC_LINK_VERSION}/index.html`,
         siem: {
-          guide: `${ELASTIC_WEBSITE_URL}guide/en/siem/guide/${DOC_LINK_VERSION}/index.html`,
-          gettingStarted: `${ELASTIC_WEBSITE_URL}guide/en/siem/guide/${DOC_LINK_VERSION}/install-siem.html`,
+          guide: `${ELASTIC_WEBSITE_URL}guide/en/security/${DOC_LINK_VERSION}/index.html`,
+          gettingStarted: `${ELASTIC_WEBSITE_URL}guide/en/security/${DOC_LINK_VERSION}/install-siem.html`,
         },
         query: {
           luceneQuerySyntax: `${ELASTICSEARCH_DOCS}query-dsl-query-string-query.html#query-string-syntax`,
diff --git a/src/core/server/elasticsearch/elasticsearch_service.test.ts b/src/core/server/elasticsearch/elasticsearch_service.test.ts
index b36af2a7e4671..4375f09f1ce0b 100644
--- a/src/core/server/elasticsearch/elasticsearch_service.test.ts
+++ b/src/core/server/elasticsearch/elasticsearch_service.test.ts
@@ -17,11 +17,9 @@
  * under the License.
  */
 
-import { first } from 'rxjs/operators';
-
 import { MockLegacyClusterClient, MockClusterClient } from './elasticsearch_service.test.mocks';
-
 import { BehaviorSubject } from 'rxjs';
+import { first } from 'rxjs/operators';
 import { Env } from '../config';
 import { getEnvOptions } from '../config/__mocks__/env';
 import { CoreContext } from '../core_context';
@@ -227,28 +225,34 @@ describe('#setup', () => {
   });
 
   it('esNodeVersionCompatibility$ only starts polling when subscribed to', async (done) => {
-    mockLegacyClusterClientInstance.callAsInternalUser.mockRejectedValue(new Error());
+    const mockedClient = mockClusterClientInstance.asInternalUser;
+    mockedClient.nodes.info.mockImplementation(() =>
+      elasticsearchClientMock.createClientError(new Error())
+    );
 
     const setupContract = await elasticsearchService.setup(setupDeps);
     await delay(10);
 
-    expect(mockLegacyClusterClientInstance.callAsInternalUser).toHaveBeenCalledTimes(0);
+    expect(mockedClient.nodes.info).toHaveBeenCalledTimes(0);
     setupContract.esNodesCompatibility$.subscribe(() => {
-      expect(mockLegacyClusterClientInstance.callAsInternalUser).toHaveBeenCalledTimes(1);
+      expect(mockedClient.nodes.info).toHaveBeenCalledTimes(1);
       done();
     });
   });
 
   it('esNodeVersionCompatibility$ stops polling when unsubscribed from', async (done) => {
-    mockLegacyClusterClientInstance.callAsInternalUser.mockRejectedValue(new Error());
+    const mockedClient = mockClusterClientInstance.asInternalUser;
+    mockedClient.nodes.info.mockImplementation(() =>
+      elasticsearchClientMock.createClientError(new Error())
+    );
 
     const setupContract = await elasticsearchService.setup(setupDeps);
 
-    expect(mockLegacyClusterClientInstance.callAsInternalUser).toHaveBeenCalledTimes(0);
+    expect(mockedClient.nodes.info).toHaveBeenCalledTimes(0);
     const sub = setupContract.esNodesCompatibility$.subscribe(async () => {
       sub.unsubscribe();
       await delay(100);
-      expect(mockLegacyClusterClientInstance.callAsInternalUser).toHaveBeenCalledTimes(1);
+      expect(mockedClient.nodes.info).toHaveBeenCalledTimes(1);
       done();
     });
   });
@@ -353,16 +357,19 @@ describe('#stop', () => {
   it('stops pollEsNodeVersions even if there are active subscriptions', async (done) => {
     expect.assertions(2);
 
-    mockLegacyClusterClientInstance.callAsInternalUser.mockRejectedValue(new Error());
+    const mockedClient = mockClusterClientInstance.asInternalUser;
+    mockedClient.nodes.info.mockImplementation(() =>
+      elasticsearchClientMock.createClientError(new Error())
+    );
 
     const setupContract = await elasticsearchService.setup(setupDeps);
 
     setupContract.esNodesCompatibility$.subscribe(async () => {
-      expect(mockLegacyClusterClientInstance.callAsInternalUser).toHaveBeenCalledTimes(1);
+      expect(mockedClient.nodes.info).toHaveBeenCalledTimes(1);
 
       await elasticsearchService.stop();
       await delay(100);
-      expect(mockLegacyClusterClientInstance.callAsInternalUser).toHaveBeenCalledTimes(1);
+      expect(mockedClient.nodes.info).toHaveBeenCalledTimes(1);
       done();
     });
   });
diff --git a/src/core/server/elasticsearch/elasticsearch_service.ts b/src/core/server/elasticsearch/elasticsearch_service.ts
index 9b05fb9887a3b..69bf593dd5862 100644
--- a/src/core/server/elasticsearch/elasticsearch_service.ts
+++ b/src/core/server/elasticsearch/elasticsearch_service.ts
@@ -78,9 +78,10 @@ export class ElasticsearchService
 
     this.getAuthHeaders = deps.http.getAuthHeaders;
     this.legacyClient = this.createLegacyClusterClient('data', config);
+    this.client = this.createClusterClient('data', config);
 
     const esNodesCompatibility$ = pollEsNodesVersion({
-      callWithInternalUser: this.legacyClient.callAsInternalUser,
+      internalClient: this.client.asInternalUser,
       log: this.log,
       ignoreVersionMismatch: config.ignoreVersionMismatch,
       esVersionCheckInterval: config.healthCheckDelay.asMilliseconds(),
@@ -109,7 +110,6 @@ export class ElasticsearchService
     }
 
     const config = await this.config$.pipe(first()).toPromise();
-    this.client = this.createClusterClient('data', config);
 
     const createClient = (
       type: string,
@@ -120,7 +120,7 @@ export class ElasticsearchService
     };
 
     return {
-      client: this.client,
+      client: this.client!,
       createClient,
       legacy: {
         client: this.legacyClient,
@@ -133,7 +133,7 @@ export class ElasticsearchService
     this.log.debug('Stopping elasticsearch service');
     this.stop$.next();
     if (this.client) {
-      this.client.close();
+      await this.client.close();
     }
     if (this.legacyClient) {
       this.legacyClient.close();
diff --git a/src/core/server/elasticsearch/version_check/ensure_es_version.test.ts b/src/core/server/elasticsearch/version_check/ensure_es_version.test.ts
index 3d1218d4a8e8b..21adac081acf7 100644
--- a/src/core/server/elasticsearch/version_check/ensure_es_version.test.ts
+++ b/src/core/server/elasticsearch/version_check/ensure_es_version.test.ts
@@ -18,6 +18,7 @@
  */
 import { mapNodesVersionCompatibility, pollEsNodesVersion, NodesInfo } from './ensure_es_version';
 import { loggingSystemMock } from '../../logging/logging_system.mock';
+import { elasticsearchClientMock } from '../client/mocks';
 import { take, delay } from 'rxjs/operators';
 import { TestScheduler } from 'rxjs/testing';
 import { of } from 'rxjs';
@@ -27,6 +28,9 @@ const mockLogger = mockLoggerFactory.get('mock logger');
 
 const KIBANA_VERSION = '5.1.0';
 
+const createEsSuccess = elasticsearchClientMock.createClientResponse;
+const createEsError = elasticsearchClientMock.createClientError;
+
 function createNodes(...versions: string[]): NodesInfo {
   const nodes = {} as any;
   versions
@@ -111,25 +115,34 @@ describe('mapNodesVersionCompatibility', () => {
 });
 
 describe('pollEsNodesVersion', () => {
-  const callWithInternalUser = jest.fn();
+  let internalClient: ReturnType<typeof elasticsearchClientMock.createInternalClient>;
   const getTestScheduler = () =>
     new TestScheduler((actual, expected) => {
       expect(actual).toEqual(expected);
     });
 
   beforeEach(() => {
-    callWithInternalUser.mockReset();
+    internalClient = elasticsearchClientMock.createInternalClient();
   });
 
+  const nodeInfosSuccessOnce = (infos: NodesInfo) => {
+    internalClient.nodes.info.mockImplementationOnce(() => createEsSuccess(infos));
+  };
+  const nodeInfosErrorOnce = (error: any) => {
+    internalClient.nodes.info.mockImplementationOnce(() => createEsError(error));
+  };
+
   it('returns iscCompatible=false and keeps polling when a poll request throws', (done) => {
     expect.assertions(3);
     const expectedCompatibilityResults = [false, false, true];
     jest.clearAllMocks();
-    callWithInternalUser.mockResolvedValueOnce(createNodes('5.1.0', '5.2.0', '5.0.0'));
-    callWithInternalUser.mockRejectedValueOnce(new Error('mock request error'));
-    callWithInternalUser.mockResolvedValueOnce(createNodes('5.1.0', '5.2.0', '5.1.1-Beta1'));
+
+    nodeInfosSuccessOnce(createNodes('5.1.0', '5.2.0', '5.0.0'));
+    nodeInfosErrorOnce('mock request error');
+    nodeInfosSuccessOnce(createNodes('5.1.0', '5.2.0', '5.1.1-Beta1'));
+
     pollEsNodesVersion({
-      callWithInternalUser,
+      internalClient,
       esVersionCheckInterval: 1,
       ignoreVersionMismatch: false,
       kibanaVersion: KIBANA_VERSION,
@@ -148,9 +161,11 @@ describe('pollEsNodesVersion', () => {
   it('returns compatibility results', (done) => {
     expect.assertions(1);
     const nodes = createNodes('5.1.0', '5.2.0', '5.0.0');
-    callWithInternalUser.mockResolvedValueOnce(nodes);
+
+    nodeInfosSuccessOnce(nodes);
+
     pollEsNodesVersion({
-      callWithInternalUser,
+      internalClient,
       esVersionCheckInterval: 1,
       ignoreVersionMismatch: false,
       kibanaVersion: KIBANA_VERSION,
@@ -168,15 +183,15 @@ describe('pollEsNodesVersion', () => {
 
   it('only emits if the node versions changed since the previous poll', (done) => {
     expect.assertions(4);
-    callWithInternalUser.mockResolvedValueOnce(createNodes('5.1.0', '5.2.0', '5.0.0')); // emit
-    callWithInternalUser.mockResolvedValueOnce(createNodes('5.0.0', '5.1.0', '5.2.0')); // ignore, same versions, different ordering
-    callWithInternalUser.mockResolvedValueOnce(createNodes('5.1.1', '5.2.0', '5.0.0')); // emit
-    callWithInternalUser.mockResolvedValueOnce(createNodes('5.1.1', '5.1.2', '5.1.3')); // emit
-    callWithInternalUser.mockResolvedValueOnce(createNodes('5.1.1', '5.1.2', '5.1.3')); // ignore
-    callWithInternalUser.mockResolvedValueOnce(createNodes('5.0.0', '5.1.0', '5.2.0')); // emit, different from previous version
+    nodeInfosSuccessOnce(createNodes('5.1.0', '5.2.0', '5.0.0')); // emit
+    nodeInfosSuccessOnce(createNodes('5.0.0', '5.1.0', '5.2.0')); // ignore, same versions, different ordering
+    nodeInfosSuccessOnce(createNodes('5.1.1', '5.2.0', '5.0.0')); // emit
+    nodeInfosSuccessOnce(createNodes('5.1.1', '5.1.2', '5.1.3')); // emit
+    nodeInfosSuccessOnce(createNodes('5.1.1', '5.1.2', '5.1.3')); // ignore
+    nodeInfosSuccessOnce(createNodes('5.0.0', '5.1.0', '5.2.0')); // emit, different from previous version
 
     pollEsNodesVersion({
-      callWithInternalUser,
+      internalClient,
       esVersionCheckInterval: 1,
       ignoreVersionMismatch: false,
       kibanaVersion: KIBANA_VERSION,
@@ -192,14 +207,21 @@ describe('pollEsNodesVersion', () => {
 
   it('starts polling immediately and then every esVersionCheckInterval', () => {
     expect.assertions(1);
-    callWithInternalUser.mockReturnValueOnce([createNodes('5.1.0', '5.2.0', '5.0.0')]);
-    callWithInternalUser.mockReturnValueOnce([createNodes('5.1.1', '5.2.0', '5.0.0')]);
+
+    // @ts-expect-error we need to return an incompatible type to use the testScheduler here
+    internalClient.nodes.info.mockReturnValueOnce([
+      { body: createNodes('5.1.0', '5.2.0', '5.0.0') },
+    ]);
+    // @ts-expect-error we need to return an incompatible type to use the testScheduler here
+    internalClient.nodes.info.mockReturnValueOnce([
+      { body: createNodes('5.1.1', '5.2.0', '5.0.0') },
+    ]);
 
     getTestScheduler().run(({ expectObservable }) => {
       const expected = 'a 99ms (b|)';
 
       const esNodesCompatibility$ = pollEsNodesVersion({
-        callWithInternalUser,
+        internalClient,
         esVersionCheckInterval: 100,
         ignoreVersionMismatch: false,
         kibanaVersion: KIBANA_VERSION,
@@ -227,15 +249,17 @@ describe('pollEsNodesVersion', () => {
     getTestScheduler().run(({ expectObservable }) => {
       const expected = '100ms a 99ms (b|)';
 
-      callWithInternalUser.mockReturnValueOnce(
-        of(createNodes('5.1.0', '5.2.0', '5.0.0')).pipe(delay(100))
+      internalClient.nodes.info.mockReturnValueOnce(
+        // @ts-expect-error we need to return an incompatible type to use the testScheduler here
+        of({ body: createNodes('5.1.0', '5.2.0', '5.0.0') }).pipe(delay(100))
       );
-      callWithInternalUser.mockReturnValueOnce(
-        of(createNodes('5.1.1', '5.2.0', '5.0.0')).pipe(delay(100))
+      internalClient.nodes.info.mockReturnValueOnce(
+        // @ts-expect-error we need to return an incompatible type to use the testScheduler here
+        of({ body: createNodes('5.1.1', '5.2.0', '5.0.0') }).pipe(delay(100))
       );
 
       const esNodesCompatibility$ = pollEsNodesVersion({
-        callWithInternalUser,
+        internalClient,
         esVersionCheckInterval: 10,
         ignoreVersionMismatch: false,
         kibanaVersion: KIBANA_VERSION,
@@ -256,6 +280,6 @@ describe('pollEsNodesVersion', () => {
       });
     });
 
-    expect(callWithInternalUser).toHaveBeenCalledTimes(2);
+    expect(internalClient.nodes.info).toHaveBeenCalledTimes(2);
   });
 });
diff --git a/src/core/server/elasticsearch/version_check/ensure_es_version.ts b/src/core/server/elasticsearch/version_check/ensure_es_version.ts
index dc56d982d7b4a..5f926215d167f 100644
--- a/src/core/server/elasticsearch/version_check/ensure_es_version.ts
+++ b/src/core/server/elasticsearch/version_check/ensure_es_version.ts
@@ -29,10 +29,10 @@ import {
   esVersionEqualsKibana,
 } from './es_kibana_version_compatability';
 import { Logger } from '../../logging';
-import { LegacyAPICaller } from '../legacy';
+import type { ElasticsearchClient } from '../client';
 
 export interface PollEsNodesVersionOptions {
-  callWithInternalUser: LegacyAPICaller;
+  internalClient: ElasticsearchClient;
   log: Logger;
   kibanaVersion: string;
   ignoreVersionMismatch: boolean;
@@ -137,7 +137,7 @@ function compareNodes(prev: NodesVersionCompatibility, curr: NodesVersionCompati
 }
 
 export const pollEsNodesVersion = ({
-  callWithInternalUser,
+  internalClient,
   log,
   kibanaVersion,
   ignoreVersionMismatch,
@@ -147,10 +147,11 @@ export const pollEsNodesVersion = ({
   return timer(0, healthCheckInterval).pipe(
     exhaustMap(() => {
       return from(
-        callWithInternalUser('nodes.info', {
-          filterPath: ['nodes.*.version', 'nodes.*.http.publish_address', 'nodes.*.ip'],
+        internalClient.nodes.info<NodesInfo>({
+          filter_path: ['nodes.*.version', 'nodes.*.http.publish_address', 'nodes.*.ip'],
         })
       ).pipe(
+        map(({ body }) => body),
         catchError((_err) => {
           return of({ nodes: {} });
         })
diff --git a/src/dev/build/README.md b/src/dev/build/README.md
index ed8750f6fee56..460ab01794334 100644
--- a/src/dev/build/README.md
+++ b/src/dev/build/README.md
@@ -39,14 +39,3 @@ The majority of this logic is extracted from the grunt build that has existed fo
 [lib/build.js]: ./lib/build.js
 [build_distributables.js]: ./build_distributables.js
 [../tooling_log/tooling_log.js]: ../tooling_log/tooling_log.js
-
-# Client Node Modules Cleaning
-
-We have introduced in our bundle a webpack dll for the client vendor modules in order to improve
-the optimization time both in dev and in production. As for those modules we already have the 
-code into the vendors_${chunk_number}.bundle.dll.js we have decided to delete those bundled modules from the 
-distributable node_modules folder. However, in order to accomplish this, we need to exclude 
-every node_module used in the server side code. This logic is performed 
-under `nodejs_modules/clean_client_modules_on_dll_task.js`. In case we need to add any new cli
-or any other piece of server code other than `x-pack` or `core_plugins` we'll need
-to update the globs present on `clean_client_modules_on_dll_task.js` accordingly.
diff --git a/src/dev/build/build_distributables.js b/src/dev/build/build_distributables.js
index 22a348b78dc0a..39a32fff891c2 100644
--- a/src/dev/build/build_distributables.js
+++ b/src/dev/build/build_distributables.js
@@ -22,7 +22,6 @@ import { getConfig, createRunner } from './lib';
 import {
   BuildKibanaPlatformPluginsTask,
   BuildPackagesTask,
-  CleanClientModulesOnDLLTask,
   CleanEmptyFoldersTask,
   CleanExtraBinScriptsTask,
   CleanExtraFilesFromModulesTask,
@@ -127,7 +126,6 @@ export async function buildDistributables(options) {
   await run(TranspileScssTask);
   await run(BuildKibanaPlatformPluginsTask);
   await run(OptimizeBuildTask);
-  await run(CleanClientModulesOnDLLTask);
   await run(CleanTypescriptTask);
   await run(CleanExtraFilesFromModulesTask);
   await run(CleanEmptyFoldersTask);
diff --git a/src/dev/build/tasks/index.js b/src/dev/build/tasks/index.js
index d96e745c10776..0a3a67313d6a4 100644
--- a/src/dev/build/tasks/index.js
+++ b/src/dev/build/tasks/index.js
@@ -30,7 +30,6 @@ export * from './create_readme_task';
 export * from './install_chromium';
 export * from './install_dependencies_task';
 export * from './license_file_task';
-export * from './nodejs_modules';
 export * from './nodejs';
 export * from './notice_file_task';
 export * from './optimize_task';
diff --git a/src/dev/build/tasks/nodejs_modules/clean_client_modules_on_dll_task.js b/src/dev/build/tasks/nodejs_modules/clean_client_modules_on_dll_task.js
deleted file mode 100644
index 05bfd3ca31a65..0000000000000
--- a/src/dev/build/tasks/nodejs_modules/clean_client_modules_on_dll_task.js
+++ /dev/null
@@ -1,126 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import {
-  getDllEntries,
-  cleanDllModuleFromEntryPath,
-  writeEmptyFileForDllEntry,
-} from './webpack_dll';
-import { getDependencies } from './get_dependencies';
-import globby from 'globby';
-import normalizePosixPath from 'normalize-path';
-
-export const CleanClientModulesOnDLLTask = {
-  description: 'Cleaning client node_modules bundled into the DLL',
-
-  async run(config, log, build) {
-    const baseDir = normalizePosixPath(build.resolvePath('.'));
-    const kbnPkg = config.getKibanaPkg();
-    const kbnPkgDependencies = (kbnPkg && kbnPkg.dependencies) || {};
-    const kbnWebpackLoaders = Object.keys(kbnPkgDependencies).filter(
-      (dep) => !!dep.includes('-loader')
-    );
-
-    // Define the entry points for the server code in order to
-    // start here later looking for the server side dependencies
-    const mainCodeEntries = [
-      `${baseDir}/src/cli`,
-      `${baseDir}/src/cli_keystore`,
-      `${baseDir}/src/cli_plugin`,
-      `${baseDir}/x-pack`,
-      ...kbnWebpackLoaders.map((loader) => `${baseDir}/node_modules/${loader}`),
-    ];
-    const discoveredLegacyCorePluginEntries = await globby([
-      `${baseDir}/src/legacy/core_plugins/*/index.js`,
-      `!${baseDir}/src/legacy/core_plugins/**/public`,
-    ]);
-    const discoveredPluginEntries = await globby([
-      `${baseDir}/src/plugins/*/server/index.js`,
-      // Small exception to load dynamically discovered functions for timelion plugin
-      `${baseDir}/src/plugins/vis_type_timelion/server/*_functions/**/*.js`,
-      `!${baseDir}/src/plugins/**/public`,
-    ]);
-    const discoveredNewPlatformXpackPlugins = await globby([
-      `${baseDir}/x-pack/plugins/*/server/index.js`,
-      `!${baseDir}/x-pack/plugins/**/public`,
-    ]);
-
-    // Compose all the needed entries
-    const serverEntries = [
-      ...mainCodeEntries,
-      ...discoveredLegacyCorePluginEntries,
-      ...discoveredPluginEntries,
-      ...discoveredNewPlatformXpackPlugins,
-    ];
-
-    // Get the dependencies found searching through the server
-    // side code entries that were provided
-    const serverDependencies = await getDependencies(baseDir, serverEntries);
-
-    // This fulfill a particular exceptional case where
-    // we need to keep loading a file from a node_module
-    // only used in the front-end like we do when using the file-loader
-    // in https://github.com/elastic/kibana/blob/master/x-pack/legacy/plugins/maps/public/connected_components/map/mb/view.js
-    //
-    // manual list of exception modules
-    const manualExceptionModules = ['mapbox-gl'];
-
-    // consider the top modules as exceptions as the entry points
-    // to look for other exceptions dependent on that one
-    const manualExceptionEntries = [
-      ...manualExceptionModules.map((module) => `${baseDir}/node_modules/${module}`),
-    ];
-
-    // dependencies for declared exception modules
-    const manualExceptionModulesDependencies = await getDependencies(baseDir, [
-      ...manualExceptionEntries,
-    ]);
-
-    // final list of manual exceptions to add
-    const manualExceptions = [...manualExceptionModules, ...manualExceptionModulesDependencies];
-
-    // Consider this as our whiteList for the modules we can't delete
-    const whiteListedModules = [...serverDependencies, ...kbnWebpackLoaders, ...manualExceptions];
-
-    // Resolve the client vendors dll manifest paths
-    // excluding the runtime one
-    const dllManifestPaths = await globby([
-      `${baseDir}/built_assets/dlls/vendors_*.manifest.dll.json`,
-      `!${baseDir}/built_assets/dlls/vendors_runtime.manifest.dll.json`,
-    ]);
-
-    // Get dll entries filtering out the ones
-    // from any whitelisted module
-    const dllEntries = await getDllEntries(dllManifestPaths, whiteListedModules, baseDir);
-
-    for (const relativeEntryPath of dllEntries) {
-      const entryPath = `${baseDir}/${relativeEntryPath}`;
-
-      if (entryPath.endsWith('package.json')) {
-        continue;
-      }
-
-      // Clean a module included into the dll
-      // and then write a blank file for each
-      // entry file present into the dll
-      await cleanDllModuleFromEntryPath(log, entryPath);
-      await writeEmptyFileForDllEntry(entryPath);
-    }
-  },
-};
diff --git a/src/dev/build/tasks/nodejs_modules/webpack_dll.js b/src/dev/build/tasks/nodejs_modules/webpack_dll.js
deleted file mode 100644
index 8de5e582c3d36..0000000000000
--- a/src/dev/build/tasks/nodejs_modules/webpack_dll.js
+++ /dev/null
@@ -1,131 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { deleteAll, isFileAccessible, read, write } from '../../lib';
-import { dirname, relative, resolve } from 'path';
-import pkgUp from 'pkg-up';
-import globby from 'globby';
-import normalizePosixPath from 'normalize-path';
-
-function checkDllEntryAccess(entry, baseDir = '') {
-  const resolvedPath = baseDir ? resolve(baseDir, entry) : entry;
-  return isFileAccessible(resolvedPath);
-}
-
-export async function getDllEntries(manifestPaths, whiteListedModules, baseDir = '') {
-  // Read and parse all manifests
-  const manifests = await Promise.all(
-    manifestPaths.map(async (manifestPath) => JSON.parse(await read(manifestPath)))
-  );
-
-  // Process and group modules from all manifests
-  const manifestsModules = manifests.flatMap((manifest, idx) => {
-    if (!manifest || !manifest.content) {
-      // It should fails because if we don't have the manifest file
-      // or it is malformed something wrong is happening and we
-      // should stop
-      throw new Error(`The following dll manifest doesn't exists: ${manifestPaths[idx]}`);
-    }
-
-    const modules = Object.keys(manifest.content);
-    if (!modules.length) {
-      // It should fails because if we don't have any
-      // module inside the client vendors dll something
-      // wrong is happening and we should stop too
-      throw new Error(
-        `The following dll manifest is reporting an empty dll: ${manifestPaths[idx]}`
-      );
-    }
-
-    return modules;
-  });
-
-  // Only includes modules who are not in the white list of modules
-  // and that are node_modules
-  return manifestsModules.filter((entry) => {
-    const isWhiteListed = whiteListedModules.some((nonEntry) =>
-      normalizePosixPath(entry).includes(`node_modules/${nonEntry}`)
-    );
-    const isNodeModule = entry.includes('node_modules');
-
-    // NOTE: when using dynamic imports on webpack the entry paths could be created
-    // with special context module (ex: lazy recursive) values over directories that are not real files
-    // and only exists in runtime, so we need to check if the entry is a real file.
-    // We found that problem through the issue https://github.com/elastic/kibana/issues/38481
-    //
-    // More info:
-    // https://github.com/webpack/webpack/blob/master/examples/code-splitting-harmony/README.md
-    // https://webpack.js.org/guides/dependency-management/#require-with-expression
-    const isAccessible = checkDllEntryAccess(entry, baseDir);
-
-    return !isWhiteListed && isNodeModule && isAccessible;
-  });
-}
-
-export async function cleanDllModuleFromEntryPath(logger, entryPath) {
-  const modulePkgPath = await pkgUp(entryPath);
-  const modulePkg = JSON.parse(await read(modulePkgPath));
-  const moduleDir = dirname(modulePkgPath);
-  const normalizedModuleDir = normalizePosixPath(moduleDir);
-
-  // Cancel the cleanup for this module as it
-  // was already done.
-  if (modulePkg.cleaned) {
-    return;
-  }
-
-  // Clear dependencies from dll module package.json
-  if (modulePkg.dependencies) {
-    modulePkg.dependencies = {};
-  }
-
-  // Clear devDependencies from dll module package.json
-  if (modulePkg.devDependencies) {
-    modulePkg.devDependencies = {};
-  }
-
-  // Delete module contents. It will delete everything
-  // excepts package.json, images and css
-  //
-  // NOTE: We can't use cwd option with globby
-  // until the following issue gets closed
-  // https://github.com/sindresorhus/globby/issues/87
-  const filesToDelete = await globby([
-    `${normalizedModuleDir}/**`,
-    `!${normalizedModuleDir}/**/*.+(css)`,
-    `!${normalizedModuleDir}/**/*.+(gif|ico|jpeg|jpg|tiff|tif|svg|png|webp)`,
-  ]);
-
-  await deleteAll(
-    filesToDelete.filter((path) => {
-      const relativePath = relative(moduleDir, path);
-      return !relativePath.endsWith('package.json') || relativePath.includes('node_modules');
-    })
-  );
-
-  // Mark this module as cleaned
-  modulePkg.cleaned = true;
-
-  // Rewrite modified package.json
-  await write(modulePkgPath, JSON.stringify(modulePkg, null, 2));
-}
-
-export async function writeEmptyFileForDllEntry(entryPath) {
-  await write(entryPath, '');
-}
diff --git a/src/dev/build/tasks/nodejs_modules/webpack_dll.test.js b/src/dev/build/tasks/nodejs_modules/webpack_dll.test.js
deleted file mode 100644
index ce305169a777b..0000000000000
--- a/src/dev/build/tasks/nodejs_modules/webpack_dll.test.js
+++ /dev/null
@@ -1,123 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { isFileAccessible, read } from '../../lib';
-import { getDllEntries } from './webpack_dll';
-
-jest.mock('../../lib', () => ({
-  read: jest.fn(),
-  isFileAccessible: jest.fn(),
-}));
-
-const manifestContentMock = JSON.stringify({
-  name: 'vendors',
-  content: {
-    '/mock/node_modules/dep1': {},
-    '/mock/node_modules/dep2': {},
-    '/mock/node_modules/dep3': {},
-    '/mock/tmp/dep2': {},
-  },
-});
-
-const emptyManifestContentMock = JSON.stringify({
-  name: 'vendors',
-  content: {},
-});
-
-const noManifestMock = JSON.stringify(null);
-
-const noContentFieldManifestMock = JSON.stringify({
-  name: 'vendors',
-});
-
-describe('Webpack DLL Build Tasks Utils', () => {
-  it('should get dll entries correctly', async () => {
-    read.mockImplementationOnce(async () => manifestContentMock);
-
-    isFileAccessible.mockImplementation(() => true);
-
-    const mockManifestPath = ['/mock/mock_dll_manifest.json'];
-    const mockModulesWhitelist = ['dep1'];
-    const dllEntries = await getDllEntries(mockManifestPath, mockModulesWhitelist);
-
-    expect(dllEntries).toEqual(
-      expect.arrayContaining(['/mock/node_modules/dep2', '/mock/node_modules/dep3'])
-    );
-  });
-
-  it('should only include accessible files', async () => {
-    read.mockImplementationOnce(async () => manifestContentMock);
-
-    isFileAccessible.mockImplementation(() => false);
-
-    const mockManifestPath = ['/mock/mock_dll_manifest.json'];
-    const mockModulesWhitelist = ['dep1'];
-    const dllEntries = await getDllEntries(mockManifestPath, mockModulesWhitelist);
-
-    isFileAccessible.mockRestore();
-
-    expect(dllEntries.length).toEqual(0);
-  });
-
-  it('should throw an error for no manifest file', async () => {
-    read.mockImplementationOnce(async () => noManifestMock);
-
-    const mockManifestPath = ['/mock/mock_dll_manifest.json'];
-
-    try {
-      await getDllEntries(mockManifestPath, []);
-    } catch (error) {
-      expect(error.message).toEqual(
-        `The following dll manifest doesn't exists: /mock/mock_dll_manifest.json`
-      );
-    }
-  });
-
-  it('should throw an error for no manifest content field', async () => {
-    read.mockImplementation(async () => noContentFieldManifestMock);
-
-    const mockManifestPath = ['/mock/mock_dll_manifest.json'];
-
-    try {
-      await getDllEntries(mockManifestPath, []);
-    } catch (error) {
-      expect(error.message).toEqual(
-        `The following dll manifest doesn't exists: /mock/mock_dll_manifest.json`
-      );
-    }
-  });
-
-  it('should throw an error for manifest file without any content', async () => {
-    read.mockImplementation(async () => emptyManifestContentMock);
-
-    const mockManifestPath = ['/mock/mock_dll_manifest.json'];
-
-    try {
-      await getDllEntries(mockManifestPath, []);
-    } catch (error) {
-      expect(error.message).toEqual(
-        `The following dll manifest is reporting an empty dll: /mock/mock_dll_manifest.json`
-      );
-    }
-  });
-
-  afterAll(() => {
-    jest.clearAllMocks();
-  });
-});
diff --git a/src/dev/build/tasks/optimize_task.js b/src/dev/build/tasks/optimize_task.js
index 4034092273239..16a7537b8ac9e 100644
--- a/src/dev/build/tasks/optimize_task.js
+++ b/src/dev/build/tasks/optimize_task.js
@@ -41,7 +41,6 @@ export const OptimizeBuildTask = {
     await exec(log, kibanaScript, kibanaArgs, {
       cwd: build.resolvePath('.'),
       env: {
-        FORCE_DLL_CREATION: 'true',
         KBN_CACHE_LOADER_WRITABLE: 'true',
         NODE_OPTIONS: '--max-old-space-size=4096',
       },
diff --git a/src/dev/build/tasks/patch_native_modules_task.js b/src/dev/build/tasks/patch_native_modules_task.js
index a10010ed5255f..c30d1fd774b55 100644
--- a/src/dev/build/tasks/patch_native_modules_task.js
+++ b/src/dev/build/tasks/patch_native_modules_task.js
@@ -26,21 +26,21 @@ const DOWNLOAD_DIRECTORY = '.native_modules';
 const packages = [
   {
     name: 're2',
-    version: '1.14.0',
+    version: '1.15.4',
     destinationPath: 'node_modules/re2/build/Release/re2.node',
     extractMethod: 'gunzip',
     archives: {
       darwin: {
-        url: 'https://github.com/uhop/node-re2/releases/download/1.14.0/darwin-x64-64.gz',
-        sha256: '54c8386cb7cd53895cf379522114bfe82378e300e127e58d392ddd40a77e396f',
+        url: 'https://github.com/uhop/node-re2/releases/download/1.15.4/darwin-x64-64.gz',
+        sha256: '595c6653d796493ddb288fc0732a0d1df8560099796f55a1dd242357d96bb8d6',
       },
       linux: {
-        url: 'https://github.com/uhop/node-re2/releases/download/1.14.0/linux-x64-64.gz',
-        sha256: 'f54f059035e71a7ccb3fa201080e260c41d228d13a8247974b4bb157691b6757',
+        url: 'https://github.com/uhop/node-re2/releases/download/1.15.4/linux-x64-64.gz',
+        sha256: 'e743587bc96314edf10c3e659c03168bc374a5cd9a6623ee99d989251e331f28',
       },
       win32: {
-        url: 'https://github.com/uhop/node-re2/releases/download/1.14.0/win32-x64-64.gz',
-        sha256: 'de708446a8b802f4634c2cfef097c2625a2811fdcd8133dfd7b7c485f966caa9',
+        url: 'https://github.com/uhop/node-re2/releases/download/1.15.4/win32-x64-64.gz',
+        sha256: 'b33de62cda24fb02dc80a19fb79977d686468ac746e97cd211059d2d4c75d529',
       },
     },
   },
diff --git a/src/dev/ci_setup/setup.sh b/src/dev/ci_setup/setup.sh
index dc91d1cf23a37..25d2afb00cd87 100755
--- a/src/dev/ci_setup/setup.sh
+++ b/src/dev/ci_setup/setup.sh
@@ -65,3 +65,19 @@ if [ "$GIT_CHANGES" ]; then
   echo -e "$GIT_CHANGES\n"
   exit 1
 fi
+
+###
+### rebuild plugin list to ensure it's not out of date
+###
+echo " -- building plugin list docs"
+node scripts/build_plugin_list_docs
+
+###
+### verify no git modifications
+###
+GIT_CHANGES="$(git ls-files --modified)"
+if [ "$GIT_CHANGES" ]; then
+  echo -e "\n${RED}ERROR: 'node scripts/build_plugin_list_docs' caused changes to the following files:${C_RESET}\n"
+  echo -e "$GIT_CHANGES\n"
+  exit 1
+fi
diff --git a/src/dev/ci_setup/setup_env.sh b/src/dev/ci_setup/setup_env.sh
index 343ff47199375..86927b694679a 100644
--- a/src/dev/ci_setup/setup_env.sh
+++ b/src/dev/ci_setup/setup_env.sh
@@ -126,6 +126,7 @@ export PATH="$PATH:$yarnGlobalDir"
 # use a proxy to fetch chromedriver/geckodriver asset
 export GECKODRIVER_CDNURL="https://us-central1-elastic-kibana-184716.cloudfunctions.net/kibana-ci-proxy-cache"
 export CHROMEDRIVER_CDNURL="https://us-central1-elastic-kibana-184716.cloudfunctions.net/kibana-ci-proxy-cache"
+export RE2_DOWNLOAD_MIRROR="https://us-central1-elastic-kibana-184716.cloudfunctions.net/kibana-ci-proxy-cache"
 export CYPRESS_DOWNLOAD_MIRROR="https://us-central1-elastic-kibana-184716.cloudfunctions.net/kibana-ci-proxy-cache/cypress"
 
 export CHECKS_REPORTER_ACTIVE=false
diff --git a/src/dev/code_coverage/docs/team_assignment/README.md b/src/dev/code_coverage/docs/team_assignment/README.md
new file mode 100644
index 0000000000000..3509fb5c2a4fc
--- /dev/null
+++ b/src/dev/code_coverage/docs/team_assignment/README.md
@@ -0,0 +1,8 @@
+# Team Assignment Ingestion Pipeline
+
+Team assignment will occur once per ci run.
+Team assignment uses an ingest pipeline.
+
+The coverage user has the coverage admin role.
+
+This role must have the rights depicted below ![Cluster Rights](./security_privleges.png)
diff --git a/src/dev/code_coverage/docs/team_assignment/security_privleges.png b/src/dev/code_coverage/docs/team_assignment/security_privleges.png
new file mode 100644
index 0000000000000..002774f3ecefa
Binary files /dev/null and b/src/dev/code_coverage/docs/team_assignment/security_privleges.png differ
diff --git a/src/dev/code_coverage/ingest_coverage/constants.js b/src/dev/code_coverage/ingest_coverage/constants.js
index ddee7106f4490..ae3079afd911d 100644
--- a/src/dev/code_coverage/ingest_coverage/constants.js
+++ b/src/dev/code_coverage/ingest_coverage/constants.js
@@ -32,3 +32,4 @@ export const TEAM_ASSIGNMENT_PIPELINE_NAME = process.env.PIPELINE_NAME || 'team_
 export const CODE_COVERAGE_CI_JOB_NAME = 'elastic+kibana+code-coverage';
 export const RESEARCH_CI_JOB_NAME = 'elastic+kibana+qa-research';
 export const CI_JOB_NAME = process.env.COVERAGE_JOB_NAME || RESEARCH_CI_JOB_NAME;
+export const RESEARCH_CLUSTER_ES_HOST = process.env.ES_HOST || 'http://localhost:9200';
diff --git a/src/dev/code_coverage/ingest_coverage/integration_tests/ingest_coverage.test.js b/src/dev/code_coverage/ingest_coverage/integration_tests/ingest_coverage.test.js
index 95056d9f0d8d7..ba73922ec508a 100644
--- a/src/dev/code_coverage/ingest_coverage/integration_tests/ingest_coverage.test.js
+++ b/src/dev/code_coverage/ingest_coverage/integration_tests/ingest_coverage.test.js
@@ -69,96 +69,4 @@ describe('Ingesting coverage', () => {
       expect(folderStructure.test(actualUrl)).ok();
     });
   });
-  describe(`vcsInfo`, () => {
-    let stdOutWithVcsInfo = '';
-    describe(`without a commit msg in the vcs info file`, () => {
-      beforeAll(async () => {
-        const args = [
-          'scripts/ingest_coverage.js',
-          '--verbose',
-          '--vcsInfoPath',
-          'src/dev/code_coverage/ingest_coverage/integration_tests/mocks/VCS_INFO_missing_commit_msg.txt',
-          '--path',
-        ];
-        const opts = [...args, resolved];
-        const { stdout } = await execa(process.execPath, opts, { cwd: ROOT_DIR, env });
-        stdOutWithVcsInfo = stdout;
-      });
-
-      it(`should be an obj w/o a commit msg`, () => {
-        const commitMsgRE = /"commitMsg"/;
-        expect(commitMsgRE.test(stdOutWithVcsInfo)).to.not.be.ok();
-      });
-    });
-    describe(`including previous sha`, () => {
-      let stdOutWithPrevious = '';
-      beforeAll(async () => {
-        const opts = [...verboseArgs, resolved];
-        const { stdout } = await execa(process.execPath, opts, { cwd: ROOT_DIR, env });
-        stdOutWithPrevious = stdout;
-      });
-
-      it(`should have a vcsCompareUrl`, () => {
-        const previousCompareUrlRe = /vcsCompareUrl.+\s*.*https.+compare\/FAKE_PREVIOUS_SHA\.\.\.f07b34f6206/;
-        expect(previousCompareUrlRe.test(stdOutWithPrevious)).to.be.ok();
-      });
-    });
-    describe(`with a commit msg in the vcs info file`, () => {
-      beforeAll(async () => {
-        const args = [
-          'scripts/ingest_coverage.js',
-          '--verbose',
-          '--vcsInfoPath',
-          'src/dev/code_coverage/ingest_coverage/integration_tests/mocks/VCS_INFO.txt',
-          '--path',
-        ];
-        const opts = [...args, resolved];
-        const { stdout } = await execa(process.execPath, opts, { cwd: ROOT_DIR, env });
-        stdOutWithVcsInfo = stdout;
-      });
-
-      it(`should be an obj w/ a commit msg`, () => {
-        const commitMsgRE = /commitMsg/;
-        expect(commitMsgRE.test(stdOutWithVcsInfo)).to.be.ok();
-      });
-    });
-  });
-  describe(`team assignment`, () => {
-    let shouldNotHavePipelineOut = '';
-    let shouldIndeedHavePipelineOut = '';
-
-    const args = [
-      'scripts/ingest_coverage.js',
-      '--verbose',
-      '--vcsInfoPath',
-      'src/dev/code_coverage/ingest_coverage/integration_tests/mocks/VCS_INFO.txt',
-      '--path',
-    ];
-
-    const teamAssignRE = /pipeline:/;
-
-    beforeAll(async () => {
-      const summaryPath = 'jest-combined/coverage-summary-just-total.json';
-      const resolved = resolve(MOCKS_DIR, summaryPath);
-      const opts = [...args, resolved];
-      const { stdout } = await execa(process.execPath, opts, { cwd: ROOT_DIR, env });
-      shouldNotHavePipelineOut = stdout;
-    });
-    beforeAll(async () => {
-      const summaryPath = 'jest-combined/coverage-summary-manual-mix.json';
-      const resolved = resolve(MOCKS_DIR, summaryPath);
-      const opts = [...args, resolved];
-      const { stdout } = await execa(process.execPath, opts, { cwd: ROOT_DIR, env });
-      shouldIndeedHavePipelineOut = stdout;
-    });
-
-    it(`should not occur when going to the totals index`, () => {
-      const actual = teamAssignRE.test(shouldNotHavePipelineOut);
-      expect(actual).to.not.be.ok();
-    });
-    it(`should indeed occur when going to the coverage index`, () => {
-      const actual = /ingest-pipe=>team_assignment/.test(shouldIndeedHavePipelineOut);
-      expect(actual).to.be.ok();
-    });
-  });
 });
diff --git a/src/optimize/dynamic_dll_plugin/dll_entry_template.js b/src/dev/code_coverage/ingest_coverage/team_assignment/get_data.js
similarity index 61%
rename from src/optimize/dynamic_dll_plugin/dll_entry_template.js
rename to src/dev/code_coverage/ingest_coverage/team_assignment/get_data.js
index 351bed4e591ba..d9fbf5690d8a4 100644
--- a/src/optimize/dynamic_dll_plugin/dll_entry_template.js
+++ b/src/dev/code_coverage/ingest_coverage/team_assignment/get_data.js
@@ -17,21 +17,15 @@
  * under the License.
  */
 
-export function dllEntryTemplate(requirePaths = []) {
-  return requirePaths
-    .map((path) => `require('${path}');`)
-    .sort()
-    .join('\n');
-}
+import { readFileSync } from 'fs';
+import { resolve } from 'path';
+import { fromNullable } from '../either';
 
-export function dllEntryFileContentStringToArray(content = '') {
-  return content.split('\n');
-}
+const ROOT = resolve(__dirname, '../../../../..');
+const resolveFromRoot = resolve.bind(null, ROOT);
+const path = `
+src/dev/code_coverage/ingest_coverage/team_assignment/ingestion_pipeline_painless.json`;
+const resolved = resolveFromRoot(path.trimStart());
+const getContents = (scriptPath) => readFileSync(scriptPath, 'utf8');
 
-export function dllEntryFileContentArrayToString(content = []) {
-  return content.join('\n');
-}
-
-export function dllMergeAllEntryFilesContent(content = []) {
-  return content.join('\n').split('\n').sort().join('\n');
-}
+export const fetch = () => fromNullable(resolved).map(getContents);
diff --git a/src/dev/code_coverage/ingest_coverage/team_assignment/index.js b/src/dev/code_coverage/ingest_coverage/team_assignment/index.js
new file mode 100644
index 0000000000000..301f7fb2dee2f
--- /dev/null
+++ b/src/dev/code_coverage/ingest_coverage/team_assignment/index.js
@@ -0,0 +1,48 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { run } from '@kbn/dev-utils';
+import { TEAM_ASSIGNMENT_PIPELINE_NAME } from '../constants';
+import { fetch } from './get_data';
+import { noop } from '../utils';
+import { update } from './update_ingest_pipeline';
+
+export const uploadTeamAssignmentJson = () => run(execute, { description });
+
+const updatePipeline = update(TEAM_ASSIGNMENT_PIPELINE_NAME);
+
+function execute({ flags, log }) {
+  if (flags.verbose) log.verbose(`### Verbose logging enabled`);
+
+  fetch().fold(noop, updatePipeline(log));
+}
+
+function description() {
+  return `
+
+Upload the latest team assignment pipeline def from src,
+to the cluster.
+
+
+Examples:
+
+node scripts/load_team_assignment.js --verbose
+
+      `;
+}
diff --git a/src/dev/code_coverage/ingest_coverage/team_assignment/ingestion_pipeline_painless.json b/src/dev/code_coverage/ingest_coverage/team_assignment/ingestion_pipeline_painless.json
new file mode 100644
index 0000000000000..18e88b47ec887
--- /dev/null
+++ b/src/dev/code_coverage/ingest_coverage/team_assignment/ingestion_pipeline_painless.json
@@ -0,0 +1 @@
+{"description":"Kibana code coverage team assignments","processors":[{"script":{"lang":"painless","source":"\n            String path = ctx.coveredFilePath; \n            if (path.indexOf('src/legacy/core_plugins/kibana/') == 0) {\n\n                if (path.indexOf('src/legacy/core_plugins/kibana/common/utils') == 0) ctx.team = 'kibana-app';\n                else if (path.indexOf('src/legacy/core_plugins/kibana/migrations') == 0) ctx.team = 'kibana-app';\n                else if (path.indexOf('src/legacy/core_plugins/kibana/public') == 0) ctx.team = 'kibana-app';\n                else if (path.indexOf('src/legacy/core_plugins/kibana/public/dashboard/') == 0) ctx.team = 'kibana-app';\n                else if (path.indexOf('src/legacy/core_plugins/kibana/public/dev_tools/') == 0) ctx.team = 'kibana-app';\n                else if (path.indexOf('src/legacy/core_plugins/kibana/public/discover/') == 0) ctx.team = 'kibana-app';\n                else if (path.indexOf('src/legacy/core_plugins/kibana/public/home') == 0) ctx.team = 'kibana-core-ui';\n                else if (path.indexOf('src/legacy/core_plugins/kibana/public/home/np_ready/') == 0) ctx.team = 'kibana-core-ui';\n                else if (path.indexOf('src/legacy/core_plugins/kibana/public/local_application_service/') == 0) ctx.team = 'kibana-app';\n                else if (path.indexOf('src/legacy/core_plugins/kibana/public/management/') == 0) ctx.team = 'kibana-app-arch';\n                else if (path.indexOf('src/legacy/core_plugins/kibana/server/lib') == 0) ctx.team = 'kibana-platform';\n                else if (path.indexOf('src/legacy/core_plugins/kibana/server/lib/management/saved_objects') == 0) ctx.team = 'kibana-platform';\n                else if (path.indexOf('src/legacy/core_plugins/kibana/server/routes/api/management/') == 0) ctx.team = 'kibana-app-arch';\n                else if (path.indexOf('src/legacy/core_plugins/kibana/server/routes/api/import/') == 0) ctx.team = 'kibana-platform';\n                else if (path.indexOf('src/legacy/core_plugins/kibana/server/routes/api/export/') == 0) ctx.team = 'kibana-platform';\n                else ctx.team = 'unknown';\n\n            } else if (path.indexOf('src/legacy/core_plugins/') == 0) {\n\n                if (path.indexOf('src/legacy/core_plugins/apm_oss/') == 0) ctx.team = 'apm-ui';\n                else if (path.indexOf('src/legacy/core_plugins/console_legacy') == 0) ctx.team = 'kibana-app';\n                else if (path.indexOf('src/legacy/core_plugins/elasticsearch') == 0) ctx.team = 'kibana-platform';\n                else if (path.indexOf('src/legacy/core_plugins/embeddable_api/') == 0) ctx.team = 'kibana-app-arch';\n                else if (path.indexOf('src/legacy/core_plugins/input_control_vis') == 0) ctx.team = 'kibana-app';\n                else if (path.indexOf('src/legacy/core_plugins/interpreter/') == 0) ctx.team = 'kibana-app-arch';\n                else if (path.indexOf('src/legacy/core_plugins/kibana_react/') == 0) ctx.team = 'kibana-app-arch';\n                else if (path.indexOf('src/legacy/core_plugins/newsfeed') == 0) ctx.team = 'kibana-core-ui';\n                else if (path.indexOf('src/legacy/core_plugins/region_map') == 0) ctx.team = 'maps';\n                else if (path.indexOf('src/legacy/core_plugins/status_page/public') == 0) ctx.team = 'kibana-app-arch';\n                else if (path.indexOf('src/legacy/core_plugins/testbed') == 0) ctx.team = 'kibana-platform';\n                // else if (path.indexOf('src/legacy/core_plugins/tests_bundle/') == 0) ctx.team = 'kibana-platform';\n                \n                else if (path.indexOf('src/legacy/core_plugins/tile_map') == 0) ctx.team = 'maps';\n                else if (path.indexOf('src/legacy/core_plugins/timelion') == 0) ctx.team = 'kibana-app';\n                else if (path.indexOf('src/legacy/core_plugins/ui_metric/') == 0) ctx.team = 'pulse';\n                else if (path.indexOf('src/legacy/core_plugins/vis_type_tagcloud') == 0) ctx.team = 'kibana-app';\n                else if (path.indexOf('src/legacy/core_plugins/vis_type_vega') == 0) ctx.team = 'kibana-app';\n                else if (path.indexOf('src/legacy/core_plugins/vis_type_vislib/') == 0) ctx.team = 'kibana-app';\n                else if (path.indexOf('src/legacy/core_plugins/visualizations/') == 0) ctx.team = 'kibana-app-arch';\n                else ctx.team = 'unknown';\n\n            } else if (path.indexOf('src/legacy/server/') == 0) {\n\n                if (path.indexOf('src/legacy/server/config/') == 0) ctx.team = 'kibana-platform';\n                else if (path.indexOf('src/legacy/server/http/') == 0) ctx.team = 'kibana-platform';\n                else if (path.indexOf('src/legacy/server/i18n/') == 0) ctx.team = 'kibana-localization';\n                else if (path.indexOf('src/legacy/server/index_patterns/') == 0) ctx.team = 'kibana-app-arch';\n                else if (path.indexOf('src/legacy/server/keystore/') == 0) ctx.team = 'kibana-operations';\n                else if (path.indexOf('src/legacy/server/logging/') == 0) ctx.team = 'kibana-platform';\n                else if (path.indexOf('src/legacy/server/pid/') == 0) ctx.team = 'kibana-operations';\n                else if (path.indexOf('src/legacy/server/sample_data/') == 0) ctx.team = 'kibana-app';\n                else if (path.indexOf('src/legacy/server/sass/') == 0) ctx.team = 'kibana-operations';\n                else if (path.indexOf('src/legacy/server/saved_objects/') == 0) ctx.team = 'kibana-platform';\n                else if (path.indexOf('src/legacy/server/status/') == 0) ctx.team = 'kibana-platform';\n                else if (path.indexOf('src/legacy/server/url_shortening/') == 0) ctx.team = 'kibana-app';\n                else if (path.indexOf('src/legacy/server/utils/') == 0) ctx.team = 'kibana-operations';\n                else if (path.indexOf('src/legacy/server/warnings/') == 0) ctx.team = 'kibana-operations';\n                else ctx.team = 'unknown';\n\n            } else if (path.indexOf('src/legacy/ui') == 0) {\n\n                if (path.indexOf('src/legacy/ui/public/field_editor') == 0) ctx.team = 'kibana-app-arch';\n                else if (path.indexOf('src/legacy/ui/public/timefilter') == 0) ctx.team = 'kibana-app-arch';\n                else if (path.indexOf('src/legacy/ui/public/management') == 0) ctx.team = 'kibana-app-arch';\n                else if (path.indexOf('src/legacy/ui/public/state_management') == 0) ctx.team = 'kibana-app';\n                else if (path.indexOf('src/legacy/ui/public/new_platform') == 0) ctx.team = 'kibana-platform';\n                else if (path.indexOf('src/legacy/ui/public/plugin_discovery') == 0) ctx.team = 'kibana-platform';\n                else if (path.indexOf('src/legacy/ui/public/chrome') == 0) ctx.team = 'kibana-platform';\n                else if (path.indexOf('src/legacy/ui/public/notify') == 0) ctx.team = 'kibana-platform';\n                else if (path.indexOf('src/legacy/ui/public/documentation_links') == 0) ctx.team = 'kibana-platform';\n                else if (path.indexOf('src/legacy/ui/public/autoload') == 0) ctx.team = 'kibana-platform';\n                else if (path.indexOf('src/legacy/ui/public/capabilities') == 0) ctx.team = 'kibana-security';\n                else if (path.indexOf('src/legacy/ui/public/apm') == 0) ctx.team = 'apm-ui';\n\n            } else if (path.indexOf('src/plugins/') == 0) {\n\n                if (path.indexOf('src/plugins/advanced_settings/') == 0) ctx.team = 'kibana-app-arch';\n                else if (path.indexOf('src/plugins/apm_oss/') == 0) ctx.team = 'apm-ui';\n                else if (path.indexOf('src/plugins/bfetch/') == 0) ctx.team = 'kibana-app-arch';\n                else if (path.indexOf('src/plugins/charts/') == 0) ctx.team = 'kibana-app-arch';\n                else if (path.indexOf('src/plugins/charts/public/static/color_maps') == 0) ctx.team = 'kibana-app';\n                else if (path.indexOf('src/plugins/console/') == 0) ctx.team = 'es-ui';\n                else if (path.indexOf('src/plugins/dashboard/') == 0) ctx.team = 'kibana-app';\n                else if (path.indexOf('src/plugins/data/') == 0) ctx.team = 'kibana-app-arch';\n                else if (path.indexOf('src/plugins/dev_tools/') == 0) ctx.team = 'es-ui';\n                else if (path.indexOf('src/plugins/discover/') == 0) ctx.team = 'kibana-app';\n                else if (path.indexOf('src/plugins/embeddable/') == 0) ctx.team = 'kibana-app-arch';\n                else if (path.indexOf('src/plugins/es_ui_shared/') == 0) ctx.team = 'es-ui';\n                else if (path.indexOf('src/plugins/expressions/') == 0) ctx.team = 'kibana-app-arch';\n                else if (path.indexOf('src/plugins/home/public') == 0) ctx.team = 'kibana-core-ui';\n                else if (path.indexOf('src/plugins/home/server/tutorials') == 0) ctx.team = 'observability';\n                else if (path.indexOf('src/plugins/home/server/services/') == 0) ctx.team = 'kibana-core-ui';\n                else if (path.indexOf('src/plugins/home/') == 0) ctx.team = 'kibana-core-ui';\n                else if (path.indexOf('src/plugins/index_pattern_management/public/service') == 0) ctx.team = 'kibana-app-arch';\n                else if (path.indexOf('src/plugins/index_pattern_management/public') == 0) ctx.team = 'kibana-app';\n                else if (path.indexOf('src/plugins/input_control_vis/') == 0) ctx.team = 'kibana-app';\n                else if (path.indexOf('src/plugins/inspector/') == 0) ctx.team = 'kibana-app-arch';\n                else if (path.indexOf('src/plugins/kibana_legacy/') == 0) ctx.team = 'kibana-app';\n                else if (path.indexOf('src/plugins/kibana_react/public/code_editor') == 0) ctx.team = 'kibana-canvas';\n                else if (path.indexOf('src/plugins/kibana_react/') == 0) ctx.team = 'kibana-app-arch';\n                else if (path.indexOf('src/plugins/kibana_utils/') == 0) ctx.team = 'kibana-app-arch';\n                else if (path.indexOf('src/plugins/management/') == 0) ctx.team = 'kibana-app-arch';\n                else if (path.indexOf('src/plugins/kibana_usage_collection/') == 0) ctx.team = 'pulse';\n                else if (path.indexOf('src/plugins/legacy_export/') == 0) ctx.team = 'kibana-platform';\n                else if (path.indexOf('src/plugins/maps_legacy/') == 0) ctx.team = 'maps';\n                else if (path.indexOf('src/plugins/region_map/') == 0) ctx.team = 'maps';\n                else if (path.indexOf('src/plugins/tile_map/') == 0) ctx.team = 'maps';\n                else if (path.indexOf('src/plugins/timelion') == 0) ctx.team = 'kibana-app';\n                else if (path.indexOf('src/plugins/navigation/') == 0) ctx.team = 'kibana-app-arch';\n                else if (path.indexOf('src/plugins/newsfeed') == 0) ctx.team = 'kibana-core-ui';\n                else if (path.indexOf('src/plugins/saved_objects_management/') == 0) ctx.team = 'kibana-platform';\n                else if (path.indexOf('src/plugins/saved_objects/') == 0) ctx.team = 'kibana-app-arch';\n                else if (path.indexOf('src/plugins/share/') == 0) ctx.team = 'kibana-app-arch';\n                else if (path.indexOf('src/plugins/status_page/') == 0) ctx.team = 'kibana-platform';\n                else if (path.indexOf('src/plugins/telemetry') == 0) ctx.team = 'pulse';\n                else if (path.indexOf('src/plugins/testbed/server/') == 0) ctx.team = 'kibana-platform';\n                else if (path.indexOf('src/plugins/ui_actions/') == 0) ctx.team = 'kibana-app-arch';\n                else if (path.indexOf('src/plugins/usage_collection/') == 0) ctx.team = 'pulse';\n                else if (path.indexOf('src/plugins/vis_default_editor') == 0) ctx.team = 'kibana-app-arch';\n                else if (path.indexOf('src/plugins/vis_type') == 0) ctx.team = 'kibana-app';\n                else if (path.indexOf('src/plugins/visualizations/') == 0) ctx.team = 'kibana-app-arch';\n                else if (path.indexOf('src/plugins/visualize/') == 0) ctx.team = 'kibana-app';\n                else ctx.team = 'unknown';\n\n            } else if (path.indexOf('x-pack/legacy/') == 0) {\n\n                if (path.indexOf('x-pack/legacy/plugins/actions/') == 0) ctx.team = 'kibana-alerting-services';\n                else if (path.indexOf('x-pack/legacy/plugins/alerting/') == 0) ctx.team = 'kibana-alerting-services';\n                else if (path.indexOf('x-pack/legacy/plugins/apm/') == 0) ctx.team = 'apm-ui';\n                else if (path.indexOf('x-pack/legacy/plugins/beats_management/') == 0) ctx.team = 'beats';\n                else if (path.indexOf('x-pack/legacy/plugins/canvas/') == 0) ctx.team = 'kibana-canvas';\n                else if (path.indexOf('x-pack/legacy/plugins/cross_cluster_replication/') == 0) ctx.team = 'es-ui';\n                else if (path.indexOf('x-pack/legacy/plugins/dashboard_mode/') == 0) ctx.team = 'kibana-app';\n                else if (path.indexOf('x-pack/legacy/plugins/encrypted_saved_objects/') == 0) ctx.team = 'kibana-security';\n                else if (path.indexOf('x-pack/legacy/plugins/index_management/') == 0) ctx.team = 'es-ui';\n                else if (path.indexOf('x-pack/legacy/plugins/infra/') == 0) ctx.team = 'logs-metrics-ui';\n                else if (path.indexOf('x-pack/legacy/plugins/ingest_manager/') == 0) ctx.team = 'ingest-management';\n                else if (path.indexOf('x-pack/legacy/plugins/license_management/') == 0) ctx.team = 'es-ui';\n                else if (path.indexOf('x-pack/legacy/plugins/maps/') == 0) ctx.team = 'kibana-gis';\n                else if (path.indexOf('x-pack/legacy/plugins/ml/') == 0) ctx.team = 'ml-ui';\n                else if (path.indexOf('x-pack/legacy/plugins/monitoring/') == 0) ctx.team = 'stack-monitoring-ui';\n                else if (path.indexOf('x-pack/legacy/plugins/reporting') == 0) ctx.team = 'kibana-reporting';\n                else if (path.indexOf('x-pack/legacy/plugins/rollup/') == 0) ctx.team = 'es-ui';\n                else if (path.indexOf('x-pack/legacy/plugins/security/') == 0) ctx.team = 'kibana-security';\n                else if (path.indexOf('x-pack/legacy/plugins/siem/') == 0) ctx.team = 'siem';\n                else if (path.indexOf('x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules') == 0) ctx.team = 'security-intelligence-analytics';\n                else if (path.indexOf('x-pack/legacy/plugins/snapshot_restore/') == 0) ctx.team = 'es-ui';\n                else if (path.indexOf('x-pack/legacy/plugins/spaces/') == 0) ctx.team = 'kibana-security';\n                else if (path.indexOf('x-pack/legacy/plugins/task_manager') == 0) ctx.team = 'kibana-alerting-services';\n                else if (path.indexOf('x-pack/legacy/plugins/triggers_actions_ui/') == 0) ctx.team = 'kibana-alerting-services';\n                else if (path.indexOf('x-pack/legacy/plugins/upgrade_assistant/') == 0) ctx.team = 'es-ui';\n                else if (path.indexOf('x-pack/legacy/plugins/uptime') == 0) ctx.team = 'uptime';\n                else if (path.indexOf('x-pack/legacy/plugins/xpack_main/server/') == 0) ctx.team = 'kibana-platform';\n\n                else if (path.indexOf('x-pack/legacy/server/lib/create_router/') == 0) ctx.team = 'es-ui';\n                else if (path.indexOf('x-pack/legacy/server/lib/check_license/') == 0) ctx.team = 'es-ui'; \n                else if (path.indexOf('x-pack/legacy/server/lib/') == 0) ctx.team = 'kibana-platform'; \n                else ctx.team = 'unknown';\n\n            } else if (path.indexOf('x-pack/plugins/') == 0) {\n\n                if (path.indexOf('x-pack/plugins/actions/') == 0) ctx.team = 'kibana-alerting-services';\n                else if (path.indexOf('x-pack/plugins/advanced_ui_actions/') == 0) ctx.team = 'kibana-app-arch';\n                else if (path.indexOf('x-pack/plugins/alerts') == 0) ctx.team = 'kibana-alerting-services';\n                else if (path.indexOf('x-pack/plugins/alerting_builtins') == 0) ctx.team = 'kibana-alerting-services';\n                else if (path.indexOf('x-pack/plugins/apm/') == 0) ctx.team = 'apm-ui';\n                else if (path.indexOf('x-pack/plugins/beats_management/') == 0) ctx.team = 'beats';\n                else if (path.indexOf('x-pack/plugins/canvas/') == 0) ctx.team = 'kibana-canvas';\n                else if (path.indexOf('x-pack/plugins/case') == 0) ctx.team = 'siem';\n                else if (path.indexOf('x-pack/plugins/cloud/') == 0) ctx.team = 'kibana-platform';\n                else if (path.indexOf('x-pack/plugins/code/') == 0) ctx.team = 'code';\n                else if (path.indexOf('x-pack/plugins/console_extensions/') == 0) ctx.team = 'es-ui';\n                else if (path.indexOf('x-pack/plugins/cross_cluster_replication/') == 0) ctx.team = 'es-ui';\n                else if (path.indexOf('x-pack/plugins/dashboard_enhanced') == 0) ctx.team = 'kibana-app';\n                else if (path.indexOf('x-pack/plugins/dashboard_mode') == 0) ctx.team = 'kibana-app';\n                else if (path.indexOf('x-pack/plugins/discover_enhanced') == 0) ctx.team = 'kibana-app';\n                else if (path.indexOf('x-pack/plugins/embeddable_enhanced') == 0) ctx.team = 'kibana-app-arch';\n                else if (path.indexOf('x-pack/plugins/data_enhanced/') == 0) ctx.team = 'kibana-app-arch';\n                else if (path.indexOf('x-pack/plugins/drilldowns/') == 0) ctx.team = 'kibana-app-arch';\n                else if (path.indexOf('x-pack/plugins/encrypted_saved_objects/') == 0) ctx.team = 'kibana-security';\n                else if (path.indexOf('x-pack/plugins/endpoint/') == 0) ctx.team = 'endpoint-app-team';\n                else if (path.indexOf('x-pack/plugins/es_ui_shared/') == 0) ctx.team = 'es-ui';\n                else if (path.indexOf('x-pack/plugins/event_log/') == 0) ctx.team = 'kibana-alerting-services';\n                else if (path.indexOf('x-pack/plugins/features/') == 0) ctx.team = 'kibana-platform';\n                else if (path.indexOf('x-pack/plugins/file_upload') == 0) ctx.team = 'kibana-gis';\n                else if (path.indexOf('x-pack/plugins/global_search') == 0) ctx.team = 'kibana-platform';\n                \n                else if (path.indexOf('x-pack/plugins/graph/') == 0) ctx.team = 'kibana-app';\n                else if (path.indexOf('x-pack/plugins/grokdebugger/') == 0) ctx.team = 'es-ui';\n                else if (path.indexOf('x-pack/plugins/index_lifecycle_management/') == 0) ctx.team = 'es-ui';\n                else if (path.indexOf('x-pack/plugins/index_management/') == 0) ctx.team = 'es-ui';\n                else if (path.indexOf('x-pack/plugins/infra/') == 0) ctx.team = 'logs-metrics-ui';\n                else if (path.indexOf('x-pack/plugins/ingest_manager/') == 0) ctx.team = 'ingest-management';\n                else if (path.indexOf('x-pack/plugins/ingest_pipelines/') == 0) ctx.team = 'es-ui';\n                \n                else if (path.indexOf('x-pack/plugins/lens/') == 0) ctx.team = 'kibana-app';\n                else if (path.indexOf('x-pack/plugins/license_management/') == 0) ctx.team = 'es-ui';\n                else if (path.indexOf('x-pack/plugins/licensing/') == 0) ctx.team = 'kibana-platform';\n                else if (path.indexOf('x-pack/plugins/lists/') == 0) ctx.team = 'siem';\n                else if (path.indexOf('x-pack/plugins/logstash') == 0) ctx.team = 'logstash';\n                else if (path.indexOf('x-pack/plugins/maps/') == 0) ctx.team = 'kibana-gis';\n                else if (path.indexOf('x-pack/plugins/maps_legacy_licensing') == 0) ctx.team = 'maps';\n                else if (path.indexOf('x-pack/plugins/ml/') == 0) ctx.team = 'ml-ui';\n                else if (path.indexOf('x-pack/plugins/monitoring') == 0) ctx.team = 'stack-monitoring-ui';\n                else if (path.indexOf('x-pack/plugins/observability/') == 0) ctx.team = 'apm-ui';\n                else if (path.indexOf('x-pack/plugins/oss_telemetry/') == 0) ctx.team = 'pulse';\n                else if (path.indexOf('x-pack/plugins/painless_lab/') == 0) ctx.team = 'es-ui';\n                else if (path.indexOf('x-pack/plugins/remote_clusters/') == 0) ctx.team = 'es-ui';\n                else if (path.indexOf('x-pack/plugins/reporting') == 0) ctx.team = 'kibana-reporting';\n                else if (path.indexOf('x-pack/plugins/rollup/') == 0) ctx.team = 'es-ui';\n                else if (path.indexOf('x-pack/plugins/searchprofiler/') == 0) ctx.team = 'es-ui';\n                else if (path.indexOf('x-pack/plugins/security/') == 0) ctx.team = 'kibana-security';\n                else if (path.indexOf('x-pack/plugins/security_solution/') == 0) ctx.team = 'siem';\n                \n                else if (path.indexOf('x-pack/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules') == 0) ctx.team = 'security-intelligence-analytics';\n                else if (path.indexOf('x-pack/plugins/siem/') == 0) ctx.team = 'siem';\n                else if (path.indexOf('x-pack/plugins/snapshot_restore/') == 0) ctx.team = 'es-ui';\n                else if (path.indexOf('x-pack/plugins/spaces/') == 0) ctx.team = 'kibana-security';\n                else if (path.indexOf('x-pack/plugins/task_manager/') == 0) ctx.team = 'kibana-alerting-services';\n                else if (path.indexOf('x-pack/plugins/telemetry_collection_xpack/') == 0) ctx.team = 'pulse';\n                else if (path.indexOf('x-pack/plugins/transform/') == 0) ctx.team = 'ml-ui';\n                else if (path.indexOf('x-pack/plugins/translations/') == 0) ctx.team = 'kibana-localization';\n                else if (path.indexOf('x-pack/plugins/triggers_actions_ui/') == 0) ctx.team = 'kibana-alerting-services';\n                else if (path.indexOf('x-pack/plugins/upgrade_assistant/') == 0) ctx.team = 'es-ui';\n                else if (path.indexOf('x-pack/plugins/ui_actions_enhanced') == 0) ctx.team = 'kibana-app-arch';\n                else if (path.indexOf('x-pack/plugins/uptime') == 0) ctx.team = 'uptime';\n                \n                else if (path.indexOf('x-pack/plugins/watcher/') == 0) ctx.team = 'es-ui';\n                else ctx.team = 'unknown';\n\n            } else if (path.indexOf('packages') == 0) {\n\n                if (path.indexOf('packages/kbn-analytics/') == 0) ctx.team = 'pulse';\n                else if (path.indexOf('packages/kbn-babel') == 0) ctx.team = 'kibana-operations';\n                else if (path.indexOf('packages/kbn-config-schema/') == 0) ctx.team = 'kibana-platform';\n                else if (path.indexOf('packages/elastic-datemath') == 0) ctx.team = 'kibana-app-arch';\n                else if (path.indexOf('packages/kbn-dev-utils') == 0) ctx.team = 'kibana-operations';\n                else if (path.indexOf('packages/kbn-es/') == 0) ctx.team = 'kibana-operations';\n                else if (path.indexOf('packages/kbn-eslint') == 0) ctx.team = 'kibana-operations';\n                else if (path.indexOf('packages/kbn-expect') == 0) ctx.team = 'kibana-operations';\n                else if (path.indexOf('packages/kbn-i18n/') == 0) ctx.team = 'kibana-localization';\n                else if (path.indexOf('packages/kbn-interpreter/') == 0) ctx.team = 'kibana-app-arch';\n                else if (path.indexOf('packages/kbn-optimizer/') == 0) ctx.team = 'kibana-operations';\n                else if (path.indexOf('packages/kbn-pm/') == 0) ctx.team = 'kibana-operations';\n                else if (path.indexOf('packages/kbn-test/') == 0) ctx.team = 'kibana-operations';\n                else if (path.indexOf('packages/kbn-test-subj-selector/') == 0) ctx.team = 'kibana-operations';\n                else if (path.indexOf('packages/kbn-ui-framework/') == 0) ctx.team = 'kibana-design';\n                else if (path.indexOf('packages/kbn-ui-shared-deps/') == 0) ctx.team = 'kibana-operations';\n                else ctx.team = 'unknown';\n\n            } else {\n\n                if (path.indexOf('config/kibana.yml') == 0) ctx.team = 'kibana-platform';\n                else if (path.indexOf('src/apm.js') == 0) ctx.team = 'apm-ui';\n                else if (path.indexOf('src/core/') == 0) ctx.team = 'kibana-platform';\n                else if (path.indexOf('src/core/public/i18n/') == 0) ctx.team = 'kibana-localization';\n                else if (path.indexOf('src/core/server/csp/') == 0) ctx.team = 'kibana-security';\n                else if (path.indexOf('src/dev/') == 0) ctx.team = 'kibana-operations';\n                else if (path.indexOf('src/dev/i18n/') == 0) ctx.team = 'kibana-localization';\n                else if (path.indexOf('src/dev/run_check_published_api_changes.ts') == 0) ctx.team = 'kibana-platform';\n                else if (path.indexOf('src/es_archiver/') == 0) ctx.team = 'kibana-operations';\n                else if (path.indexOf('src/optimize/') == 0) ctx.team = 'kibana-operations';\n                else if (path.indexOf('src/setup_node_env/') == 0) ctx.team = 'kibana-operations';\n                else if (path.indexOf('src/test_utils/') == 0) ctx.team = 'kibana-operations';  \n                else ctx.team = 'unknown';\n            }"}}]}
diff --git a/packages/kbn-babel-code-parser/src/can_require.js b/src/dev/code_coverage/ingest_coverage/team_assignment/update_ingest_pipeline.js
similarity index 59%
rename from packages/kbn-babel-code-parser/src/can_require.js
rename to src/dev/code_coverage/ingest_coverage/team_assignment/update_ingest_pipeline.js
index b410611237766..03844b2a5dd32 100644
--- a/packages/kbn-babel-code-parser/src/can_require.js
+++ b/src/dev/code_coverage/ingest_coverage/team_assignment/update_ingest_pipeline.js
@@ -17,20 +17,21 @@
  * under the License.
  */
 
-export function canRequire(entry, cwd = require.resolve.paths(entry) || []) {
+import { createFailError } from '@kbn/dev-utils';
+import { RESEARCH_CLUSTER_ES_HOST } from '../constants';
+import { pretty, green } from '../utils';
+
+const { Client } = require('@elastic/elasticsearch');
+
+const node = RESEARCH_CLUSTER_ES_HOST;
+const client = new Client({ node });
+
+export const update = (id) => (log) => async (body) => {
   try {
-    // We will try to test if we can resolve
-    // this entry through the require.resolve
-    // setting as the start looking path the
-    // given cwd. That cwd variable could be
-    // a path or an array of paths
-    // from where Require.resolve will keep
-    // looking recursively as normal starting
-    // from those locations.
-    return require.resolve(entry, {
-      paths: [].concat(cwd),
-    });
+    await client.ingest.putPipeline({ id, body });
+    log.verbose(`### Ingestion Pipeline ID: ${green(id)}`);
+    log.verbose(`### Payload Partial: \n${body.slice(0, 600)}...`);
   } catch (e) {
-    return false;
+    throw createFailError(`${pretty(e.meta)}`);
   }
-}
+};
diff --git a/src/dev/code_coverage/shell_scripts/assign_teams.sh b/src/dev/code_coverage/shell_scripts/assign_teams.sh
new file mode 100644
index 0000000000000..186cbecb436e9
--- /dev/null
+++ b/src/dev/code_coverage/shell_scripts/assign_teams.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+
+echo "### Code Coverage Team Assignment"
+echo ""
+
+PIPELINE_NAME=$1
+export PIPELINE_NAME
+
+ES_HOST="https://${USER_FROM_VAULT}:${PASS_FROM_VAULT}@${HOST_FROM_VAULT}"
+export ES_HOST
+
+node scripts/load_team_assignment.js --verbose
+
+echo "###  Code Coverage Team Assignment - Complete"
+echo ""
diff --git a/src/dev/notice/generate_notice_from_source.ts b/src/dev/notice/generate_notice_from_source.ts
index fb74bed0f26f4..37bbcce72e497 100644
--- a/src/dev/notice/generate_notice_from_source.ts
+++ b/src/dev/notice/generate_notice_from_source.ts
@@ -47,10 +47,11 @@ export async function generateNoticeFromSource({ productName, directory, log }:
     cwd: directory,
     nodir: true,
     ignore: [
-      '{node_modules,build,target,dist,data,built_assets}/**',
-      'packages/*/{node_modules,build,target,dist}/**',
-      'x-pack/{node_modules,build,target,dist,data}/**',
-      'x-pack/packages/*/{node_modules,build,target,dist}/**',
+      '{node_modules,build,dist,data,built_assets}/**',
+      'packages/*/{node_modules,build,dist}/**',
+      'x-pack/{node_modules,build,dist,data}/**',
+      'x-pack/packages/*/{node_modules,build,dist}/**',
+      '**/target/**',
     ],
   };
 
diff --git a/src/dev/precommit_hook/casing_check_config.js b/src/dev/precommit_hook/casing_check_config.js
index 6b1f1dfaeabb4..929de8c6701d4 100644
--- a/src/dev/precommit_hook/casing_check_config.js
+++ b/src/dev/precommit_hook/casing_check_config.js
@@ -30,6 +30,7 @@ export const IGNORE_FILE_GLOBS = [
   'docs/**/*',
   '**/bin/**/*',
   '**/+([A-Z_]).md',
+  '**/+([A-Z_]).asciidoc',
   '**/LICENSE',
   '**/*.txt',
   '**/Gruntfile.js',
diff --git a/src/dev/renovate/config.ts b/src/dev/renovate/config.ts
index d868f0a89b98c..c9688fc0ae0bd 100644
--- a/src/dev/renovate/config.ts
+++ b/src/dev/renovate/config.ts
@@ -21,7 +21,7 @@ import { RENOVATE_PACKAGE_GROUPS } from './package_groups';
 import { PACKAGE_GLOBS } from './package_globs';
 import { wordRegExp, maybeFlatMap, maybeMap, getTypePackageName } from './utils';
 
-const DEFAULT_LABELS = ['release_note:skip', 'Team:Operations', 'renovate', 'v8.0.0', 'v7.9.0'];
+const DEFAULT_LABELS = ['release_note:skip', 'Team:Operations', 'renovate', 'v8.0.0', 'v7.10.0'];
 
 export const RENOVATE_CONFIG = {
   extends: ['config:base'],
diff --git a/src/es_archiver/lib/indices/create_index_stream.ts b/src/es_archiver/lib/indices/create_index_stream.ts
index df9d3bb623ad6..5629f95c7c9c6 100644
--- a/src/es_archiver/lib/indices/create_index_stream.ts
+++ b/src/es_archiver/lib/indices/create_index_stream.ts
@@ -18,6 +18,8 @@
  */
 
 import { Transform, Readable } from 'stream';
+import { inspect } from 'util';
+
 import { get, once } from 'lodash';
 import { Client } from 'elasticsearch';
 import { ToolingLog } from '@kbn/dev-utils';
@@ -84,6 +86,18 @@ export function createCreateIndexStream({
 
         stats.createdIndex(index, { settings });
       } catch (err) {
+        if (
+          err?.body?.error?.reason?.includes('index exists with the same name as the alias') &&
+          attemptNumber < 3
+        ) {
+          const aliasStr = inspect(aliases);
+          log.info(
+            `failed to create aliases [${aliasStr}] because ES indicated an index/alias already exists, trying again`
+          );
+          await attemptToCreate(attemptNumber + 1);
+          return;
+        }
+
         if (
           get(err, 'body.error.type') !== 'resource_already_exists_exception' ||
           attemptNumber >= 3
diff --git a/src/legacy/core_plugins/tests_bundle/index.js b/src/legacy/core_plugins/tests_bundle/index.js
index 431c161585fe0..da7c1c4f4527e 100644
--- a/src/legacy/core_plugins/tests_bundle/index.js
+++ b/src/legacy/core_plugins/tests_bundle/index.js
@@ -108,6 +108,13 @@ export default (kibana) => {
                 resolve: {
                   extensions: ['.karma_mock.js', '.karma_mock.tsx', '.karma_mock.ts'],
                 },
+                node: {
+                  fs: 'empty',
+                  child_process: 'empty',
+                  dns: 'empty',
+                  net: 'empty',
+                  tls: 'empty',
+                },
               },
               webpackConfig
             );
diff --git a/src/legacy/server/logging/log_format_string.js b/src/legacy/server/logging/log_format_string.js
index 3c18aab2e3d09..cbbf71dd894ac 100644
--- a/src/legacy/server/logging/log_format_string.js
+++ b/src/legacy/server/logging/log_format_string.js
@@ -41,8 +41,6 @@ const typeColors = {
   optmzr: 'white',
   manager: 'green',
   optimize: 'magentaBright',
-  'optimize:dynamic_dll_plugin': 'magentaBright',
-  'optimize:watch_cache': 'magentaBright',
   listening: 'magentaBright',
   scss: 'magentaBright',
 };
diff --git a/src/legacy/server/sass/build.test.js b/src/legacy/server/sass/build.test.js
index 71c43ac010962..155c300bf3036 100644
--- a/src/legacy/server/sass/build.test.js
+++ b/src/legacy/server/sass/build.test.js
@@ -50,9 +50,6 @@ it('builds light themed SASS', async () => {
   expect(readFileSync(targetPath, 'utf8').replace(/(\/\*# sourceMappingURL=).*( \*\/)/, '$1...$2'))
     .toMatchInlineSnapshot(`
     "foo bar {
-      display: -webkit-box;
-      display: -webkit-flex;
-      display: -ms-flexbox;
       display: flex;
       background: #e6f0f8 url(./images/img.png) url(ui/assets/favicons/favicon.ico); }
     /*# sourceMappingURL=... */"
@@ -75,9 +72,6 @@ it('builds dark themed SASS', async () => {
   expect(readFileSync(targetPath, 'utf8').replace(/(\/\*# sourceMappingURL=).*( \*\/)/, '$1...$2'))
     .toMatchInlineSnapshot(`
     "foo bar {
-      display: -webkit-box;
-      display: -webkit-flex;
-      display: -ms-flexbox;
       display: flex;
       background: #232635 url(./images/img.png) url(ui/assets/favicons/favicon.ico); }
     /*# sourceMappingURL=... */"
@@ -104,9 +98,6 @@ it('rewrites url imports', async () => {
   expect(readFileSync(targetPath, 'utf8').replace(/(\/\*# sourceMappingURL=).*( \*\/)/, '$1...$2'))
     .toMatchInlineSnapshot(`
     "foo bar {
-      display: -webkit-box;
-      display: -webkit-flex;
-      display: -ms-flexbox;
       display: flex;
       background: #232635 url(__REPLACE_WITH_PUBLIC_PATH__foo/bar/images/img.png) url(__REPLACE_WITH_PUBLIC_PATH__ui/favicons/favicon.ico); }
     /*# sourceMappingURL=... */"
diff --git a/src/legacy/ui/ui_render/ui_render_mixin.js b/src/legacy/ui/ui_render/ui_render_mixin.js
index 168dddf0253d9..7788aeaee72e5 100644
--- a/src/legacy/ui/ui_render/ui_render_mixin.js
+++ b/src/legacy/ui/ui_render/ui_render_mixin.js
@@ -24,7 +24,6 @@ import { i18n } from '@kbn/i18n';
 import * as UiSharedDeps from '@kbn/ui-shared-deps';
 import { AppBootstrap } from './bootstrap';
 import { getApmConfig } from '../apm';
-import { DllCompiler } from '../../../optimize/dynamic_dll_plugin';
 
 /**
  * @typedef {import('../../server/kbn_server').default} KbnServer
@@ -106,17 +105,8 @@ export function uiRenderMixin(kbnServer, server, config) {
         const basePath = config.get('server.basePath');
 
         const regularBundlePath = `${basePath}/${buildHash}/bundles`;
-        const dllBundlePath = `${basePath}/${buildHash}/built_assets/dlls`;
-
-        const dllStyleChunks = DllCompiler.getRawDllConfig().chunks.map(
-          (chunk) => `${dllBundlePath}/vendors${chunk}.style.dll.css`
-        );
-        const dllJsChunks = DllCompiler.getRawDllConfig().chunks.map(
-          (chunk) => `${dllBundlePath}/vendors${chunk}.bundle.dll.js`
-        );
 
         const styleSheetPaths = [
-          ...(isCore ? [] : dllStyleChunks),
           `${regularBundlePath}/kbn-ui-shared-deps/${UiSharedDeps.baseCssDistFilename}`,
           ...(darkMode
             ? [
@@ -173,7 +163,6 @@ export function uiRenderMixin(kbnServer, server, config) {
             (filename) => `${regularBundlePath}/kbn-ui-shared-deps/${filename}`
           ),
           `${regularBundlePath}/kbn-ui-shared-deps/${UiSharedDeps.jsFilename}`,
-          ...(isCore ? [] : [`${dllBundlePath}/vendors_runtime.bundle.dll.js`, ...dllJsChunks]),
 
           `${regularBundlePath}/core/core.entry.js`,
           ...kpPluginBundlePaths,
diff --git a/src/optimize/base_optimizer.js b/src/optimize/base_optimizer.js
index 55752db55e28a..41628a2264193 100644
--- a/src/optimize/base_optimizer.js
+++ b/src/optimize/base_optimizer.js
@@ -30,8 +30,6 @@ import webpackMerge from 'webpack-merge';
 import WrapperPlugin from 'wrapper-webpack-plugin';
 import * as UiSharedDeps from '@kbn/ui-shared-deps';
 
-import { DynamicDllPlugin } from './dynamic_dll_plugin';
-
 import { IS_KIBANA_DISTRIBUTABLE } from '../legacy/utils';
 import { fromRoot } from '../core/server/utils';
 import { PUBLIC_PATH_PLACEHOLDER } from './public_path_placeholder';
@@ -286,12 +284,6 @@ export default class BaseOptimizer {
       },
 
       plugins: [
-        new DynamicDllPlugin({
-          uiBundles: this.uiBundles,
-          threadLoaderPoolConfig: this.getThreadLoaderPoolConfig(),
-          logWithMetadata: this.logWithMetadata,
-        }),
-
         new MiniCssExtractPlugin({
           filename: '[name].style.css',
         }),
diff --git a/src/optimize/bundles_route/__tests__/bundles_route.js b/src/optimize/bundles_route/__tests__/bundles_route.js
index 902fa59b20569..5b42b658300fe 100644
--- a/src/optimize/bundles_route/__tests__/bundles_route.js
+++ b/src/optimize/bundles_route/__tests__/bundles_route.js
@@ -56,7 +56,6 @@ describe('optimizer/bundle route', () => {
   function createServer(options = {}) {
     const {
       regularBundlesPath = outputFixture,
-      dllBundlesPath = outputFixture,
       basePublicPath = '',
       builtCssPath = outputFixture,
       npUiPluginPublicDirs = [],
@@ -70,7 +69,6 @@ describe('optimizer/bundle route', () => {
     server.route(
       createBundlesRoute({
         regularBundlesPath,
-        dllBundlesPath,
         basePublicPath,
         builtCssPath,
         npUiPluginPublicDirs,
@@ -89,28 +87,24 @@ describe('optimizer/bundle route', () => {
       expect(() => {
         createBundlesRoute({
           regularBundlesPath: null,
-          dllBundlesPath: '/absolute/path',
           basePublicPath: '',
         });
       }).to.throwError(/absolute path/);
       expect(() => {
         createBundlesRoute({
           regularBundlesPath: './relative',
-          dllBundlesPath: '/absolute/path',
           basePublicPath: '',
         });
       }).to.throwError(/absolute path/);
       expect(() => {
         createBundlesRoute({
           regularBundlesPath: 1234,
-          dllBundlesPath: '/absolute/path',
           basePublicPath: '',
         });
       }).to.throwError(/absolute path/);
       expect(() => {
         createBundlesRoute({
           regularBundlesPath: '/absolute/path',
-          dllBundlesPath: '/absolute/path',
           basePublicPath: '',
         });
       }).to.not.throwError();
@@ -119,42 +113,36 @@ describe('optimizer/bundle route', () => {
       expect(() => {
         createBundlesRoute({
           regularBundlesPath: '/bundles',
-          dllBundlesPath: '/absolute/path',
           basePublicPath: 123,
         });
       }).to.throwError(/string/);
       expect(() => {
         createBundlesRoute({
           regularBundlesPath: '/bundles',
-          dllBundlesPath: '/absolute/path',
           basePublicPath: {},
         });
       }).to.throwError(/string/);
       expect(() => {
         createBundlesRoute({
           regularBundlesPath: '/bundles',
-          dllBundlesPath: '/absolute/path',
           basePublicPath: '/a/',
         });
       }).to.throwError(/start and not end with a \//);
       expect(() => {
         createBundlesRoute({
           regularBundlesPath: '/bundles',
-          dllBundlesPath: '/absolute/path',
           basePublicPath: 'a/',
         });
       }).to.throwError(/start and not end with a \//);
       expect(() => {
         createBundlesRoute({
           regularBundlesPath: '/bundles',
-          dllBundlesPath: '/absolute/path',
           basePublicPath: '/a',
         });
       }).to.not.throwError();
       expect(() => {
         createBundlesRoute({
           regularBundlesPath: '/bundles',
-          dllBundlesPath: '/absolute/path',
           basePublicPath: '',
         });
       }).to.not.throwError();
diff --git a/src/optimize/bundles_route/bundles_route.ts b/src/optimize/bundles_route/bundles_route.ts
index e9cfba0130d95..8c1092efed252 100644
--- a/src/optimize/bundles_route/bundles_route.ts
+++ b/src/optimize/bundles_route/bundles_route.ts
@@ -28,22 +28,19 @@ import { assertIsNpUiPluginPublicDirs, NpUiPluginPublicDirs } from '../np_ui_plu
 import { fromRoot } from '../../core/server/utils';
 
 /**
- *  Creates the routes that serves files from `bundlesPath` or from
- *  `dllBundlesPath` (if they are dll bundle's related files). If the
+ *  Creates the routes that serves files from `bundlesPath`. If the
  *  file is js or css then it is searched for instances of
  *  PUBLIC_PATH_PLACEHOLDER and replaces them with `publicPath`.
  *
  *  @param {Object} options
  *  @property {Array<{id,path}>} options.npUiPluginPublicDirs array of ids and paths that should be served for new platform plugins
  *  @property {string} options.regularBundlesPath
- *  @property {string} options.dllBundlesPath
  *  @property {string} options.basePublicPath
  *
  *  @return Array.of({Hapi.Route})
  */
 export function createBundlesRoute({
   regularBundlesPath,
-  dllBundlesPath,
   basePublicPath,
   builtCssPath,
   npUiPluginPublicDirs = [],
@@ -51,7 +48,6 @@ export function createBundlesRoute({
   isDist = false,
 }: {
   regularBundlesPath: string;
-  dllBundlesPath: string;
   basePublicPath: string;
   builtCssPath: string;
   npUiPluginPublicDirs?: NpUiPluginPublicDirs;
@@ -70,12 +66,6 @@ export function createBundlesRoute({
     );
   }
 
-  if (typeof dllBundlesPath !== 'string' || !isAbsolute(dllBundlesPath)) {
-    throw new TypeError(
-      'dllBundlesPath must be an absolute path to the directory containing the dll bundles'
-    );
-  }
-
   if (typeof basePublicPath !== 'string') {
     throw new TypeError('basePublicPath must be a string');
   }
@@ -118,13 +108,6 @@ export function createBundlesRoute({
       fileHashCache,
       isDist,
     }),
-    buildRouteForBundles({
-      publicPath: `${basePublicPath}/${buildHash}/built_assets/dlls/`,
-      routePath: `/${buildHash}/built_assets/dlls/`,
-      bundlesPath: dllBundlesPath,
-      fileHashCache,
-      isDist,
-    }),
     buildRouteForBundles({
       publicPath: `${basePublicPath}/`,
       routePath: `/${buildHash}/built_assets/css/`,
diff --git a/src/optimize/bundles_route/proxy_bundles_route.ts b/src/optimize/bundles_route/proxy_bundles_route.ts
index 1d189054324a1..108d253d45202 100644
--- a/src/optimize/bundles_route/proxy_bundles_route.ts
+++ b/src/optimize/bundles_route/proxy_bundles_route.ts
@@ -28,7 +28,6 @@ export function createProxyBundlesRoute({
 }) {
   return [
     buildProxyRouteForBundles(`/${buildHash}/bundles/`, host, port),
-    buildProxyRouteForBundles(`/${buildHash}/built_assets/dlls/`, host, port),
     buildProxyRouteForBundles(`/${buildHash}/built_assets/css/`, host, port),
   ];
 }
diff --git a/src/optimize/dynamic_dll_plugin/dll_compiler.js b/src/optimize/dynamic_dll_plugin/dll_compiler.js
deleted file mode 100644
index 9ab21ee0e9076..0000000000000
--- a/src/optimize/dynamic_dll_plugin/dll_compiler.js
+++ /dev/null
@@ -1,366 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { configModel } from './dll_config_model';
-import {
-  notInNodeModulesOrWebpackShims,
-  notInNodeModules,
-  inDllPluginPublic,
-} from './dll_allowed_modules';
-import {
-  dllEntryFileContentArrayToString,
-  dllEntryFileContentStringToArray,
-  dllMergeAllEntryFilesContent,
-} from './dll_entry_template';
-import { fromRoot } from '../../core/server/utils';
-import { PUBLIC_PATH_PLACEHOLDER } from '../public_path_placeholder';
-import fs from 'fs';
-import webpack from 'webpack';
-import { promisify } from 'util';
-import path from 'path';
-import del from 'del';
-import { chunk } from 'lodash';
-import seedrandom from 'seedrandom';
-
-const readFileAsync = promisify(fs.readFile);
-const mkdirAsync = promisify(fs.mkdir);
-const accessAsync = promisify(fs.access);
-const writeFileAsync = promisify(fs.writeFile);
-
-export class DllCompiler {
-  static getRawDllConfig(
-    uiBundles = {},
-    babelLoaderCacheDir = '',
-    threadLoaderPoolConfig = {},
-    chunks = Array.from(Array(4).keys()).map((chunkN) => `_${chunkN}`)
-  ) {
-    return {
-      uiBundles,
-      babelLoaderCacheDir,
-      threadLoaderPoolConfig,
-      chunks,
-      context: fromRoot('.'),
-      entryName: 'vendors',
-      dllName: '[name]',
-      manifestName: '[name]',
-      styleName: '[name]',
-      entryExt: '.entry.dll.js',
-      dllExt: '.bundle.dll.js',
-      manifestExt: '.manifest.dll.json',
-      styleExt: '.style.dll.css',
-      outputPath: fromRoot('built_assets/dlls'),
-      publicPath: PUBLIC_PATH_PLACEHOLDER,
-    };
-  }
-
-  constructor(uiBundles, threadLoaderPoolConfig, logWithMetadata) {
-    this.rawDllConfig = DllCompiler.getRawDllConfig(
-      uiBundles,
-      uiBundles.getCacheDirectory('babel'),
-      threadLoaderPoolConfig
-    );
-    this.logWithMetadata = logWithMetadata || (() => null);
-  }
-
-  async init() {
-    await this.ensureEntryFilesExists();
-    await this.ensureManifestFilesExists();
-    await this.ensureOutputPathExists();
-  }
-
-  seededShuffle(array) {
-    // Implementation based on https://github.com/TimothyGu/knuth-shuffle-seeded/blob/gh-pages/index.js#L46
-    let currentIndex;
-    let temporaryValue;
-    let randomIndex;
-    const rand = seedrandom('predictable', { global: false });
-
-    if (array.constructor !== Array) throw new Error('Input is not an array');
-    currentIndex = array.length;
-
-    // While there remain elements to shuffle...
-    while (0 !== currentIndex) {
-      // Pick a remaining element...
-      randomIndex = Math.floor(rand() * currentIndex--);
-
-      // And swap it with the current element.
-      temporaryValue = array[currentIndex];
-      array[currentIndex] = array[randomIndex];
-      array[randomIndex] = temporaryValue;
-    }
-
-    return array;
-  }
-
-  async upsertEntryFiles(content) {
-    const arrayContent = this.seededShuffle(dllEntryFileContentStringToArray(content));
-    const chunks = chunk(
-      arrayContent,
-      Math.ceil(arrayContent.length / this.rawDllConfig.chunks.length)
-    );
-    const entryPaths = this.getEntryPaths();
-
-    await Promise.all(
-      entryPaths.map(
-        async (entryPath, idx) =>
-          await this.upsertFile(entryPath, dllEntryFileContentArrayToString(chunks[idx]))
-      )
-    );
-  }
-
-  async upsertFile(filePath, content = '') {
-    await this.ensurePathExists(filePath);
-    await writeFileAsync(filePath, content, 'utf8');
-  }
-
-  getDllPaths() {
-    return this.rawDllConfig.chunks.map((chunk) =>
-      this.resolvePath(`${this.rawDllConfig.entryName}${chunk}${this.rawDllConfig.dllExt}`)
-    );
-  }
-
-  getEntryPaths() {
-    return this.rawDllConfig.chunks.map((chunk) =>
-      this.resolvePath(`${this.rawDllConfig.entryName}${chunk}${this.rawDllConfig.entryExt}`)
-    );
-  }
-
-  getManifestPaths() {
-    return this.rawDllConfig.chunks.map((chunk) =>
-      this.resolvePath(`${this.rawDllConfig.entryName}${chunk}${this.rawDllConfig.manifestExt}`)
-    );
-  }
-
-  getStylePaths() {
-    return this.rawDllConfig.chunks.map((chunk) =>
-      this.resolvePath(`${this.rawDllConfig.entryName}${chunk}${this.rawDllConfig.styleExt}`)
-    );
-  }
-
-  async ensureEntryFilesExists() {
-    const entryPaths = this.getEntryPaths();
-
-    await Promise.all(entryPaths.map(async (entryPath) => await this.ensureFileExists(entryPath)));
-  }
-
-  async ensureManifestFilesExists() {
-    const manifestPaths = this.getManifestPaths();
-
-    await Promise.all(
-      manifestPaths.map(
-        async (manifestPath, idx) =>
-          await this.ensureFileExists(
-            manifestPath,
-            JSON.stringify({
-              name: `${this.rawDllConfig.entryName}${this.rawDllConfig.chunks[idx]}`,
-              content: {},
-            })
-          )
-      )
-    );
-  }
-
-  async ensureStyleFileExists() {
-    const stylePaths = this.getStylePaths();
-
-    await Promise.all(stylePaths.map(async (stylePath) => await this.ensureFileExists(stylePath)));
-  }
-
-  async ensureFileExists(filePath, content) {
-    const exists = await this.ensurePathExists(filePath);
-
-    if (!exists) {
-      await this.upsertFile(filePath, content);
-    }
-  }
-
-  async ensurePathExists(filePath) {
-    try {
-      await accessAsync(filePath);
-    } catch (e) {
-      await mkdirAsync(path.dirname(filePath), { recursive: true });
-      return false;
-    }
-
-    return true;
-  }
-
-  async ensureOutputPathExists() {
-    await this.ensurePathExists(this.rawDllConfig.outputPath);
-  }
-
-  dllsExistsSync() {
-    const dllPaths = this.getDllPaths();
-
-    return dllPaths.every((dllPath) => this.existsSync(dllPath));
-  }
-
-  existsSync(filePath) {
-    return fs.existsSync(filePath);
-  }
-
-  resolvePath() {
-    return path.resolve(this.rawDllConfig.outputPath, ...arguments);
-  }
-
-  async readEntryFiles() {
-    const entryPaths = this.getEntryPaths();
-
-    const entryFilesContent = await Promise.all(
-      entryPaths.map(async (entryPath) => await this.readFile(entryPath))
-    );
-
-    // merge all the module contents from entry files again into
-    // sorted single one
-    return dllMergeAllEntryFilesContent(entryFilesContent);
-  }
-
-  async readFile(filePath, content) {
-    await this.ensureFileExists(filePath, content);
-    return await readFileAsync(filePath, 'utf8');
-  }
-
-  async run(dllEntries) {
-    const dllConfig = this.dllConfigGenerator(this.rawDllConfig);
-    await this.upsertEntryFiles(dllEntries);
-
-    try {
-      this.logWithMetadata(
-        ['info', 'optimize:dynamic_dll_plugin'],
-        'Client vendors dll compilation started'
-      );
-
-      await this.runWebpack(dllConfig());
-
-      this.logWithMetadata(
-        ['info', 'optimize:dynamic_dll_plugin'],
-        `Client vendors dll compilation finished with success`
-      );
-    } catch (e) {
-      this.logWithMetadata(
-        ['fatal', 'optimize:dynamic_dll_plugin'],
-        `Client vendors dll compilation failed`
-      );
-
-      // Still throw the original error has here we just want
-      // log the fail message
-      throw e;
-    }
-
-    // Style dll file isn't always created but we are
-    // expecting it to exist always as we are referencing
-    // it from the bootstrap template
-    //
-    // NOTE: We should review the way we deal with the css extraction
-    // in ours webpack builds. The industry standard is about to
-    // only extract css for production but we are extracting it
-    // in every single compilation.
-    await this.ensureStyleFileExists();
-  }
-
-  dllConfigGenerator(dllConfig) {
-    return configModel.bind(this, dllConfig);
-  }
-
-  async runWebpack(config) {
-    return new Promise((resolve, reject) => {
-      webpack(config, async (err, stats) => {
-        // If a critical error occurs or we have
-        // errors in the stats compilation,
-        // reject the promise and logs the errors
-        const webpackErrors =
-          err ||
-          (stats.hasErrors() &&
-            stats.toString({
-              all: false,
-              colors: true,
-              errors: true,
-              errorDetails: true,
-              moduleTrace: true,
-            }));
-
-        if (webpackErrors) {
-          // Reject with webpack fatal errors
-          return reject(webpackErrors);
-        }
-
-        // Identify if we have not allowed modules
-        // bundled inside the dll bundle
-        const notAllowedModules = [];
-
-        stats.compilation.modules.forEach((module) => {
-          // ignore if no module or userRequest are defined
-          if (!module || !module.resource) {
-            return;
-          }
-
-          // ignore if this module represents the
-          // dll entry file
-          if (this.getEntryPaths().includes(module.resource)) {
-            return;
-          }
-
-          // ignore if this module is part of the
-          // files inside dynamic dll plugin public folder
-          if (inDllPluginPublic(module.resource)) {
-            return;
-          }
-
-          // A module is not allowed if it's not a node_module, a webpackShim
-          // or the reasons from being bundled into the dll are not node_modules
-          if (notInNodeModulesOrWebpackShims(module.resource)) {
-            const reasons = module.reasons || [];
-
-            reasons.forEach((reason) => {
-              // Skip if we can't read the reason info
-              if (!reason || !reason.module || !reason.module.resource) {
-                return;
-              }
-
-              // Is the reason for this module being bundle a
-              // node_module or no?
-              if (notInNodeModules(reason.module.resource)) {
-                notAllowedModules.push(module.resource);
-              }
-            });
-          }
-        });
-
-        if (notAllowedModules.length) {
-          // Delete the built dll, as it contains invalid modules, and reject listing
-          // all the not allowed modules
-          try {
-            await del(this.rawDllConfig.outputPath);
-          } catch (e) {
-            return reject(e);
-          }
-
-          return reject(
-            `The following modules are not allowed to be bundled into the dll: \n${notAllowedModules.join(
-              '\n'
-            )}`
-          );
-        }
-
-        // Otherwise it has succeed
-        return resolve(stats);
-      });
-    });
-  }
-}
diff --git a/src/optimize/dynamic_dll_plugin/dll_config_model.js b/src/optimize/dynamic_dll_plugin/dll_config_model.js
deleted file mode 100644
index eec369b194fef..0000000000000
--- a/src/optimize/dynamic_dll_plugin/dll_config_model.js
+++ /dev/null
@@ -1,278 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { IS_KIBANA_DISTRIBUTABLE } from '../../legacy/utils';
-import { fromRoot } from '../../core/server/utils';
-import webpack from 'webpack';
-import webpackMerge from 'webpack-merge';
-import MiniCssExtractPlugin from 'mini-css-extract-plugin';
-import TerserPlugin from 'terser-webpack-plugin';
-import * as UiSharedDeps from '@kbn/ui-shared-deps';
-
-function generateDLL(config) {
-  const {
-    dllAlias,
-    dllValidateSyntax,
-    dllNoParseRules,
-    dllContext,
-    dllEntry,
-    dllOutputPath,
-    dllPublicPath,
-    dllBundleName,
-    dllBundleFilename,
-    dllStyleFilename,
-    dllManifestPath,
-    babelLoaderCacheDir,
-    threadLoaderPoolConfig,
-  } = config;
-
-  const BABEL_PRESET_PATH = require.resolve('@kbn/babel-preset/webpack_preset');
-  const BABEL_EXCLUDE_RE = [/[\/\\](webpackShims|node_modules|bower_components)[\/\\]/];
-
-  /**
-   * Wrap plugin loading in a function so that we can require
-   * `@kbn/optimizer` only when absolutely necessary since we
-   * don't ship this package in the distributable but this code
-   * is still shipped, though it's not used.
-   */
-  const getValidateSyntaxPlugins = () => {
-    if (!dllValidateSyntax) {
-      return [];
-    }
-
-    // only require @kbn/optimizer
-    const { DisallowedSyntaxPlugin } = require('@kbn/optimizer');
-    return [new DisallowedSyntaxPlugin()];
-  };
-
-  return {
-    entry: dllEntry,
-    context: dllContext,
-    output: {
-      futureEmitAssets: true, // TODO: remove on webpack 5
-      filename: dllBundleFilename,
-      path: dllOutputPath,
-      publicPath: dllPublicPath,
-      library: dllBundleName,
-    },
-    node: { fs: 'empty', child_process: 'empty', dns: 'empty', net: 'empty', tls: 'empty' },
-    resolve: {
-      extensions: ['.js', '.json'],
-      mainFields: ['browser', 'browserify', 'main'],
-      alias: dllAlias,
-      modules: ['webpackShims', fromRoot('webpackShims'), 'node_modules', fromRoot('node_modules')],
-    },
-    module: {
-      rules: [
-        {
-          resource: [
-            {
-              test: /\.js$/,
-              exclude: BABEL_EXCLUDE_RE.concat(dllNoParseRules),
-            },
-            {
-              test: /\.js$/,
-              include: /[\/\\]node_modules[\/\\]x-pack[\/\\]/,
-              exclude: /[\/\\]node_modules[\/\\]x-pack[\/\\](.+?[\/\\])*node_modules[\/\\]/,
-            },
-            // TODO: remove when we drop support for IE11
-            // We need because normalize-url is distributed without
-            // any kind of transpilation
-            // More info: https://github.com/elastic/kibana/pull/35804
-            {
-              test: /\.js$/,
-              include: /[\/\\]node_modules[\/\\]normalize-url[\/\\]/,
-              exclude: /[\/\\]node_modules[\/\\]normalize-url[\/\\](.+?[\/\\])*node_modules[\/\\]/,
-            },
-          ],
-          // Self calling function with the equivalent logic
-          // from maybeAddCacheLoader one from base optimizer
-          use: ((babelLoaderCacheDirPath, loaders) => {
-            return [
-              {
-                loader: 'cache-loader',
-                options: {
-                  cacheContext: fromRoot('.'),
-                  cacheDirectory: babelLoaderCacheDirPath,
-                  readOnly: process.env.KBN_CACHE_LOADER_WRITABLE ? false : IS_KIBANA_DISTRIBUTABLE,
-                },
-              },
-              ...loaders,
-            ];
-          })(babelLoaderCacheDir, [
-            {
-              loader: 'thread-loader',
-              options: threadLoaderPoolConfig,
-            },
-            {
-              loader: 'babel-loader',
-              options: {
-                babelrc: false,
-                presets: [BABEL_PRESET_PATH],
-              },
-            },
-          ]),
-        },
-        {
-          test: /\.(html|tmpl)$/,
-          loader: 'raw-loader',
-        },
-        {
-          test: /\.css$/,
-          use: [MiniCssExtractPlugin.loader, 'css-loader'],
-        },
-        {
-          test: /\.png$/,
-          loader: 'url-loader',
-        },
-        {
-          test: /\.(woff|woff2|ttf|eot|svg|ico)(\?|$)/,
-          loader: 'file-loader',
-        },
-      ],
-      noParse: dllNoParseRules,
-    },
-    plugins: [
-      new webpack.DllPlugin({
-        context: dllContext,
-        name: dllBundleName,
-        path: dllManifestPath,
-      }),
-      new MiniCssExtractPlugin({
-        filename: dllStyleFilename,
-      }),
-      ...getValidateSyntaxPlugins(),
-    ],
-    // Single runtime for the dll bundles which assures that common transient dependencies won't be evaluated twice.
-    // The module cache will be shared, even when module code may be duplicated across chunks.
-    optimization: {
-      runtimeChunk: {
-        name: 'vendors_runtime',
-      },
-    },
-    performance: {
-      // NOTE: we are disabling this as those hints
-      // are more tailored for the final bundles result
-      // and not for the webpack compilations performance itself
-      hints: false,
-    },
-    externals: {
-      ...UiSharedDeps.externals,
-    },
-  };
-}
-
-function extendRawConfig(rawConfig) {
-  // Build all extended configs from raw config
-  const dllAlias = rawConfig.uiBundles.getAliases();
-  const dllValidateSyntax = rawConfig.uiBundles.shouldValidateSyntaxOfNodeModules();
-  const dllNoParseRules = rawConfig.uiBundles.getWebpackNoParseRules();
-  const dllDevMode = rawConfig.uiBundles.isDevMode();
-  const dllContext = rawConfig.context;
-  const dllChunks = rawConfig.chunks;
-  const dllEntry = {};
-  const dllEntryName = rawConfig.entryName;
-  const dllBundleName = rawConfig.dllName;
-  const dllManifestName = rawConfig.dllName;
-  const dllStyleName = rawConfig.styleName;
-  const dllEntryExt = rawConfig.entryExt;
-  const dllBundleExt = rawConfig.dllExt;
-  const dllManifestExt = rawConfig.manifestExt;
-  const dllStyleExt = rawConfig.styleExt;
-  const dllOutputPath = rawConfig.outputPath;
-  const dllPublicPath = rawConfig.publicPath;
-  const dllBundleFilename = `${dllBundleName}${dllBundleExt}`;
-  const dllManifestPath = `${dllOutputPath}/${dllManifestName}${dllManifestExt}`;
-  const dllStyleFilename = `${dllStyleName}${dllStyleExt}`;
-  const babelLoaderCacheDir = rawConfig.babelLoaderCacheDir;
-  const threadLoaderPoolConfig = rawConfig.threadLoaderPoolConfig;
-
-  // Create webpack entry object key with the provided dllEntryName
-  dllChunks.reduce((dllEntryObj, chunk) => {
-    dllEntryObj[`${dllEntryName}${chunk}`] = [
-      `${dllOutputPath}/${dllEntryName}${chunk}${dllEntryExt}`,
-    ];
-    return dllEntryObj;
-  }, dllEntry);
-
-  // Export dll config map
-  return {
-    dllAlias,
-    dllValidateSyntax,
-    dllNoParseRules,
-    dllDevMode,
-    dllContext,
-    dllEntry,
-    dllOutputPath,
-    dllPublicPath,
-    dllBundleName,
-    dllBundleFilename,
-    dllStyleFilename,
-    dllManifestPath,
-    babelLoaderCacheDir,
-    threadLoaderPoolConfig,
-  };
-}
-
-function common(config) {
-  return webpackMerge(generateDLL(config));
-}
-
-function optimized() {
-  return webpackMerge({
-    mode: 'production',
-    optimization: {
-      minimizer: [
-        new TerserPlugin({
-          // NOTE: we should not enable that option for now
-          // Since 2.0.0 terser-webpack-plugin is using jest-worker
-          // to run tasks in a pool of workers. Currently it looks like
-          // is requiring too much memory and break on large entry points
-          // compilations (like this) one. Also the gain we have enabling
-          // that option was barely noticed.
-          // https://github.com/webpack-contrib/terser-webpack-plugin/issues/143
-          parallel: false,
-          sourceMap: false,
-          cache: false,
-          extractComments: false,
-          terserOptions: {
-            compress: false,
-            mangle: false,
-          },
-        }),
-      ],
-    },
-  });
-}
-
-function unoptimized() {
-  return webpackMerge({
-    mode: 'development',
-  });
-}
-
-export function configModel(rawConfig = {}) {
-  const config = extendRawConfig(rawConfig);
-
-  if (config.dllDevMode) {
-    return webpackMerge(common(config), unoptimized());
-  }
-
-  return webpackMerge(common(config), optimized());
-}
diff --git a/src/optimize/dynamic_dll_plugin/dynamic_dll_plugin.js b/src/optimize/dynamic_dll_plugin/dynamic_dll_plugin.js
deleted file mode 100644
index fb6f6e097b5cd..0000000000000
--- a/src/optimize/dynamic_dll_plugin/dynamic_dll_plugin.js
+++ /dev/null
@@ -1,354 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { DllCompiler } from './dll_compiler';
-import { notInNodeModulesOrWebpackShims, inPluginNodeModules } from './dll_allowed_modules';
-import { IS_KIBANA_DISTRIBUTABLE } from '../../legacy/utils';
-import { dllEntryTemplate } from './dll_entry_template';
-import RawModule from 'webpack/lib/RawModule';
-import webpack from 'webpack';
-import path from 'path';
-import normalizePosixPath from 'normalize-path';
-import fs from 'fs';
-import { promisify } from 'util';
-
-const realPathAsync = promisify(fs.realpath);
-const DLL_ENTRY_STUB_MODULE_TYPE = 'javascript/dll-entry-stub';
-
-export class DynamicDllPlugin {
-  constructor({ uiBundles, threadLoaderPoolConfig, logWithMetadata, maxCompilations = 1 }) {
-    this.logWithMetadata = logWithMetadata || (() => null);
-    this.dllCompiler = new DllCompiler(uiBundles, threadLoaderPoolConfig, logWithMetadata);
-    this.entryPaths = dllEntryTemplate();
-    this.afterCompilationEntryPaths = dllEntryTemplate();
-    this.maxCompilations = maxCompilations;
-    this.performedCompilations = 0;
-    this.forceDLLCreationFlag = !!(process && process.env && process.env.FORCE_DLL_CREATION);
-  }
-
-  async init() {
-    await this.dllCompiler.init();
-    this.entryPaths = await this.dllCompiler.readEntryFiles();
-  }
-
-  apply(compiler) {
-    // Just register the init basic hooks
-    // in order to run the init function
-    this.registerInitBasicHooks(compiler);
-    // The dll reference should always be bind to the
-    // main webpack config.
-    this.bindDllReferencePlugin(compiler);
-
-    // Verify if we must init and run the dynamic dll plugin tasks.
-    // We must run it every time we are not under a distributable env
-    if (!this.mustRunDynamicDllPluginTasks()) {
-      return;
-    }
-
-    // This call init all the DynamicDllPlugin tasks
-    // as it attaches the plugin to the main webpack
-    // lifecycle hooks needed to perform the logic
-    this.registerTasksHooks(compiler);
-  }
-
-  bindDllReferencePlugin(compiler) {
-    const rawDllConfig = this.dllCompiler.rawDllConfig;
-    const dllContext = rawDllConfig.context;
-    const dllManifestPaths = this.dllCompiler.getManifestPaths();
-
-    dllManifestPaths.forEach((dllChunkManifestPath) => {
-      new webpack.DllReferencePlugin({
-        context: dllContext,
-        manifest: dllChunkManifestPath,
-      }).apply(compiler);
-    });
-  }
-
-  registerInitBasicHooks(compiler) {
-    this.registerRunHook(compiler);
-    this.registerWatchRunHook(compiler);
-  }
-
-  registerTasksHooks(compiler) {
-    this.logWithMetadata(
-      ['info', 'optimize:dynamic_dll_plugin'],
-      'Started dynamic dll plugin tasks'
-    );
-    this.registerBeforeCompileHook(compiler);
-    this.registerCompilationHook(compiler);
-    this.registerDoneHook(compiler);
-  }
-
-  registerRunHook(compiler) {
-    compiler.hooks.run.tapPromise('DynamicDllPlugin', async () => {
-      await this.init();
-    });
-  }
-
-  registerWatchRunHook(compiler) {
-    compiler.hooks.watchRun.tapPromise('DynamicDllPlugin', async () => {
-      await this.init();
-    });
-  }
-
-  registerBeforeCompileHook(compiler) {
-    compiler.hooks.beforeCompile.tapPromise('DynamicDllPlugin', async ({ normalModuleFactory }) => {
-      normalModuleFactory.hooks.factory.tap('DynamicDllPlugin', (actualFactory) => (params, cb) => {
-        // This is used in order to avoid the cache for DLL modules
-        // resolved from other dependencies
-        normalModuleFactory.cachePredicate = (module) =>
-          !(module.stubType === DLL_ENTRY_STUB_MODULE_TYPE);
-
-        // Overrides the normalModuleFactory module creation behaviour
-        // in order to understand the modules we need to add to the DLL
-        actualFactory(params, (error, module) => {
-          if (error || !module) {
-            cb(error, module);
-          } else {
-            this.mapNormalModule(module).then(
-              (m = module) => cb(undefined, m),
-              (error) => cb(error)
-            );
-          }
-        });
-      });
-    });
-  }
-
-  registerCompilationHook(compiler) {
-    compiler.hooks.compilation.tap('DynamicDllPlugin', (compilation) => {
-      compilation.hooks.needAdditionalPass.tap('DynamicDllPlugin', () => {
-        // Run the procedures in order to execute our dll compilation
-        // The process is very straightforward in it's conception:
-        //
-        // * 1 - loop through every compilation module in order to start building
-        //   the dll entry paths arrays and assume it is the new entry paths
-        // * 1.1 - start from adding the modules already included into the dll, if any.
-        // * 1.2 - adding the new discovered stub modules
-        // * 1.3 - check if the module added to the entry path is from node_modules or
-        //   webpackShims, otherwise throw an error.
-        // * 1.3.1 - for the entry path modules coming from webpackShims search for every
-        //   require statements inside of them
-        // * 1.3.2 - discard the ones that are not js dependencies
-        // * 1.3.3 - add those new discovered dependencies inside the webpackShims to the
-        //   entry paths array
-        // * 2 - compare the built entry paths and compares it to the old one (if any)
-        // * 3 - runs a new dll compilation in case there is none old entry paths or if the
-        //   new built one differs from the old one.
-        //
-        const rawDllConfig = this.dllCompiler.rawDllConfig;
-        const dllContext = rawDllConfig.context;
-        const dllOutputPath = rawDllConfig.outputPath;
-        const requiresMap = {};
-
-        for (const module of compilation.modules) {
-          // re-include requires for modules already handled by the dll
-          if (module.delegateData) {
-            const absoluteResource = path.resolve(dllContext, module.userRequest);
-            if (
-              absoluteResource.includes('node_modules') ||
-              absoluteResource.includes('webpackShims')
-            ) {
-              // NOTE: normalizePosixPath is been used as we only want to have posix
-              // paths inside our final dll entry file
-              requiresMap[
-                normalizePosixPath(path.relative(dllOutputPath, absoluteResource))
-              ] = true;
-            }
-          }
-
-          // include requires for modules that need to be added to the dll
-          if (module.stubType === DLL_ENTRY_STUB_MODULE_TYPE) {
-            requiresMap[
-              normalizePosixPath(path.relative(dllOutputPath, module.stubResource))
-            ] = true;
-          }
-        }
-
-        // Sort and join all the discovered require deps
-        // in order to create a consistent entry file
-        this.afterCompilationEntryPaths = dllEntryTemplate(Object.keys(requiresMap));
-        // The dll compilation will run if on of the following conditions return true:
-        // 1 - the new generated entry paths are different from the
-        // old ones
-        // 2 - if no dll bundle is yet created
-        // 3 - if this.forceDLLCreationFlag were set from the node env var FORCE_DLL_CREATION and
-        // we are not running over the distributable. If we are running under the watch optimizer,
-        // this.forceDLLCreationFlag will only be applied in the very first execution,
-        // then will be set to false
-        compilation.needsDLLCompilation =
-          this.afterCompilationEntryPaths !== this.entryPaths ||
-          !this.dllCompiler.dllsExistsSync() ||
-          (this.isToForceDLLCreation() && this.performedCompilations === 0);
-        this.entryPaths = this.afterCompilationEntryPaths;
-
-        // Only run this info log in the first performed dll compilation
-        // per each execution run
-        if (this.performedCompilations === 0) {
-          this.logWithMetadata(
-            ['info', 'optimize:dynamic_dll_plugin'],
-            compilation.needsDLLCompilation
-              ? 'Need to compile the client vendors dll'
-              : 'No need to compile client vendors dll'
-          );
-        }
-
-        return compilation.needsDLLCompilation;
-      });
-    });
-  }
-
-  registerDoneHook(compiler) {
-    compiler.hooks.done.tapPromise('DynamicDllPlugin', async (stats) => {
-      if (stats.compilation.needsDLLCompilation) {
-        // Run the dlls compiler and increment
-        // the performed compilations
-        //
-        // NOTE: check the need for this extra try/catch after upgrading
-        // past webpack v4.29.3. For now it is needed so we can log the error
-        // otherwise the error log we'll get will be something like: [fatal] [object Object]
-        try {
-          await this.runDLLCompiler(compiler);
-        } catch (error) {
-          this.logWithMetadata(['error', 'optimize:dynamic_dll_plugin'], error.message);
-          throw error;
-        }
-
-        return;
-      }
-
-      this.performedCompilations = 0;
-      // reset this flag var set from the node env FORCE_DLL_CREATION on init,
-      // has the force_dll_creation is only valid for the very first run
-      if (this.forceDLLCreationFlag) {
-        this.forceDLLCreationFlag = false;
-      }
-      this.logWithMetadata(
-        ['info', 'optimize:dynamic_dll_plugin'],
-        'Finished all dynamic dll plugin tasks'
-      );
-    });
-  }
-
-  isToForceDLLCreation() {
-    return this.forceDLLCreationFlag;
-  }
-
-  mustRunDynamicDllPluginTasks() {
-    return !IS_KIBANA_DISTRIBUTABLE || this.isToForceDLLCreation();
-  }
-
-  async mapNormalModule(module) {
-    // ignore anything that doesn't have a resource (ignored) or is already delegating to the DLL
-    if (!module.resource || module.delegateData) {
-      return;
-    }
-
-    // ignore anything that needs special loaders or config
-    if (module.request.includes('!') || module.request.includes('?')) {
-      return;
-    }
-
-    // ignore files that are not in node_modules
-    if (notInNodeModulesOrWebpackShims(module.resource)) {
-      return;
-    }
-
-    // also ignore files that are symlinked into node_modules, but only
-    // do the `realpath` call after checking the plain resource path
-    if (notInNodeModulesOrWebpackShims(await realPathAsync(module.resource))) {
-      return;
-    }
-
-    const dirs = module.resource.split(path.sep);
-    const nodeModuleName = dirs[dirs.lastIndexOf('node_modules') + 1];
-
-    // ignore webpack loader modules
-    if (nodeModuleName.endsWith('-loader')) {
-      return;
-    }
-
-    // ignore modules from plugins
-    if (inPluginNodeModules(module.resource)) {
-      return;
-    }
-
-    // also ignore files that are symlinked into plugins node_modules, but only
-    // do the `realpath` call after checking the plain resource path
-    if (inPluginNodeModules(await realPathAsync(module.resource))) {
-      return;
-    }
-
-    // This is a StubModule (as a RawModule) in order
-    // to mimic the missing modules from the DLL and
-    // also hold useful metadata
-    const stubModule = new RawModule(
-      `/* pending dll entry */`,
-      `dll pending:${module.resource}`,
-      module.resource
-    );
-    stubModule.stubType = DLL_ENTRY_STUB_MODULE_TYPE;
-    stubModule.stubResource = module.resource;
-    stubModule.stubOriginalModule = module;
-
-    return stubModule;
-  }
-
-  async assertMaxCompilations() {
-    // Logic to run the max compilation requirements.
-    // Only enable this for CI builds in order to ensure
-    // we have an healthy dll ecosystem.
-    if (this.performedCompilations === this.maxCompilations) {
-      throw new Error(
-        'All the allowed dll compilations were already performed and one more is needed which is not possible'
-      );
-    }
-  }
-
-  async runDLLCompiler(mainCompiler) {
-    const runCompilerErrors = [];
-
-    try {
-      await this.dllCompiler.run(this.entryPaths);
-    } catch (e) {
-      runCompilerErrors.push(e);
-    }
-
-    try {
-      await this.assertMaxCompilations();
-    } catch (e) {
-      runCompilerErrors.push(e);
-    }
-
-    // We need to purge the cache into the inputFileSystem
-    // for every single built in previous compilation
-    // that we rely in next ones.
-    this.dllCompiler
-      .getManifestPaths()
-      .forEach((chunkDllManifestPath) => mainCompiler.inputFileSystem.purge(chunkDllManifestPath));
-
-    this.performedCompilations++;
-
-    if (!runCompilerErrors.length) {
-      return;
-    }
-
-    throw new Error(runCompilerErrors.join('\n-'));
-  }
-}
diff --git a/src/optimize/optimize_mixin.ts b/src/optimize/optimize_mixin.ts
index 9a3f08e2f667e..947c918a567f5 100644
--- a/src/optimize/optimize_mixin.ts
+++ b/src/optimize/optimize_mixin.ts
@@ -22,8 +22,6 @@ import Hapi from 'hapi';
 // @ts-ignore not TS yet
 import FsOptimizer from './fs_optimizer';
 import { createBundlesRoute } from './bundles_route';
-// @ts-ignore not TS yet
-import { DllCompiler } from './dynamic_dll_plugin';
 import { fromRoot } from '../core/server/utils';
 import { getNpUiPluginPublicDirs } from './np_ui_plugin_public_dirs';
 import KbnServer, { KibanaConfig } from '../legacy/server/kbn_server';
@@ -40,7 +38,7 @@ export const optimizeMixin = async (
   // bundles in a "middleware" style.
   //
   // the server listening on 5601 may be restarted a number of times, depending
-  // on the watch setup managed by the cli. It proxies all bundles/* and built_assets/dlls/*
+  // on the watch setup managed by the cli. It proxies all bundles/*
   // requests to the other server. The server on 5602 is long running, in order
   // to prevent complete rebuilds of the optimize content.
   const watch = config.get('optimize.watch');
@@ -53,7 +51,6 @@ export const optimizeMixin = async (
   server.route(
     createBundlesRoute({
       regularBundlesPath: uiBundles.getWorkingDir(),
-      dllBundlesPath: DllCompiler.getRawDllConfig().outputPath,
       basePublicPath: config.get('server.basePath'),
       builtCssPath: fromRoot('built_assets/css'),
       npUiPluginPublicDirs: getNpUiPluginPublicDirs(kbnServer),
diff --git a/src/optimize/watch/optmzr_role.js b/src/optimize/watch/optmzr_role.js
index ba8007e1065b4..0057c04219ec6 100644
--- a/src/optimize/watch/optmzr_role.js
+++ b/src/optimize/watch/optmzr_role.js
@@ -17,12 +17,8 @@
  * under the License.
  */
 
-import { resolve } from 'path';
-
 import WatchServer from './watch_server';
 import WatchOptimizer, { STATUS } from './watch_optimizer';
-import { DllCompiler } from '../dynamic_dll_plugin';
-import { WatchCache } from './watch_cache';
 import { getNpUiPluginPublicDirs } from '../np_ui_plugin_public_dirs';
 
 export default async (kbnServer, kibanaHapiServer, config) => {
@@ -36,12 +32,6 @@ export default async (kbnServer, kibanaHapiServer, config) => {
     sourceMaps: config.get('optimize.sourceMaps'),
     workers: config.get('optimize.workers'),
     prebuild: config.get('optimize.watchPrebuild'),
-    watchCache: new WatchCache({
-      logWithMetadata,
-      outputPath: config.get('path.data'),
-      dllsPath: DllCompiler.getRawDllConfig().outputPath,
-      cachePath: resolve(kbnServer.uiBundles.getCacheDirectory(), '../'),
-    }),
   });
 
   const server = new WatchServer(
diff --git a/src/optimize/watch/watch.js b/src/optimize/watch/watch.js
index a284da11f294f..7774577fb7677 100644
--- a/src/optimize/watch/watch.js
+++ b/src/optimize/watch/watch.js
@@ -32,7 +32,7 @@ export default async (kbnServer) => {
    *   while the optimizer is running
    *
    * server: this process runs the entire kibana server and proxies
-   *   all requests for /bundles/* or /built_assets/dlls/* to the optmzr process
+   *   all requests for /bundles/* to the optmzr process
    *
    * @param  {string} process.env.kbnWorkerType
    */
diff --git a/src/optimize/watch/watch_cache.ts b/src/optimize/watch/watch_cache.ts
deleted file mode 100644
index 40bd1d6075f47..0000000000000
--- a/src/optimize/watch/watch_cache.ts
+++ /dev/null
@@ -1,189 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { createHash } from 'crypto';
-import { readFile, writeFile, readdir, unlink, rmdir } from 'fs';
-import { resolve } from 'path';
-import { promisify } from 'util';
-import path from 'path';
-import del from 'del';
-import normalizePosixPath from 'normalize-path';
-
-const readAsync = promisify(readFile);
-const writeAsync = promisify(writeFile);
-const readdirAsync = promisify(readdir);
-const unlinkAsync = promisify(unlink);
-const rmdirAsync = promisify(rmdir);
-
-interface Params {
-  logWithMetadata: (tags: string[], message: string, metadata?: { [key: string]: any }) => void;
-  outputPath: string;
-  dllsPath: string;
-  cachePath: string;
-}
-
-interface WatchCacheStateContent {
-  optimizerConfigSha?: string;
-  yarnLockSha?: string;
-}
-
-export class WatchCache {
-  private readonly logWithMetadata: Params['logWithMetadata'];
-  private readonly outputPath: Params['outputPath'];
-  private readonly dllsPath: Params['dllsPath'];
-  private readonly cachePath: Params['cachePath'];
-  private readonly cacheState: WatchCacheStateContent;
-  private statePath: string;
-  private diskCacheState: WatchCacheStateContent;
-  private isInitialized: boolean;
-
-  constructor(params: Params) {
-    this.logWithMetadata = params.logWithMetadata;
-    this.outputPath = params.outputPath;
-    this.dllsPath = params.dllsPath;
-    this.cachePath = params.cachePath;
-
-    this.isInitialized = false;
-    this.statePath = '';
-    this.cacheState = {};
-    this.diskCacheState = {};
-    this.cacheState.yarnLockSha = '';
-    this.cacheState.optimizerConfigSha = '';
-  }
-
-  public async tryInit() {
-    if (!this.isInitialized) {
-      this.statePath = resolve(this.outputPath, 'watch_optimizer_cache_state.json');
-      this.diskCacheState = await this.read();
-      this.cacheState.yarnLockSha = await this.buildYarnLockSha();
-      this.cacheState.optimizerConfigSha = await this.buildOptimizerConfigSha();
-      this.isInitialized = true;
-    }
-  }
-
-  public async tryReset() {
-    await this.tryInit();
-
-    if (!this.isResetNeeded()) {
-      return;
-    }
-
-    await this.reset();
-  }
-
-  public async reset() {
-    this.logWithMetadata(['info', 'optimize:watch_cache'], 'The optimizer watch cache will reset');
-
-    // start by deleting the state file to lower the
-    // amount of time that another process might be able to
-    // successfully read it once we decide to delete it
-    await del(this.statePath, { force: true });
-
-    // delete everything in optimize/.cache directory
-    await recursiveDelete(normalizePosixPath(this.cachePath));
-
-    // delete dlls
-    await del(this.dllsPath);
-
-    // re-write new cache state file
-    await this.write();
-
-    this.logWithMetadata(['info', 'optimize:watch_cache'], 'The optimizer watch cache has reset');
-  }
-
-  private async buildShaWithMultipleFiles(filePaths: string[]) {
-    const shaHash = createHash('sha1');
-
-    for (const filePath of filePaths) {
-      try {
-        shaHash.update(await readAsync(filePath, 'utf8'), 'utf8');
-      } catch (e) {
-        /* no-op */
-      }
-    }
-
-    return shaHash.digest('hex');
-  }
-
-  private async buildYarnLockSha() {
-    const kibanaYarnLock = resolve(__dirname, '../../../yarn.lock');
-
-    return await this.buildShaWithMultipleFiles([kibanaYarnLock]);
-  }
-
-  private async buildOptimizerConfigSha() {
-    const baseOptimizer = resolve(__dirname, '../base_optimizer.js');
-    const dynamicDllConfigModel = resolve(__dirname, '../dynamic_dll_plugin/dll_config_model.js');
-    const dynamicDllPlugin = resolve(__dirname, '../dynamic_dll_plugin/dynamic_dll_plugin.js');
-
-    return await this.buildShaWithMultipleFiles([
-      baseOptimizer,
-      dynamicDllConfigModel,
-      dynamicDllPlugin,
-    ]);
-  }
-
-  private isResetNeeded() {
-    return this.hasYarnLockChanged() || this.hasOptimizerConfigChanged();
-  }
-
-  private hasYarnLockChanged() {
-    return this.cacheState.yarnLockSha !== this.diskCacheState.yarnLockSha;
-  }
-
-  private hasOptimizerConfigChanged() {
-    return this.cacheState.optimizerConfigSha !== this.diskCacheState.optimizerConfigSha;
-  }
-
-  private async write() {
-    await writeAsync(this.statePath, JSON.stringify(this.cacheState, null, 2), 'utf8');
-    this.diskCacheState = this.cacheState;
-  }
-
-  private async read(): Promise<WatchCacheStateContent> {
-    try {
-      return JSON.parse(await readAsync(this.statePath, 'utf8'));
-    } catch (error) {
-      return {};
-    }
-  }
-}
-
-/**
- * Recursively deletes a folder. This is a workaround for a bug in `del` where
- * very large folders (with 84K+ files) cause a stack overflow.
- */
-async function recursiveDelete(directory: string) {
-  try {
-    const entries = await readdirAsync(directory, { withFileTypes: true });
-
-    await Promise.all(
-      entries.map((entry) => {
-        const absolutePath = path.join(directory, entry.name);
-        return entry.isDirectory() ? recursiveDelete(absolutePath) : unlinkAsync(absolutePath);
-      })
-    );
-
-    return rmdirAsync(directory);
-  } catch (error) {
-    if (error.code !== 'ENOENT') {
-      throw error;
-    }
-  }
-}
diff --git a/src/optimize/watch/watch_optimizer.js b/src/optimize/watch/watch_optimizer.js
index 816185e544ab5..000c03ffb34fe 100644
--- a/src/optimize/watch/watch_optimizer.js
+++ b/src/optimize/watch/watch_optimizer.js
@@ -19,7 +19,6 @@
 
 import BaseOptimizer from '../base_optimizer';
 import { createBundlesRoute } from '../bundles_route';
-import { DllCompiler } from '../dynamic_dll_plugin';
 import { fromRoot } from '../../core/server/utils';
 import * as Rx from 'rxjs';
 import { mergeMap, take } from 'rxjs/operators';
@@ -35,7 +34,6 @@ export default class WatchOptimizer extends BaseOptimizer {
   constructor(opts) {
     super(opts);
     this.prebuild = opts.prebuild || false;
-    this.watchCache = opts.watchCache;
     this.status$ = new Rx.ReplaySubject(1);
   }
 
@@ -43,9 +41,6 @@ export default class WatchOptimizer extends BaseOptimizer {
     this.initializing = true;
     this.initialBuildComplete = false;
 
-    // try reset the watch optimizer cache
-    await this.watchCache.tryReset();
-
     // log status changes
     this.status$.subscribe(this.onStatusChangeHandler);
     await this.uiBundles.resetBundleDir();
@@ -120,7 +115,6 @@ export default class WatchOptimizer extends BaseOptimizer {
         npUiPluginPublicDirs: npUiPluginPublicDirs,
         buildHash,
         regularBundlesPath: this.compiler.outputPath,
-        dllBundlesPath: DllCompiler.getRawDllConfig().outputPath,
         basePublicPath: basePath,
         builtCssPath: fromRoot('built_assets/css'),
       })
diff --git a/src/plugins/dashboard/README.asciidoc b/src/plugins/dashboard/README.asciidoc
new file mode 100644
index 0000000000000..78163b14c14d6
--- /dev/null
+++ b/src/plugins/dashboard/README.asciidoc
@@ -0,0 +1,5 @@
+[[kibana-dashboard-plugin]]
+== Dashboard plugin
+
+- Registers the dashboard application.
+- Adds a dashboard embeddable that can be used in other applications.
\ No newline at end of file
diff --git a/src/plugins/data/common/field_formats/converters/url.test.ts b/src/plugins/data/common/field_formats/converters/url.test.ts
index 5ee195f8c7752..771bde85626d0 100644
--- a/src/plugins/data/common/field_formats/converters/url.test.ts
+++ b/src/plugins/data/common/field_formats/converters/url.test.ts
@@ -167,8 +167,8 @@ describe('UrlFormat', () => {
     });
   });
 
-  describe('whitelist', () => {
-    test('should assume a relative url if the value is not in the whitelist without a base path', () => {
+  describe('allow-list', () => {
+    test('should assume a relative url if the value is not in the allow-list without a base path', () => {
       const parsedUrl = {
         origin: 'http://kibana',
         basePath: '',
@@ -193,7 +193,7 @@ describe('UrlFormat', () => {
       );
     });
 
-    test('should assume a relative url if the value is not in the whitelist with a basepath', () => {
+    test('should assume a relative url if the value is not in the allow-list with a basepath', () => {
       const parsedUrl = {
         origin: 'http://kibana',
         basePath: '/xyz',
diff --git a/src/plugins/data/common/field_formats/converters/url.ts b/src/plugins/data/common/field_formats/converters/url.ts
index b797159b53486..2630c97b0821b 100644
--- a/src/plugins/data/common/field_formats/converters/url.ts
+++ b/src/plugins/data/common/field_formats/converters/url.ts
@@ -161,8 +161,8 @@ export class UrlFormat extends FieldFormat {
 
         return this.generateImgHtml(url, imageLabel);
       default:
-        const inWhitelist = allowedUrlSchemes.some((scheme) => url.indexOf(scheme) === 0);
-        if (!inWhitelist && !parsedUrl) {
+        const allowed = allowedUrlSchemes.some((scheme) => url.indexOf(scheme) === 0);
+        if (!allowed && !parsedUrl) {
           return url;
         }
 
@@ -178,7 +178,7 @@ export class UrlFormat extends FieldFormat {
          * UNSUPPORTED
          *  - app/kibana
          */
-        if (!inWhitelist) {
+        if (!allowed) {
           // Handles urls like: `#/discover`
           if (url[0] === '#') {
             prefix = `${origin}${pathname}`;
diff --git a/src/plugins/data/public/actions/apply_filter_action.ts b/src/plugins/data/public/actions/apply_filter_action.ts
index 7e8ed5ec8fb22..a2621e6ce8802 100644
--- a/src/plugins/data/public/actions/apply_filter_action.ts
+++ b/src/plugins/data/public/actions/apply_filter_action.ts
@@ -22,6 +22,7 @@ import { toMountPoint } from '../../../kibana_react/public';
 import { ActionByType, createAction, IncompatibleActionError } from '../../../ui_actions/public';
 import { getOverlays, getIndexPatterns } from '../services';
 import { applyFiltersPopover } from '../ui/apply_filters';
+import type { IEmbeddable } from '../../../embeddable/public';
 import { Filter, FilterManager, TimefilterContract, esFilters } from '..';
 
 export const ACTION_GLOBAL_APPLY_FILTER = 'ACTION_GLOBAL_APPLY_FILTER';
@@ -29,6 +30,7 @@ export const ACTION_GLOBAL_APPLY_FILTER = 'ACTION_GLOBAL_APPLY_FILTER';
 export interface ApplyGlobalFilterActionContext {
   filters: Filter[];
   timeFieldName?: string;
+  embeddable?: IEmbeddable;
 }
 
 async function isCompatible(context: ApplyGlobalFilterActionContext) {
diff --git a/src/plugins/data/public/actions/filters/create_filters_from_range_select.ts b/src/plugins/data/public/actions/filters/create_filters_from_range_select.ts
index a0eb49d773f3d..d9aa1b8ec8048 100644
--- a/src/plugins/data/public/actions/filters/create_filters_from_range_select.ts
+++ b/src/plugins/data/public/actions/filters/create_filters_from_range_select.ts
@@ -22,7 +22,7 @@ import moment from 'moment';
 import { esFilters, IFieldType, RangeFilterParams } from '../../../public';
 import { getIndexPatterns } from '../../../public/services';
 import { deserializeAggConfig } from '../../search/expressions/utils';
-import { RangeSelectContext } from '../../../../embeddable/public';
+import type { RangeSelectContext } from '../../../../embeddable/public';
 
 export async function createFiltersFromRangeSelectAction(event: RangeSelectContext['data']) {
   const column: Record<string, any> = event.table.columns[event.column];
diff --git a/src/plugins/data/public/actions/filters/create_filters_from_value_click.ts b/src/plugins/data/public/actions/filters/create_filters_from_value_click.ts
index 1974b9f776748..9429df91f693c 100644
--- a/src/plugins/data/public/actions/filters/create_filters_from_value_click.ts
+++ b/src/plugins/data/public/actions/filters/create_filters_from_value_click.ts
@@ -21,7 +21,7 @@ import { KibanaDatatable } from '../../../../../plugins/expressions/public';
 import { deserializeAggConfig } from '../../search/expressions';
 import { esFilters, Filter } from '../../../public';
 import { getIndexPatterns } from '../../../public/services';
-import { ValueClickContext } from '../../../../embeddable/public';
+import type { ValueClickContext } from '../../../../embeddable/public';
 
 /**
  * For terms aggregations on `__other__` buckets, this assembles a list of applicable filter
diff --git a/src/plugins/data/public/actions/index.ts b/src/plugins/data/public/actions/index.ts
index ef9014aafe82d..692996cf6fd19 100644
--- a/src/plugins/data/public/actions/index.ts
+++ b/src/plugins/data/public/actions/index.ts
@@ -17,8 +17,12 @@
  * under the License.
  */
 
-export { ACTION_GLOBAL_APPLY_FILTER, createFilterAction } from './apply_filter_action';
+export {
+  ACTION_GLOBAL_APPLY_FILTER,
+  createFilterAction,
+  ApplyGlobalFilterActionContext,
+} from './apply_filter_action';
 export { createFiltersFromValueClickAction } from './filters/create_filters_from_value_click';
 export { createFiltersFromRangeSelectAction } from './filters/create_filters_from_range_select';
-export { selectRangeAction } from './select_range_action';
-export { valueClickAction } from './value_click_action';
+export * from './select_range_action';
+export * from './value_click_action';
diff --git a/src/plugins/data/public/actions/select_range_action.ts b/src/plugins/data/public/actions/select_range_action.ts
index 49766143b5588..1781da980dc30 100644
--- a/src/plugins/data/public/actions/select_range_action.ts
+++ b/src/plugins/data/public/actions/select_range_action.ts
@@ -17,60 +17,39 @@
  * under the License.
  */
 
-import { i18n } from '@kbn/i18n';
 import {
-  createAction,
-  IncompatibleActionError,
   ActionByType,
+  APPLY_FILTER_TRIGGER,
+  createAction,
+  UiActionsStart,
 } from '../../../../plugins/ui_actions/public';
 import { createFiltersFromRangeSelectAction } from './filters/create_filters_from_range_select';
-import { RangeSelectContext } from '../../../embeddable/public';
-import { FilterManager, TimefilterContract, esFilters } from '..';
-
-export const ACTION_SELECT_RANGE = 'ACTION_SELECT_RANGE';
+import type { RangeSelectContext } from '../../../embeddable/public';
 
 export type SelectRangeActionContext = RangeSelectContext;
 
-async function isCompatible(context: SelectRangeActionContext) {
-  try {
-    return Boolean(await createFiltersFromRangeSelectAction(context.data));
-  } catch {
-    return false;
-  }
-}
+export const ACTION_SELECT_RANGE = 'ACTION_SELECT_RANGE';
 
-export function selectRangeAction(
-  filterManager: FilterManager,
-  timeFilter: TimefilterContract
+export function createSelectRangeAction(
+  getStartServices: () => { uiActions: UiActionsStart }
 ): ActionByType<typeof ACTION_SELECT_RANGE> {
   return createAction<typeof ACTION_SELECT_RANGE>({
     type: ACTION_SELECT_RANGE,
     id: ACTION_SELECT_RANGE,
-    getIconType: () => 'filter',
-    getDisplayName: () => {
-      return i18n.translate('data.filter.applyFilterActionTitle', {
-        defaultMessage: 'Apply filter to current view',
-      });
-    },
-    isCompatible,
-    execute: async ({ data }: SelectRangeActionContext) => {
-      if (!(await isCompatible({ data }))) {
-        throw new IncompatibleActionError();
-      }
-
-      const selectedFilters = await createFiltersFromRangeSelectAction(data);
-
-      if (data.timeFieldName) {
-        const { timeRangeFilter, restOfFilters } = esFilters.extractTimeFilter(
-          data.timeFieldName,
-          selectedFilters
-        );
-        filterManager.addFilters(restOfFilters);
-        if (timeRangeFilter) {
-          esFilters.changeTimeFilter(timeFilter, timeRangeFilter);
+    shouldAutoExecute: async () => true,
+    execute: async (context: SelectRangeActionContext) => {
+      try {
+        const filters = await createFiltersFromRangeSelectAction(context.data);
+        if (filters.length > 0) {
+          await getStartServices().uiActions.getTrigger(APPLY_FILTER_TRIGGER).exec({
+            filters,
+            embeddable: context.embeddable,
+            timeFieldName: context.data.timeFieldName,
+          });
         }
-      } else {
-        filterManager.addFilters(selectedFilters);
+      } catch (e) {
+        // eslint-disable-next-line no-console
+        console.warn(`Error [ACTION_SELECT_RANGE]: can\'t extract filters from action context`);
       }
     },
   });
diff --git a/src/plugins/data/public/actions/value_click_action.ts b/src/plugins/data/public/actions/value_click_action.ts
index dd74a7ee507f3..81e62380eacfb 100644
--- a/src/plugins/data/public/actions/value_click_action.ts
+++ b/src/plugins/data/public/actions/value_click_action.ts
@@ -17,98 +17,41 @@
  * under the License.
  */
 
-import { i18n } from '@kbn/i18n';
-import { toMountPoint } from '../../../../plugins/kibana_react/public';
 import {
   ActionByType,
+  APPLY_FILTER_TRIGGER,
   createAction,
-  IncompatibleActionError,
+  UiActionsStart,
 } from '../../../../plugins/ui_actions/public';
-import { getOverlays, getIndexPatterns } from '../services';
-import { applyFiltersPopover } from '../ui/apply_filters';
 import { createFiltersFromValueClickAction } from './filters/create_filters_from_value_click';
-import { ValueClickContext } from '../../../embeddable/public';
-import { Filter, FilterManager, TimefilterContract, esFilters } from '..';
-
-export const ACTION_VALUE_CLICK = 'ACTION_VALUE_CLICK';
+import type { Filter } from '../../common/es_query/filters';
+import type { ValueClickContext } from '../../../embeddable/public';
 
 export type ValueClickActionContext = ValueClickContext;
+export const ACTION_VALUE_CLICK = 'ACTION_VALUE_CLICK';
 
-async function isCompatible(context: ValueClickActionContext) {
-  try {
-    const filters: Filter[] = await createFiltersFromValueClickAction(context.data);
-    return filters.length > 0;
-  } catch {
-    return false;
-  }
-}
-
-export function valueClickAction(
-  filterManager: FilterManager,
-  timeFilter: TimefilterContract
+export function createValueClickAction(
+  getStartServices: () => { uiActions: UiActionsStart }
 ): ActionByType<typeof ACTION_VALUE_CLICK> {
   return createAction<typeof ACTION_VALUE_CLICK>({
     type: ACTION_VALUE_CLICK,
     id: ACTION_VALUE_CLICK,
-    getIconType: () => 'filter',
-    getDisplayName: () => {
-      return i18n.translate('data.filter.applyFilterActionTitle', {
-        defaultMessage: 'Apply filter to current view',
-      });
-    },
-    isCompatible,
-    execute: async ({ data }: ValueClickActionContext) => {
-      if (!(await isCompatible({ data }))) {
-        throw new IncompatibleActionError();
-      }
-
-      const filters: Filter[] = await createFiltersFromValueClickAction(data);
-
-      let selectedFilters = filters;
-
-      if (filters.length > 1) {
-        const indexPatterns = await Promise.all(
-          filters.map((filter) => {
-            return getIndexPatterns().get(filter.meta.index!);
-          })
-        );
-
-        const filterSelectionPromise: Promise<Filter[]> = new Promise((resolve) => {
-          const overlay = getOverlays().openModal(
-            toMountPoint(
-              applyFiltersPopover(
-                filters,
-                indexPatterns,
-                () => {
-                  overlay.close();
-                  resolve([]);
-                },
-                (filterSelection: Filter[]) => {
-                  overlay.close();
-                  resolve(filterSelection);
-                }
-              )
-            ),
-            {
-              'data-test-subj': 'selectFilterOverlay',
-            }
-          );
-        });
-
-        selectedFilters = await filterSelectionPromise;
-      }
-
-      if (data.timeFieldName) {
-        const { timeRangeFilter, restOfFilters } = esFilters.extractTimeFilter(
-          data.timeFieldName,
-          selectedFilters
-        );
-        filterManager.addFilters(restOfFilters);
-        if (timeRangeFilter) {
-          esFilters.changeTimeFilter(timeFilter, timeRangeFilter);
+    shouldAutoExecute: async () => true,
+    execute: async (context: ValueClickActionContext) => {
+      try {
+        const filters: Filter[] = await createFiltersFromValueClickAction(context.data);
+        if (filters.length > 0) {
+          await getStartServices().uiActions.getTrigger(APPLY_FILTER_TRIGGER).exec({
+            filters,
+            embeddable: context.embeddable,
+            timeFieldName: context.data.timeFieldName,
+          });
         }
-      } else {
-        filterManager.addFilters(selectedFilters);
+      } catch (e) {
+        // eslint-disable-next-line no-console
+        console.warn(
+          `Error [ACTION_EMIT_APPLY_FILTER_TRIGGER]: can\'t extract filters from action context`
+        );
       }
     },
   });
diff --git a/src/plugins/data/public/index.ts b/src/plugins/data/public/index.ts
index 6328e694193c9..846471420327f 100644
--- a/src/plugins/data/public/index.ts
+++ b/src/plugins/data/public/index.ts
@@ -438,6 +438,8 @@ export {
 
 export { isTimeRange, isQuery, isFilter, isFilters } from '../common';
 
+export { ApplyGlobalFilterActionContext } from './actions';
+
 export * from '../common/field_mapping';
 
 /*
diff --git a/src/plugins/data/public/plugin.ts b/src/plugins/data/public/plugin.ts
index 323a32ea362ac..68c0f506f121d 100644
--- a/src/plugins/data/public/plugin.ts
+++ b/src/plugins/data/public/plugin.ts
@@ -69,18 +69,15 @@ import {
   createFilterAction,
   createFiltersFromValueClickAction,
   createFiltersFromRangeSelectAction,
-} from './actions';
-import { ApplyGlobalFilterActionContext } from './actions/apply_filter_action';
-import {
-  selectRangeAction,
-  SelectRangeActionContext,
+  ApplyGlobalFilterActionContext,
   ACTION_SELECT_RANGE,
-} from './actions/select_range_action';
-import {
-  valueClickAction,
   ACTION_VALUE_CLICK,
+  SelectRangeActionContext,
   ValueClickActionContext,
-} from './actions/value_click_action';
+  createValueClickAction,
+  createSelectRangeAction,
+} from './actions';
+
 import { SavedObjectsClientPublicToCommon } from './index_patterns';
 import { indexPatternLoad } from './index_patterns/expressions/load_index_pattern';
 
@@ -92,7 +89,14 @@ declare module '../../ui_actions/public' {
   }
 }
 
-export class DataPublicPlugin implements Plugin<DataPublicPluginSetup, DataPublicPluginStart> {
+export class DataPublicPlugin
+  implements
+    Plugin<
+      DataPublicPluginSetup,
+      DataPublicPluginStart,
+      DataSetupDependencies,
+      DataStartDependencies
+    > {
   private readonly autocomplete: AutocompleteService;
   private readonly searchService: SearchService;
   private readonly fieldFormatsService: FieldFormatsService;
@@ -110,13 +114,13 @@ export class DataPublicPlugin implements Plugin<DataPublicPluginSetup, DataPubli
   }
 
   public setup(
-    core: CoreSetup,
+    core: CoreSetup<DataStartDependencies, DataPublicPluginStart>,
     { expressions, uiActions, usageCollection }: DataSetupDependencies
   ): DataPublicPluginSetup {
     const startServices = createStartServicesGetter(core.getStartServices);
 
     const getInternalStartServices = (): InternalStartServices => {
-      const { core: coreStart, self }: any = startServices();
+      const { core: coreStart, self } = startServices();
       return {
         fieldFormats: self.fieldFormats,
         notifications: coreStart.notifications,
@@ -140,12 +144,16 @@ export class DataPublicPlugin implements Plugin<DataPublicPluginSetup, DataPubli
 
     uiActions.addTriggerAction(
       SELECT_RANGE_TRIGGER,
-      selectRangeAction(queryService.filterManager, queryService.timefilter.timefilter)
+      createSelectRangeAction(() => ({
+        uiActions: startServices().plugins.uiActions,
+      }))
     );
 
     uiActions.addTriggerAction(
       VALUE_CLICK_TRIGGER,
-      valueClickAction(queryService.filterManager, queryService.timefilter.timefilter)
+      createValueClickAction(() => ({
+        uiActions: startServices().plugins.uiActions,
+      }))
     );
 
     return {
diff --git a/src/plugins/data/public/public.api.md b/src/plugins/data/public/public.api.md
index f8b8cb43b2297..38e0416233e25 100644
--- a/src/plugins/data/public/public.api.md
+++ b/src/plugins/data/public/public.api.md
@@ -250,6 +250,20 @@ export class AggParamType<TAggConfig extends IAggConfig = IAggConfig> extends Ba
     makeAgg: (agg: TAggConfig, state?: AggConfigSerialized) => TAggConfig;
 }
 
+// Warning: (ae-missing-release-tag) "ApplyGlobalFilterActionContext" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
+//
+// @public (undocumented)
+export interface ApplyGlobalFilterActionContext {
+    // Warning: (ae-forgotten-export) The symbol "IEmbeddable" needs to be exported by the entry point index.d.ts
+    //
+    // (undocumented)
+    embeddable?: IEmbeddable;
+    // (undocumented)
+    filters: Filter[];
+    // (undocumented)
+    timeFieldName?: string;
+}
+
 // Warning: (ae-forgotten-export) The symbol "DateNanosFormat" needs to be exported by the entry point index.d.ts
 // Warning: (ae-forgotten-export) The symbol "DateFormat" needs to be exported by the entry point index.d.ts
 // Warning: (ae-missing-release-tag) "baseFormattersPublic" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
@@ -1443,18 +1457,16 @@ export type PhrasesFilter = Filter & {
     meta: PhrasesFilterMeta;
 };
 
+// Warning: (ae-forgotten-export) The symbol "DataSetupDependencies" needs to be exported by the entry point index.d.ts
+// Warning: (ae-forgotten-export) The symbol "DataStartDependencies" needs to be exported by the entry point index.d.ts
 // Warning: (ae-missing-release-tag) "DataPublicPlugin" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
-export class Plugin implements Plugin_2<DataPublicPluginSetup, DataPublicPluginStart> {
+export class Plugin implements Plugin_2<DataPublicPluginSetup, DataPublicPluginStart, DataSetupDependencies, DataStartDependencies> {
     // Warning: (ae-forgotten-export) The symbol "ConfigSchema" needs to be exported by the entry point index.d.ts
     constructor(initializerContext: PluginInitializerContext_2<ConfigSchema>);
-    // Warning: (ae-forgotten-export) The symbol "DataSetupDependencies" needs to be exported by the entry point index.d.ts
-    //
     // (undocumented)
-    setup(core: CoreSetup, { expressions, uiActions, usageCollection }: DataSetupDependencies): DataPublicPluginSetup;
-    // Warning: (ae-forgotten-export) The symbol "DataStartDependencies" needs to be exported by the entry point index.d.ts
-    //
+    setup(core: CoreSetup<DataStartDependencies, DataPublicPluginStart>, { expressions, uiActions, usageCollection }: DataSetupDependencies): DataPublicPluginSetup;
     // (undocumented)
     start(core: CoreStart_2, { uiActions }: DataStartDependencies): DataPublicPluginStart;
     // (undocumented)
diff --git a/src/plugins/dev_tools/public/plugin.ts b/src/plugins/dev_tools/public/plugin.ts
index 3ee44aaa0816e..45fa3634bc87e 100644
--- a/src/plugins/dev_tools/public/plugin.ts
+++ b/src/plugins/dev_tools/public/plugin.ts
@@ -61,7 +61,7 @@ export class DevToolsPlugin implements Plugin<DevToolsSetup, void> {
       }),
       updater$: this.appStateUpdater,
       euiIconType: 'devToolsApp',
-      order: 9001,
+      order: 9010,
       category: DEFAULT_APP_CATEGORIES.management,
       mount: async (params: AppMountParameters) => {
         const { element, history } = params;
diff --git a/src/plugins/discover/public/application/components/sidebar/discover_field.tsx b/src/plugins/discover/public/application/components/sidebar/discover_field.tsx
index 5f40c55e30e7e..724908281146d 100644
--- a/src/plugins/discover/public/application/components/sidebar/discover_field.tsx
+++ b/src/plugins/discover/public/application/components/sidebar/discover_field.tsx
@@ -17,7 +17,7 @@
  * under the License.
  */
 import React from 'react';
-import { EuiButton, EuiText } from '@elastic/eui';
+import { EuiButton } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { DiscoverFieldDetails } from './discover_field_details';
 import { FieldIcon } from '../../../../../kibana_react/public';
@@ -108,6 +108,13 @@ export function DiscoverField({
     }
   };
 
+  function wrapOnDot(str?: string) {
+    // u200B is a non-width white-space character, which allows
+    // the browser to efficiently word-wrap right after the dot
+    // without us having to draw a lot of extra DOM elements, etc
+    return str ? str.replace(/\./g, '.\u200B') : '';
+  }
+
   return (
     <>
       <div
@@ -124,15 +131,12 @@ export function DiscoverField({
             scripted={field.scripted}
           />
         </span>
-        <span className="dscSidebarField__name eui-textTruncate">
-          <EuiText
-            size="xs"
-            data-test-subj={`field-${field.name}`}
-            className="eui-textTruncate"
-            title={field.name}
-          >
-            {useShortDots ? shortenDottedString(field.name) : field.displayName}
-          </EuiText>
+        <span
+          data-test-subj={`field-${field.name}`}
+          title={field.name}
+          className="dscSidebarField__name"
+        >
+          {useShortDots ? wrapOnDot(shortenDottedString(field.name)) : wrapOnDot(field.displayName)}
         </span>
         <span>
           {field.name !== '_source' && !selected && (
diff --git a/src/plugins/discover/public/application/components/sidebar/discover_sidebar.scss b/src/plugins/discover/public/application/components/sidebar/discover_sidebar.scss
index ae7e915f09773..07efd64752c84 100644
--- a/src/plugins/discover/public/application/components/sidebar/discover_sidebar.scss
+++ b/src/plugins/discover/public/application/components/sidebar/discover_sidebar.scss
@@ -23,13 +23,6 @@
   margin-bottom: 0;
 }
 
-.dscFieldList--selected,
-.dscFieldList--unpopular,
-.dscFieldList--popular {
-  padding-left: $euiSizeS;
-  padding-right: $euiSizeS;
-}
-
 .dscFieldListHeader {
   padding: $euiSizeS $euiSizeS 0 $euiSizeS;
   background-color: lightOrDarkTheme(tint($euiColorPrimary, 90%), $euiColorLightShade);
@@ -40,8 +33,7 @@
 }
 
 .dscFieldChooser {
-  padding-left: $euiSizeS !important;
-  padding-right: $euiSizeS !important;
+  padding-left: $euiSize;
 }
 
 .dscFieldChooser__toggle {
@@ -55,12 +47,12 @@
   display: flex;
   align-items: center;
   justify-content: space-between;
-  padding: 0 2px;
   cursor: pointer;
   font-size: $euiFontSizeXS;
   border-top: solid 1px transparent;
   border-bottom: solid 1px transparent;
   line-height: normal;
+  margin-bottom: $euiSizeXS * 0.5;
 
   &:hover,
   &:focus {
@@ -72,28 +64,25 @@
 
 .dscSidebarItem--active {
   border-top: 1px solid $euiColorLightShade;
-  background: shade($euiColorLightestShade, 5%);
   color: $euiColorFullShade;
-  .euiText {
-    font-weight: bold;
-  }
 }
 
 .dscSidebarField {
-  padding: $euiSizeXS 0;
+  padding: $euiSizeXS;
   display: flex;
-  align-items: flex-start;
+  align-items: center;
   max-width: 100%;
-  margin: 0;
   width: 100%;
   border: none;
-  border-radius: 0;
+  border-radius: $euiBorderRadius - 1px;
   text-align: left;
 }
 
 .dscSidebarField__name {
   margin-left: $euiSizeS;
   flex-grow: 1;
+  word-break: break-word;
+  padding-right: 1px;
 }
 
 .dscSidebarField__fieldIcon {
diff --git a/src/plugins/discover/public/application/components/sidebar/discover_sidebar.tsx b/src/plugins/discover/public/application/components/sidebar/discover_sidebar.tsx
index 96e04c13d70e9..e8ed8b80da3bb 100644
--- a/src/plugins/discover/public/application/components/sidebar/discover_sidebar.tsx
+++ b/src/plugins/discover/public/application/components/sidebar/discover_sidebar.tsx
@@ -19,7 +19,7 @@
 import './discover_sidebar.scss';
 import React, { useCallback, useEffect, useState, useMemo } from 'react';
 import { i18n } from '@kbn/i18n';
-import { EuiButtonIcon, EuiTitle } from '@elastic/eui';
+import { EuiButtonIcon, EuiTitle, EuiSpacer } from '@elastic/eui';
 import { sortBy } from 'lodash';
 import { FormattedMessage, I18nProvider } from '@kbn/i18n/react';
 import { DiscoverField } from './discover_field';
@@ -199,6 +199,7 @@ export function DiscoverSidebar({
                   />
                 </h3>
               </EuiTitle>
+              <EuiSpacer size="xs" />
               <ul
                 className="dscSidebarList dscFieldList--selected"
                 aria-labelledby="selected_fields"
diff --git a/src/plugins/embeddable/public/lib/panel/embeddable_panel.tsx b/src/plugins/embeddable/public/lib/panel/embeddable_panel.tsx
index 8cf2e015f88cf..cb02ffc470e95 100644
--- a/src/plugins/embeddable/public/lib/panel/embeddable_panel.tsx
+++ b/src/plugins/embeddable/public/lib/panel/embeddable_panel.tsx
@@ -311,8 +311,7 @@ export class EmbeddablePanel extends React.Component<Props, State> {
     const sortedActions = [...regularActions, ...extraActions].sort(sortByOrderField);
 
     return await buildContextMenuForActions({
-      actions: sortedActions,
-      actionContext: { embeddable: this.props.embeddable },
+      actions: sortedActions.map((action) => [action, { embeddable: this.props.embeddable }]),
       closeMenu: this.closeMyContextMenuPanel,
     });
   };
diff --git a/src/plugins/es_ui_shared/public/forms/multi_content/multi_content_context.tsx b/src/plugins/es_ui_shared/public/forms/multi_content/multi_content_context.tsx
index 210b0cedccd06..c5659745f229a 100644
--- a/src/plugins/es_ui_shared/public/forms/multi_content/multi_content_context.tsx
+++ b/src/plugins/es_ui_shared/public/forms/multi_content/multi_content_context.tsx
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import React, { useEffect, useCallback, createContext, useContext } from 'react';
+import React, { useEffect, useCallback, createContext, useContext, useRef } from 'react';
 
 import { useMultiContent, HookProps, Content, MultiContent } from './use_multi_content';
 
@@ -55,7 +55,14 @@ export function useMultiContentContext<T extends object = { [key: string]: any }
  * @param contentId The content id to be added to the "contents" map
  */
 export function useContent<T extends object, K extends keyof T>(contentId: K) {
-  const { updateContentAt, saveSnapshotAndRemoveContent, getData } = useMultiContentContext<T>();
+  const isMounted = useRef(false);
+  const defaultValue = useRef<T[K] | undefined>(undefined);
+  const {
+    updateContentAt,
+    saveSnapshotAndRemoveContent,
+    getData,
+    getSingleContentData,
+  } = useMultiContentContext<T>();
 
   const updateContent = useCallback(
     (content: Content) => {
@@ -71,12 +78,22 @@ export function useContent<T extends object, K extends keyof T>(contentId: K) {
     };
   }, [contentId, saveSnapshotAndRemoveContent]);
 
-  const data = getData();
-  const defaultValue = data[contentId];
+  useEffect(() => {
+    if (isMounted.current === false) {
+      isMounted.current = true;
+    }
+  }, []);
+
+  if (isMounted.current === false) {
+    // Only read the default value once, on component mount to avoid re-rendering the
+    // consumer each time the multi-content validity ("isValid") changes.
+    defaultValue.current = getSingleContentData(contentId);
+  }
 
   return {
-    defaultValue,
+    defaultValue: defaultValue.current!,
     updateContent,
     getData,
+    getSingleContentData,
   };
 }
diff --git a/src/plugins/es_ui_shared/public/forms/multi_content/use_multi_content.ts b/src/plugins/es_ui_shared/public/forms/multi_content/use_multi_content.ts
index adc68a39a4a5b..8d470f6454b0e 100644
--- a/src/plugins/es_ui_shared/public/forms/multi_content/use_multi_content.ts
+++ b/src/plugins/es_ui_shared/public/forms/multi_content/use_multi_content.ts
@@ -45,6 +45,7 @@ export interface MultiContent<T extends object> {
   updateContentAt: (id: keyof T, content: Content) => void;
   saveSnapshotAndRemoveContent: (id: keyof T) => void;
   getData: () => T;
+  getSingleContentData: <K extends keyof T>(contentId: K) => T[K];
   validate: () => Promise<boolean>;
   validation: Validation<T>;
 }
@@ -109,9 +110,22 @@ export function useMultiContent<T extends object>({
     };
   }, [stateData, validation]);
 
+  /**
+   * Read a single content data.
+   */
+  const getSingleContentData = useCallback(
+    <K extends keyof T>(contentId: K): T[K] => {
+      if (contents.current[contentId]) {
+        return contents.current[contentId].getData();
+      }
+      return stateData[contentId];
+    },
+    [stateData]
+  );
+
   const updateContentValidity = useCallback(
     (updatedData: { [key in keyof T]?: boolean | undefined }): boolean | undefined => {
-      let allContentValidity: boolean | undefined;
+      let isAllContentValid: boolean | undefined = validation.isValid;
 
       setValidation((prev) => {
         if (
@@ -120,7 +134,7 @@ export function useMultiContent<T extends object>({
           )
         ) {
           // No change in validation, nothing to update
-          allContentValidity = prev.isValid;
+          isAllContentValid = prev.isValid;
           return prev;
         }
 
@@ -129,21 +143,21 @@ export function useMultiContent<T extends object>({
           ...updatedData,
         };
 
-        allContentValidity = Object.values(nextContentsValidityState).some(
+        isAllContentValid = Object.values(nextContentsValidityState).some(
           (_isValid) => _isValid === undefined
         )
           ? undefined
           : Object.values(nextContentsValidityState).every(Boolean);
 
         return {
-          isValid: allContentValidity,
+          isValid: isAllContentValid,
           contents: nextContentsValidityState,
         };
       });
 
-      return allContentValidity;
+      return isAllContentValid;
     },
-    []
+    [validation.isValid]
   );
 
   /**
@@ -163,7 +177,7 @@ export function useMultiContent<T extends object>({
     }
 
     return Boolean(updateContentValidity(updatedValidation));
-  }, [updateContentValidity]);
+  }, [validation.isValid, updateContentValidity]);
 
   /**
    * Update a content. It replaces the content in our "contents" map and update
@@ -186,7 +200,7 @@ export function useMultiContent<T extends object>({
         });
       }
     },
-    [updateContentValidity, onChange]
+    [updateContentValidity, onChange, getData, validate]
   );
 
   /**
@@ -211,6 +225,7 @@ export function useMultiContent<T extends object>({
 
   return {
     getData,
+    getSingleContentData,
     validate,
     validation,
     updateContentAt,
diff --git a/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/form_data_provider.ts b/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/form_data_provider.ts
index 4c4a7f0642022..4c8e91b13b1b7 100644
--- a/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/form_data_provider.ts
+++ b/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/form_data_provider.ts
@@ -29,6 +29,7 @@ interface Props {
 
 export const FormDataProvider = React.memo(({ children, pathsToWatch }: Props) => {
   const form = useFormContext();
+  const { subscribe } = form;
   const previousRawData = useRef<FormData>(form.__getFormData$().value);
   const [formData, setFormData] = useState<FormData>(previousRawData.current);
 
@@ -54,9 +55,9 @@ export const FormDataProvider = React.memo(({ children, pathsToWatch }: Props) =
   );
 
   useEffect(() => {
-    const subscription = form.subscribe(onFormData);
+    const subscription = subscribe(onFormData);
     return subscription.unsubscribe;
-  }, [form.subscribe, onFormData]);
+  }, [subscribe, onFormData]);
 
   return children(formData);
 });
diff --git a/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_array.ts b/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_array.ts
index 1605c09f575f6..3688421964d2e 100644
--- a/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_array.ts
+++ b/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_array.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import { useState, useEffect, useRef } from 'react';
+import { useState, useEffect, useRef, useCallback } from 'react';
 
 import { useFormContext } from '../form_context';
 
@@ -83,14 +83,18 @@ export const UseArray = ({
 
   const [items, setItems] = useState<ArrayItem[]>(initialState);
 
-  const updatePaths = (_rows: ArrayItem[]) =>
-    _rows.map(
-      (row, index) =>
-        ({
-          ...row,
-          path: `${path}[${index}]`,
-        } as ArrayItem)
-    );
+  const updatePaths = useCallback(
+    (_rows: ArrayItem[]) => {
+      return _rows.map(
+        (row, index) =>
+          ({
+            ...row,
+            path: `${path}[${index}]`,
+          } as ArrayItem)
+      );
+    },
+    [path]
+  );
 
   const addItem = () => {
     setItems((previousItems) => {
@@ -108,11 +112,13 @@ export const UseArray = ({
 
   useEffect(() => {
     if (didMountRef.current) {
-      setItems(updatePaths(items));
+      setItems((prev) => {
+        return updatePaths(prev);
+      });
     } else {
       didMountRef.current = true;
     }
-  }, [path]);
+  }, [path, updatePaths]);
 
   return children({ items, addItem, removeItem });
 };
diff --git a/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_field.test.tsx b/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_field.test.tsx
index 7ad32cb0bc3f0..f00beb470a9fc 100644
--- a/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_field.test.tsx
+++ b/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_field.test.tsx
@@ -30,8 +30,9 @@ describe('<UseField />', () => {
 
     const TestComp = ({ onData }: { onData: OnUpdateHandler }) => {
       const { form } = useForm();
+      const { subscribe } = form;
 
-      useEffect(() => form.subscribe(onData).unsubscribe, [form]);
+      useEffect(() => subscribe(onData).unsubscribe, [subscribe, onData]);
 
       return (
         <Form form={form}>
diff --git a/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_field.ts b/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_field.ts
index b83006c6cec52..b2f00610a3d33 100644
--- a/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_field.ts
+++ b/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_field.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import { useState, useEffect, useRef, useMemo } from 'react';
+import { useMemo, useState, useEffect, useRef, useCallback } from 'react';
 
 import { FormHook, FieldHook, FieldConfig, FieldValidateResponse, ValidationError } from '../types';
 import { FIELD_TYPES, VALIDATION_TYPES } from '../constants';
@@ -34,21 +34,21 @@ export const useField = <T>(
     label = '',
     labelAppend = '',
     helpText = '',
-    validations = [],
-    formatters = [],
-    fieldsToValidateOnChange = [path],
+    validations,
+    formatters,
+    fieldsToValidateOnChange,
     errorDisplayDelay = form.__options.errorDisplayDelay,
-    serializer = (value: unknown) => value,
-    deserializer = (value: unknown) => value,
+    serializer,
+    deserializer,
   } = config;
+  const { getFormData, __removeField, __updateFormDataAt, __validateFields } = form;
 
-  const initialValue = useMemo(
-    () =>
-      typeof defaultValue === 'function'
-        ? deserializer(defaultValue())
-        : deserializer(defaultValue),
-    [defaultValue]
-  ) as T;
+  const initialValue = useMemo(() => {
+    if (typeof defaultValue === 'function') {
+      return deserializer ? deserializer(defaultValue()) : defaultValue();
+    }
+    return deserializer ? deserializer(defaultValue) : defaultValue;
+  }, [defaultValue, deserializer]) as T;
 
   const [value, setStateValue] = useState<T>(initialValue);
   const [errors, setErrors] = useState<ValidationError[]>([]);
@@ -64,6 +64,12 @@ export const useField = <T>(
 
   // -- HELPERS
   // ----------------------------------
+  const serializeOutput: FieldHook<T>['__serializeOutput'] = useCallback(
+    (rawValue = value) => {
+      return serializer ? serializer(rawValue) : rawValue;
+    },
+    [serializer, value]
+  );
 
   /**
    * Filter an array of errors with specific validation type on them
@@ -84,19 +90,22 @@ export const useField = <T>(
     );
   };
 
-  const formatInputValue = <T>(inputValue: unknown): T => {
-    const isEmptyString = typeof inputValue === 'string' && inputValue.trim() === '';
+  const formatInputValue = useCallback(
+    <T>(inputValue: unknown): T => {
+      const isEmptyString = typeof inputValue === 'string' && inputValue.trim() === '';
 
-    if (isEmptyString) {
-      return inputValue as T;
-    }
+      if (isEmptyString || !formatters) {
+        return inputValue as T;
+      }
 
-    const formData = form.getFormData({ unflatten: false });
+      const formData = getFormData({ unflatten: false });
 
-    return formatters.reduce((output, formatter) => formatter(output, formData), inputValue) as T;
-  };
+      return formatters.reduce((output, formatter) => formatter(output, formData), inputValue) as T;
+    },
+    [formatters, getFormData]
+  );
 
-  const onValueChange = async () => {
+  const onValueChange = useCallback(async () => {
     const changeIteration = ++changeCounter.current;
     const startTime = Date.now();
 
@@ -116,10 +125,10 @@ export const useField = <T>(
     }
 
     // Update the form data observable
-    form.__updateFormDataAt(path, newValue);
+    __updateFormDataAt(path, newValue);
 
-    // Validate field(s) and set form.isValid flag
-    await form.__validateFields(fieldsToValidateOnChange);
+    // Validate field(s) and update form.isValid state
+    await __validateFields(fieldsToValidateOnChange ?? [path]);
 
     if (isUnmounted.current) {
       return;
@@ -142,9 +151,18 @@ export const useField = <T>(
         setIsChangingValue(false);
       }
     }
-  };
+  }, [
+    serializeOutput,
+    valueChangeListener,
+    errorDisplayDelay,
+    path,
+    value,
+    fieldsToValidateOnChange,
+    __updateFormDataAt,
+    __validateFields,
+  ]);
 
-  const cancelInflightValidation = () => {
+  const cancelInflightValidation = useCallback(() => {
     // Cancel any inflight validation (like an HTTP Request)
     if (
       inflightValidation.current &&
@@ -153,209 +171,232 @@ export const useField = <T>(
       (inflightValidation.current as any).cancel();
       inflightValidation.current = null;
     }
-  };
+  }, []);
 
-  const runValidations = ({
-    formData,
-    value: valueToValidate,
-    validationTypeToValidate,
-  }: {
-    formData: any;
-    value: unknown;
-    validationTypeToValidate?: string;
-  }): ValidationError[] | Promise<ValidationError[]> => {
-    // By default, for fields that have an asynchronous validation
-    // we will clear the errors as soon as the field value changes.
-    clearErrors([VALIDATION_TYPES.FIELD, VALIDATION_TYPES.ASYNC]);
-
-    cancelInflightValidation();
-
-    const runAsync = async () => {
-      const validationErrors: ValidationError[] = [];
-
-      for (const validation of validations) {
-        inflightValidation.current = null;
-
-        const {
-          validator,
-          exitOnFail = true,
-          type: validationType = VALIDATION_TYPES.FIELD,
-        } = validation;
-
-        if (
-          typeof validationTypeToValidate !== 'undefined' &&
-          validationType !== validationTypeToValidate
-        ) {
-          continue;
-        }
-
-        inflightValidation.current = validator({
-          value: (valueToValidate as unknown) as string,
-          errors: validationErrors,
-          form,
-          formData,
-          path,
-        }) as Promise<ValidationError>;
-
-        const validationResult = await inflightValidation.current;
-
-        if (!validationResult) {
-          continue;
-        }
-
-        validationErrors.push({
-          ...validationResult,
-          validationType: validationType || VALIDATION_TYPES.FIELD,
-        });
+  const clearErrors: FieldHook['clearErrors'] = useCallback(
+    (validationType = VALIDATION_TYPES.FIELD) => {
+      setErrors((previousErrors) => filterErrors(previousErrors, validationType));
+    },
+    []
+  );
 
-        if (exitOnFail) {
-          break;
-        }
+  const runValidations = useCallback(
+    ({
+      formData,
+      value: valueToValidate,
+      validationTypeToValidate,
+    }: {
+      formData: any;
+      value: unknown;
+      validationTypeToValidate?: string;
+    }): ValidationError[] | Promise<ValidationError[]> => {
+      if (!validations) {
+        return [];
       }
 
-      return validationErrors;
-    };
-
-    const runSync = () => {
-      const validationErrors: ValidationError[] = [];
-      // Sequentially execute all the validations for the field
-      for (const validation of validations) {
-        const {
-          validator,
-          exitOnFail = true,
-          type: validationType = VALIDATION_TYPES.FIELD,
-        } = validation;
-
-        if (
-          typeof validationTypeToValidate !== 'undefined' &&
-          validationType !== validationTypeToValidate
-        ) {
-          continue;
-        }
-
-        const validationResult = validator({
-          value: (valueToValidate as unknown) as string,
-          errors: validationErrors,
-          form,
-          formData,
-          path,
-        });
-
-        if (!validationResult) {
-          continue;
+      // By default, for fields that have an asynchronous validation
+      // we will clear the errors as soon as the field value changes.
+      clearErrors([VALIDATION_TYPES.FIELD, VALIDATION_TYPES.ASYNC]);
+
+      cancelInflightValidation();
+
+      const runAsync = async () => {
+        const validationErrors: ValidationError[] = [];
+
+        for (const validation of validations) {
+          inflightValidation.current = null;
+
+          const {
+            validator,
+            exitOnFail = true,
+            type: validationType = VALIDATION_TYPES.FIELD,
+          } = validation;
+
+          if (
+            typeof validationTypeToValidate !== 'undefined' &&
+            validationType !== validationTypeToValidate
+          ) {
+            continue;
+          }
+
+          inflightValidation.current = validator({
+            value: (valueToValidate as unknown) as string,
+            errors: validationErrors,
+            form,
+            formData,
+            path,
+          }) as Promise<ValidationError>;
+
+          const validationResult = await inflightValidation.current;
+
+          if (!validationResult) {
+            continue;
+          }
+
+          validationErrors.push({
+            ...validationResult,
+            validationType: validationType || VALIDATION_TYPES.FIELD,
+          });
+
+          if (exitOnFail) {
+            break;
+          }
         }
 
-        if (!!validationResult.then) {
-          // The validator returned a Promise: abort and run the validations asynchronously
-          // We keep a reference to the onflith promise so we can cancel it.
-
-          inflightValidation.current = validationResult as Promise<ValidationError>;
-          cancelInflightValidation();
-
-          return runAsync();
-        }
-
-        validationErrors.push({
-          ...(validationResult as ValidationError),
-          validationType: validationType || VALIDATION_TYPES.FIELD,
-        });
+        return validationErrors;
+      };
 
-        if (exitOnFail) {
-          break;
+      const runSync = () => {
+        const validationErrors: ValidationError[] = [];
+        // Sequentially execute all the validations for the field
+        for (const validation of validations) {
+          const {
+            validator,
+            exitOnFail = true,
+            type: validationType = VALIDATION_TYPES.FIELD,
+          } = validation;
+
+          if (
+            typeof validationTypeToValidate !== 'undefined' &&
+            validationType !== validationTypeToValidate
+          ) {
+            continue;
+          }
+
+          const validationResult = validator({
+            value: (valueToValidate as unknown) as string,
+            errors: validationErrors,
+            form,
+            formData,
+            path,
+          });
+
+          if (!validationResult) {
+            continue;
+          }
+
+          if (!!validationResult.then) {
+            // The validator returned a Promise: abort and run the validations asynchronously
+            // We keep a reference to the onflith promise so we can cancel it.
+
+            inflightValidation.current = validationResult as Promise<ValidationError>;
+            cancelInflightValidation();
+
+            return runAsync();
+          }
+
+          validationErrors.push({
+            ...(validationResult as ValidationError),
+            validationType: validationType || VALIDATION_TYPES.FIELD,
+          });
+
+          if (exitOnFail) {
+            break;
+          }
         }
-      }
 
-      return validationErrors;
-    };
+        return validationErrors;
+      };
 
-    // We first try to run the validations synchronously
-    return runSync();
-  };
+      // We first try to run the validations synchronously
+      return runSync();
+    },
+    [clearErrors, cancelInflightValidation, validations, form, path]
+  );
 
   // -- API
   // ----------------------------------
-  const clearErrors: FieldHook['clearErrors'] = (validationType = VALIDATION_TYPES.FIELD) => {
-    setErrors((previousErrors) => filterErrors(previousErrors, validationType));
-  };
 
   /**
    * Validate a form field, running all its validations.
    * If a validationType is provided then only that validation will be executed,
    * skipping the other type of validation that might exist.
    */
-  const validate: FieldHook<T>['validate'] = (validationData = {}) => {
-    const {
-      formData = form.getFormData({ unflatten: false }),
-      value: valueToValidate = value,
-      validationType,
-    } = validationData;
-
-    setIsValidated(true);
-    setValidating(true);
-
-    // By the time our validate function has reached completion, it’s possible
-    // that validate() will have been called again. If this is the case, we need
-    // to ignore the results of this invocation and only use the results of
-    // the most recent invocation to update the error state for a field
-    const validateIteration = ++validateCounter.current;
-
-    const onValidationErrors = (_validationErrors: ValidationError[]): FieldValidateResponse => {
-      if (validateIteration === validateCounter.current) {
-        // This is the most recent invocation
-        setValidating(false);
-        // Update the errors array
-        const filteredErrors = filterErrors(errors, validationType);
-        setErrors([...filteredErrors, ..._validationErrors]);
-      }
+  const validate: FieldHook<T>['validate'] = useCallback(
+    (validationData = {}) => {
+      const {
+        formData = getFormData({ unflatten: false }),
+        value: valueToValidate = value,
+        validationType,
+      } = validationData;
+
+      setIsValidated(true);
+      setValidating(true);
+
+      // By the time our validate function has reached completion, it’s possible
+      // that validate() will have been called again. If this is the case, we need
+      // to ignore the results of this invocation and only use the results of
+      // the most recent invocation to update the error state for a field
+      const validateIteration = ++validateCounter.current;
+
+      const onValidationErrors = (_validationErrors: ValidationError[]): FieldValidateResponse => {
+        if (validateIteration === validateCounter.current) {
+          // This is the most recent invocation
+          setValidating(false);
+          // Update the errors array
+          setErrors((prev) => {
+            const filteredErrors = filterErrors(prev, validationType);
+            return [...filteredErrors, ..._validationErrors];
+          });
+        }
 
-      return {
-        isValid: _validationErrors.length === 0,
-        errors: _validationErrors,
+        return {
+          isValid: _validationErrors.length === 0,
+          errors: _validationErrors,
+        };
       };
-    };
 
-    const validationErrors = runValidations({
-      formData,
-      value: valueToValidate,
-      validationTypeToValidate: validationType,
-    });
+      const validationErrors = runValidations({
+        formData,
+        value: valueToValidate,
+        validationTypeToValidate: validationType,
+      });
 
-    if (Reflect.has(validationErrors, 'then')) {
-      return (validationErrors as Promise<ValidationError[]>).then(onValidationErrors);
-    }
-    return onValidationErrors(validationErrors as ValidationError[]);
-  };
+      if (Reflect.has(validationErrors, 'then')) {
+        return (validationErrors as Promise<ValidationError[]>).then(onValidationErrors);
+      }
+      return onValidationErrors(validationErrors as ValidationError[]);
+    },
+    [getFormData, value, runValidations]
+  );
 
   /**
    * Handler to change the field value
    *
    * @param newValue The new value to assign to the field
    */
-  const setValue: FieldHook<T>['setValue'] = (newValue) => {
-    if (isPristine) {
-      setPristine(false);
-    }
+  const setValue: FieldHook<T>['setValue'] = useCallback(
+    (newValue) => {
+      if (isPristine) {
+        setPristine(false);
+      }
 
-    const formattedValue = formatInputValue<T>(newValue);
-    setStateValue(formattedValue);
-  };
+      const formattedValue = formatInputValue<T>(newValue);
+      setStateValue(formattedValue);
+      return formattedValue;
+    },
+    [formatInputValue, isPristine]
+  );
 
-  const _setErrors: FieldHook<T>['setErrors'] = (_errors) => {
+  const _setErrors: FieldHook<T>['setErrors'] = useCallback((_errors) => {
     setErrors(_errors.map((error) => ({ validationType: VALIDATION_TYPES.FIELD, ...error })));
-  };
+  }, []);
 
   /**
    * Form <input /> "onChange" event handler
    *
    * @param event Form input change event
    */
-  const onChange: FieldHook<T>['onChange'] = (event) => {
-    const newValue = {}.hasOwnProperty.call(event!.target, 'checked')
-      ? event.target.checked
-      : event.target.value;
+  const onChange: FieldHook<T>['onChange'] = useCallback(
+    (event) => {
+      const newValue = {}.hasOwnProperty.call(event!.target, 'checked')
+        ? event.target.checked
+        : event.target.value;
 
-    setValue((newValue as unknown) as T);
-  };
+      setValue((newValue as unknown) as T);
+    },
+    [setValue]
+  );
 
   /**
    * As we can have multiple validation types (FIELD, ASYNC, ARRAY_ITEM), this
@@ -367,48 +408,50 @@ export const useField = <T>(
    *
    * @param validationType The validation type to return error messages from
    */
-  const getErrorsMessages: FieldHook<T>['getErrorsMessages'] = (args = {}) => {
-    const { errorCode, validationType = VALIDATION_TYPES.FIELD } = args;
-    const errorMessages = errors.reduce((messages, error) => {
-      const isSameErrorCode = errorCode && error.code === errorCode;
-      const isSamevalidationType =
-        error.validationType === validationType ||
-        (validationType === VALIDATION_TYPES.FIELD &&
-          !{}.hasOwnProperty.call(error, 'validationType'));
-
-      if (isSameErrorCode || (typeof errorCode === 'undefined' && isSamevalidationType)) {
-        return messages ? `${messages}, ${error.message}` : (error.message as string);
+  const getErrorsMessages: FieldHook<T>['getErrorsMessages'] = useCallback(
+    (args = {}) => {
+      const { errorCode, validationType = VALIDATION_TYPES.FIELD } = args;
+      const errorMessages = errors.reduce((messages, error) => {
+        const isSameErrorCode = errorCode && error.code === errorCode;
+        const isSamevalidationType =
+          error.validationType === validationType ||
+          (validationType === VALIDATION_TYPES.FIELD &&
+            !{}.hasOwnProperty.call(error, 'validationType'));
+
+        if (isSameErrorCode || (typeof errorCode === 'undefined' && isSamevalidationType)) {
+          return messages ? `${messages}, ${error.message}` : (error.message as string);
+        }
+        return messages;
+      }, '');
+
+      return errorMessages ? errorMessages : null;
+    },
+    [errors]
+  );
+
+  const reset: FieldHook<T>['reset'] = useCallback(
+    (resetOptions = { resetValue: true }) => {
+      const { resetValue = true } = resetOptions;
+
+      setPristine(true);
+      setValidating(false);
+      setIsChangingValue(false);
+      setIsValidated(false);
+      setErrors([]);
+
+      if (resetValue) {
+        setValue(initialValue);
+        /**
+         * Having to call serializeOutput() is a current bug of the lib and will be fixed
+         * in a future PR. The serializer function should only be called when outputting
+         * the form data. If we need to continuously format the data while it changes,
+         * we need to use the field `formatter` config.
+         */
+        return serializeOutput(initialValue);
       }
-      return messages;
-    }, '');
-
-    return errorMessages ? errorMessages : null;
-  };
-
-  const reset: FieldHook<T>['reset'] = (resetOptions = { resetValue: true }) => {
-    const { resetValue = true } = resetOptions;
-
-    setPristine(true);
-    setValidating(false);
-    setIsChangingValue(false);
-    setIsValidated(false);
-    setErrors([]);
-
-    if (resetValue) {
-      setValue(initialValue);
-      /**
-       * Having to call serializeOutput() is a current bug of the lib and will be fixed
-       * in a future PR. The serializer function should only be called when outputting
-       * the form data. If we need to continuously format the data while it changes,
-       * we need to use the field `formatter` config.
-       */
-      return serializeOutput(initialValue);
-    }
-    return value;
-  };
-
-  const serializeOutput: FieldHook<T>['__serializeOutput'] = (rawValue = value) =>
-    serializer(rawValue);
+    },
+    [setValue, serializeOutput, initialValue]
+  );
 
   // -- EFFECTS
   // ----------------------------------
@@ -425,54 +468,64 @@ export const useField = <T>(
         clearTimeout(debounceTimeout.current);
       }
     };
-  }, [value]);
-
-  const field: FieldHook<T> = {
+  }, [isPristine, onValueChange]);
+
+  const field: FieldHook<T> = useMemo(() => {
+    return {
+      path,
+      type,
+      label,
+      labelAppend,
+      helpText,
+      value,
+      errors,
+      form,
+      isPristine,
+      isValid: errors.length === 0,
+      isValidating,
+      isValidated,
+      isChangingValue,
+      onChange,
+      getErrorsMessages,
+      setValue,
+      setErrors: _setErrors,
+      clearErrors,
+      validate,
+      reset,
+      __serializeOutput: serializeOutput,
+    };
+  }, [
     path,
     type,
     label,
     labelAppend,
     helpText,
     value,
-    errors,
     form,
     isPristine,
-    isValid: errors.length === 0,
+    errors,
     isValidating,
     isValidated,
     isChangingValue,
     onChange,
     getErrorsMessages,
     setValue,
-    setErrors: _setErrors,
+    _setErrors,
     clearErrors,
     validate,
     reset,
-    __serializeOutput: serializeOutput,
-  };
+    serializeOutput,
+  ]);
 
-  form.__addField(field as FieldHook<any>); // Executed first (1)
+  form.__addField(field as FieldHook<any>);
 
   useEffect(() => {
-    /**
-     * NOTE: effect cleanup actually happens *after* the new component has been mounted,
-     * but before the next effect callback is run.
-     * Ref: https://kentcdodds.com/blog/understanding-reacts-key-prop
-     *
-     * This means that, the "form.__addField(field)" outside the effect will be called *before*
-     * the cleanup `form.__removeField(path);` creating a race condition.
-     *
-     * TODO: See how we could refactor "use_field" & "use_form" to avoid having the
-     * `form.__addField(field)` call outside the effect.
-     */
-    form.__addField(field as FieldHook<any>); // Executed third (3)
-
     return () => {
       // Remove field from the form when it is unmounted or if its path changes.
       isUnmounted.current = true;
-      form.__removeField(path); // Executed second (2)
+      __removeField(path);
     };
-  }, [path]);
+  }, [path, __removeField]);
 
   return field;
 };
diff --git a/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form.test.tsx b/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form.test.tsx
index f332d2e6ea604..216c7974a9679 100644
--- a/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form.test.tsx
+++ b/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form.test.tsx
@@ -135,12 +135,13 @@ describe('use_form() hook', () => {
     test('should allow subscribing to the form data changes and provide a handler to build the form data', async () => {
       const TestComp = ({ onData }: { onData: OnUpdateHandler }) => {
         const { form } = useForm();
+        const { subscribe } = form;
 
         useEffect(() => {
           // Any time the form value changes, forward the data to the consumer
-          const subscription = form.subscribe(onData);
+          const subscription = subscribe(onData);
           return subscription.unsubscribe;
-        }, [form]);
+        }, [subscribe, onData]);
 
         return (
           <Form form={form}>
@@ -200,8 +201,9 @@ describe('use_form() hook', () => {
 
       const TestComp = ({ onData }: { onData: OnUpdateHandler }) => {
         const { form } = useForm({ defaultValue });
+        const { subscribe } = form;
 
-        useEffect(() => form.subscribe(onData).unsubscribe, [form]);
+        useEffect(() => subscribe(onData).unsubscribe, [subscribe, onData]);
 
         return (
           <Form form={form}>
diff --git a/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form.ts b/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form.ts
index f9286d99cbf80..46b8958491e56 100644
--- a/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form.ts
+++ b/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import { useState, useRef, useEffect, useMemo } from 'react';
+import { useState, useRef, useEffect, useMemo, useCallback } from 'react';
 import { get } from 'lodash';
 
 import { FormHook, FieldHook, FormData, FieldConfig, FieldsMap, FormConfig } from '../types';
@@ -34,28 +34,34 @@ interface UseFormReturn<T extends FormData> {
 }
 
 export function useForm<T extends FormData = FormData>(
-  formConfig: FormConfig<T> | undefined = {}
+  formConfig?: FormConfig<T>
 ): UseFormReturn<T> {
-  const {
-    onSubmit,
-    schema,
-    serializer = <T>(data: T): T => data,
-    deserializer = <T>(data: T): T => data,
-    options = {},
-    id = 'default',
-  } = formConfig;
-
-  const formDefaultValue =
-    formConfig.defaultValue === undefined || Object.keys(formConfig.defaultValue).length === 0
-      ? {}
-      : Object.entries(formConfig.defaultValue as object)
-          .filter(({ 1: value }) => value !== undefined)
-          .reduce((acc, [key, value]) => ({ ...acc, [key]: value }), {});
-
-  const formOptions = { ...DEFAULT_OPTIONS, ...options };
-  const defaultValueDeserialized = useMemo(() => deserializer(formDefaultValue), [
-    formConfig.defaultValue,
-  ]);
+  const { onSubmit, schema, serializer, deserializer, options, id = 'default', defaultValue } =
+    formConfig ?? {};
+
+  const formDefaultValue = useMemo(() => {
+    if (defaultValue === undefined || Object.keys(defaultValue).length === 0) {
+      return {};
+    }
+
+    return Object.entries(defaultValue as object)
+      .filter(({ 1: value }) => value !== undefined)
+      .reduce((acc, [key, value]) => ({ ...acc, [key]: value }), {});
+  }, [defaultValue]);
+
+  const { errorDisplayDelay, stripEmptyFields: doStripEmptyFields } = options ?? {};
+  const formOptions = useMemo(
+    () => ({
+      stripEmptyFields: doStripEmptyFields ?? DEFAULT_OPTIONS.stripEmptyFields,
+      errorDisplayDelay: errorDisplayDelay ?? DEFAULT_OPTIONS.errorDisplayDelay,
+    }),
+    [errorDisplayDelay, doStripEmptyFields]
+  );
+
+  const defaultValueDeserialized = useMemo(
+    () => (deserializer ? deserializer(formDefaultValue) : formDefaultValue),
+    [formDefaultValue, deserializer]
+  );
 
   const [isSubmitted, setIsSubmitted] = useState(false);
   const [isSubmitting, setSubmitting] = useState(false);
@@ -81,55 +87,68 @@ export function useForm<T extends FormData = FormData>(
 
   // -- HELPERS
   // ----------------------------------
-  const getFormData$ = (): Subject<T> => {
+  const getFormData$ = useCallback((): Subject<T> => {
     if (formData$.current === null) {
       formData$.current = new Subject<T>({} as T);
     }
     return formData$.current;
-  };
-  const fieldsToArray = () => Object.values(fieldsRefs.current);
+  }, []);
 
-  const stripEmptyFields = (fields: FieldsMap): FieldsMap => {
-    if (formOptions.stripEmptyFields) {
-      return Object.entries(fields).reduce((acc, [key, field]) => {
-        if (typeof field.value !== 'string' || field.value.trim() !== '') {
-          acc[key] = field;
-        }
-        return acc;
-      }, {} as FieldsMap);
-    }
-    return fields;
-  };
+  const fieldsToArray = useCallback(() => Object.values(fieldsRefs.current), []);
+
+  const stripEmptyFields = useCallback(
+    (fields: FieldsMap): FieldsMap => {
+      if (formOptions.stripEmptyFields) {
+        return Object.entries(fields).reduce((acc, [key, field]) => {
+          if (typeof field.value !== 'string' || field.value.trim() !== '') {
+            acc[key] = field;
+          }
+          return acc;
+        }, {} as FieldsMap);
+      }
+      return fields;
+    },
+    [formOptions]
+  );
+
+  const updateFormDataAt: FormHook<T>['__updateFormDataAt'] = useCallback(
+    (path, value) => {
+      const _formData$ = getFormData$();
+      const currentFormData = _formData$.value;
+
+      if (currentFormData[path] !== value) {
+        _formData$.next({ ...currentFormData, [path]: value });
+      }
 
-  const updateFormDataAt: FormHook<T>['__updateFormDataAt'] = (path, value) => {
-    const _formData$ = getFormData$();
-    const currentFormData = _formData$.value;
-    const nextValue = { ...currentFormData, [path]: value };
-    _formData$.next(nextValue);
-    return _formData$.value;
-  };
+      return _formData$.value;
+    },
+    [getFormData$]
+  );
 
   // -- API
   // ----------------------------------
-  const getFormData: FormHook<T>['getFormData'] = (
-    getDataOptions: Parameters<FormHook<T>['getFormData']>[0] = { unflatten: true }
-  ) => {
-    if (getDataOptions.unflatten) {
-      const nonEmptyFields = stripEmptyFields(fieldsRefs.current);
-      const fieldsValue = mapFormFields(nonEmptyFields, (field) => field.__serializeOutput());
-      return serializer(unflattenObject(fieldsValue)) as T;
-    }
-
-    return Object.entries(fieldsRefs.current).reduce(
-      (acc, [key, field]) => ({
-        ...acc,
-        [key]: field.__serializeOutput(),
-      }),
-      {} as T
-    );
-  };
+  const getFormData: FormHook<T>['getFormData'] = useCallback(
+    (getDataOptions: Parameters<FormHook<T>['getFormData']>[0] = { unflatten: true }) => {
+      if (getDataOptions.unflatten) {
+        const nonEmptyFields = stripEmptyFields(fieldsRefs.current);
+        const fieldsValue = mapFormFields(nonEmptyFields, (field) => field.__serializeOutput());
+        return serializer
+          ? (serializer(unflattenObject(fieldsValue)) as T)
+          : (unflattenObject(fieldsValue) as T);
+      }
 
-  const getErrors: FormHook['getErrors'] = () => {
+      return Object.entries(fieldsRefs.current).reduce(
+        (acc, [key, field]) => ({
+          ...acc,
+          [key]: field.__serializeOutput(),
+        }),
+        {} as T
+      );
+    },
+    [stripEmptyFields, serializer]
+  );
+
+  const getErrors: FormHook['getErrors'] = useCallback(() => {
     if (isValid === true) {
       return [];
     }
@@ -141,11 +160,15 @@ export function useForm<T extends FormData = FormData>(
       }
       return [...acc, fieldError];
     }, [] as string[]);
-  };
+  }, [isValid, fieldsToArray]);
 
   const isFieldValid = (field: FieldHook) => field.isValid && !field.isValidating;
 
-  const updateFormValidity = () => {
+  const updateFormValidity = useCallback(() => {
+    if (isUnmounted.current) {
+      return;
+    }
+
     const fieldsArray = fieldsToArray();
     const areAllFieldsValidated = fieldsArray.every((field) => field.isValidated);
 
@@ -158,176 +181,220 @@ export function useForm<T extends FormData = FormData>(
 
     setIsValid(isFormValid);
     return isFormValid;
-  };
+  }, [fieldsToArray]);
 
-  const validateFields: FormHook<T>['__validateFields'] = async (fieldNames) => {
-    const fieldsToValidate = fieldNames
-      .map((name) => fieldsRefs.current[name])
-      .filter((field) => field !== undefined);
+  const validateFields: FormHook<T>['__validateFields'] = useCallback(
+    async (fieldNames) => {
+      const fieldsToValidate = fieldNames
+        .map((name) => fieldsRefs.current[name])
+        .filter((field) => field !== undefined);
 
-    if (fieldsToValidate.length === 0) {
-      // Nothing to validate
-      return { areFieldsValid: true, isFormValid: true };
-    }
+      if (fieldsToValidate.length === 0) {
+        // Nothing to validate
+        return { areFieldsValid: true, isFormValid: true };
+      }
 
-    const formData = getFormData({ unflatten: false });
-    await Promise.all(fieldsToValidate.map((field) => field.validate({ formData })));
+      const formData = getFormData({ unflatten: false });
+      await Promise.all(fieldsToValidate.map((field) => field.validate({ formData })));
 
-    const isFormValid = updateFormValidity();
-    const areFieldsValid = fieldsToValidate.every(isFieldValid);
+      const isFormValid = updateFormValidity();
+      const areFieldsValid = fieldsToValidate.every(isFieldValid);
 
-    return { areFieldsValid, isFormValid };
-  };
+      return { areFieldsValid, isFormValid };
+    },
+    [getFormData, updateFormValidity]
+  );
 
-  const validateAllFields = async (): Promise<boolean> => {
+  const validateAllFields = useCallback(async (): Promise<boolean> => {
     const fieldsArray = fieldsToArray();
     const fieldsToValidate = fieldsArray.filter((field) => !field.isValidated);
 
-    let isFormValid: boolean | undefined = isValid;
+    let isFormValid: boolean | undefined;
 
     if (fieldsToValidate.length === 0) {
-      if (isFormValid === undefined) {
-        // We should never enter this condition as the form validity is updated each time
-        // a field is validated. But sometimes, during tests it does not happen and we need
-        // to wait the next tick (hooks lifecycle being tricky) to make sure the "isValid" state is updated.
-        // In order to avoid this unintentional behaviour, we add this if condition here.
-        isFormValid = fieldsArray.every(isFieldValid);
-        setIsValid(isFormValid);
-      }
+      // We should never enter this condition as the form validity is updated each time
+      // a field is validated. But sometimes, during tests or race conditions it does not happen and we need
+      // to wait the next tick (hooks lifecycle being tricky) to make sure the "isValid" state is updated.
+      // In order to avoid this unintentional behaviour, we add this if condition here.
+
+      // TODO: Fix this when adding tests to the form lib.
+      isFormValid = fieldsArray.every(isFieldValid);
+      setIsValid(isFormValid);
       return isFormValid;
     }
 
     ({ isFormValid } = await validateFields(fieldsToValidate.map((field) => field.path)));
 
     return isFormValid!;
-  };
+  }, [fieldsToArray, validateFields]);
 
-  const addField: FormHook<T>['__addField'] = (field) => {
-    fieldsRefs.current[field.path] = field;
+  const addField: FormHook<T>['__addField'] = useCallback(
+    (field) => {
+      fieldsRefs.current[field.path] = field;
 
-    if (!{}.hasOwnProperty.call(getFormData$().value, field.path)) {
-      const fieldValue = field.__serializeOutput();
-      updateFormDataAt(field.path, fieldValue);
-    }
-  };
+      if (!{}.hasOwnProperty.call(getFormData$().value, field.path)) {
+        const fieldValue = field.__serializeOutput();
+        updateFormDataAt(field.path, fieldValue);
+      }
+    },
+    [getFormData$, updateFormDataAt]
+  );
 
-  const removeField: FormHook<T>['__removeField'] = (_fieldNames) => {
-    const fieldNames = Array.isArray(_fieldNames) ? _fieldNames : [_fieldNames];
-    const currentFormData = { ...getFormData$().value } as FormData;
+  const removeField: FormHook<T>['__removeField'] = useCallback(
+    (_fieldNames) => {
+      const fieldNames = Array.isArray(_fieldNames) ? _fieldNames : [_fieldNames];
+      const currentFormData = { ...getFormData$().value } as FormData;
 
-    fieldNames.forEach((name) => {
-      delete fieldsRefs.current[name];
-      delete currentFormData[name];
-    });
+      fieldNames.forEach((name) => {
+        delete fieldsRefs.current[name];
+        delete currentFormData[name];
+      });
 
-    getFormData$().next(currentFormData as T);
+      getFormData$().next(currentFormData as T);
 
-    /**
-     * After removing a field, the form validity might have changed
-     * (an invalid field might have been removed and now the form is valid)
-     */
-    updateFormValidity();
-  };
+      /**
+       * After removing a field, the form validity might have changed
+       * (an invalid field might have been removed and now the form is valid)
+       */
+      updateFormValidity();
+    },
+    [getFormData$, updateFormValidity]
+  );
 
-  const setFieldValue: FormHook<T>['setFieldValue'] = (fieldName, value) => {
+  const setFieldValue: FormHook<T>['setFieldValue'] = useCallback((fieldName, value) => {
     if (fieldsRefs.current[fieldName] === undefined) {
       return;
     }
     fieldsRefs.current[fieldName].setValue(value);
-  };
+  }, []);
 
-  const setFieldErrors: FormHook<T>['setFieldErrors'] = (fieldName, errors) => {
+  const setFieldErrors: FormHook<T>['setFieldErrors'] = useCallback((fieldName, errors) => {
     if (fieldsRefs.current[fieldName] === undefined) {
       return;
     }
     fieldsRefs.current[fieldName].setErrors(errors);
-  };
+  }, []);
 
-  const getFields: FormHook<T>['getFields'] = () => fieldsRefs.current;
+  const getFields: FormHook<T>['getFields'] = useCallback(() => fieldsRefs.current, []);
 
-  const getFieldDefaultValue: FormHook['getFieldDefaultValue'] = (fieldName) =>
-    get(defaultValueDeserialized, fieldName);
+  const getFieldDefaultValue: FormHook['getFieldDefaultValue'] = useCallback(
+    (fieldName) => get(defaultValueDeserialized, fieldName),
+    [defaultValueDeserialized]
+  );
 
-  const readFieldConfigFromSchema: FormHook<T>['__readFieldConfigFromSchema'] = (fieldName) => {
-    const config = (get(schema ? schema : {}, fieldName) as FieldConfig) || {};
+  const readFieldConfigFromSchema: FormHook<T>['__readFieldConfigFromSchema'] = useCallback(
+    (fieldName) => {
+      const config = (get(schema ?? {}, fieldName) as FieldConfig) || {};
 
-    return config;
-  };
+      return config;
+    },
+    [schema]
+  );
 
-  const submitForm: FormHook<T>['submit'] = async (e) => {
-    if (e) {
-      e.preventDefault();
-    }
+  const submitForm: FormHook<T>['submit'] = useCallback(
+    async (e) => {
+      if (e) {
+        e.preventDefault();
+      }
 
-    if (!isSubmitted) {
       setIsSubmitted(true); // User has attempted to submit the form at least once
-    }
-    setSubmitting(true);
+      setSubmitting(true);
 
-    const isFormValid = await validateAllFields();
-    const formData = getFormData();
-
-    if (onSubmit) {
-      await onSubmit(formData, isFormValid!);
-    }
-
-    if (isUnmounted.current === false) {
-      setSubmitting(false);
-    }
+      const isFormValid = await validateAllFields();
+      const formData = getFormData();
 
-    return { data: formData, isValid: isFormValid! };
-  };
+      if (onSubmit) {
+        await onSubmit(formData, isFormValid!);
+      }
 
-  const subscribe: FormHook<T>['subscribe'] = (handler) => {
-    const subscription = getFormData$().subscribe((raw) => {
-      if (!isUnmounted.current) {
-        handler({ isValid, data: { raw, format: getFormData }, validate: validateAllFields });
+      if (isUnmounted.current === false) {
+        setSubmitting(false);
       }
-    });
 
-    formUpdateSubscribers.current.push(subscription);
+      return { data: formData, isValid: isFormValid! };
+    },
+    [validateAllFields, getFormData, onSubmit]
+  );
 
-    return {
-      unsubscribe() {
-        formUpdateSubscribers.current = formUpdateSubscribers.current.filter(
-          (sub) => sub !== subscription
-        );
-        return subscription.unsubscribe();
-      },
-    };
-  };
+  const subscribe: FormHook<T>['subscribe'] = useCallback(
+    (handler) => {
+      const subscription = getFormData$().subscribe((raw) => {
+        if (!isUnmounted.current) {
+          handler({ isValid, data: { raw, format: getFormData }, validate: validateAllFields });
+        }
+      });
+
+      formUpdateSubscribers.current.push(subscription);
+
+      return {
+        unsubscribe() {
+          formUpdateSubscribers.current = formUpdateSubscribers.current.filter(
+            (sub) => sub !== subscription
+          );
+          return subscription.unsubscribe();
+        },
+      };
+    },
+    [getFormData$, isValid, getFormData, validateAllFields]
+  );
 
   /**
    * Reset all the fields of the form to their default values
    * and reset all the states to their original value.
    */
-  const reset: FormHook<T>['reset'] = (resetOptions = { resetValues: true }) => {
-    const { resetValues = true } = resetOptions;
-    const currentFormData = { ...getFormData$().value } as FormData;
-    Object.entries(fieldsRefs.current).forEach(([path, field]) => {
-      // By resetting the form, some field might be unmounted. In order
-      // to avoid a race condition, we check that the field still exists.
-      const isFieldMounted = fieldsRefs.current[path] !== undefined;
-      if (isFieldMounted) {
-        const fieldValue = field.reset({ resetValue: resetValues });
-        currentFormData[path] = fieldValue;
+  const reset: FormHook<T>['reset'] = useCallback(
+    (resetOptions = { resetValues: true }) => {
+      const { resetValues = true } = resetOptions;
+      const currentFormData = { ...getFormData$().value } as FormData;
+      Object.entries(fieldsRefs.current).forEach(([path, field]) => {
+        // By resetting the form, some field might be unmounted. In order
+        // to avoid a race condition, we check that the field still exists.
+        const isFieldMounted = fieldsRefs.current[path] !== undefined;
+        if (isFieldMounted) {
+          const fieldValue = field.reset({ resetValue: resetValues }) ?? currentFormData[path];
+          currentFormData[path] = fieldValue;
+        }
+      });
+      if (resetValues) {
+        getFormData$().next(currentFormData as T);
       }
-    });
-    if (resetValues) {
-      getFormData$().next(currentFormData as T);
-    }
 
-    setIsSubmitted(false);
-    setSubmitting(false);
-    setIsValid(undefined);
-  };
+      setIsSubmitted(false);
+      setSubmitting(false);
+      setIsValid(undefined);
+    },
+    [getFormData$]
+  );
 
-  const form: FormHook<T> = {
+  const form = useMemo<FormHook<T>>(() => {
+    return {
+      isSubmitted,
+      isSubmitting,
+      isValid,
+      id,
+      submit: submitForm,
+      subscribe,
+      setFieldValue,
+      setFieldErrors,
+      getFields,
+      getFormData,
+      getErrors,
+      getFieldDefaultValue,
+      reset,
+      __options: formOptions,
+      __getFormData$: getFormData$,
+      __updateFormDataAt: updateFormDataAt,
+      __readFieldConfigFromSchema: readFieldConfigFromSchema,
+      __addField: addField,
+      __removeField: removeField,
+      __validateFields: validateFields,
+    };
+  }, [
     isSubmitted,
     isSubmitting,
     isValid,
     id,
-    submit: submitForm,
+    submitForm,
     subscribe,
     setFieldValue,
     setFieldErrors,
@@ -336,14 +403,14 @@ export function useForm<T extends FormData = FormData>(
     getErrors,
     getFieldDefaultValue,
     reset,
-    __options: formOptions,
-    __getFormData$: getFormData$,
-    __updateFormDataAt: updateFormDataAt,
-    __readFieldConfigFromSchema: readFieldConfigFromSchema,
-    __addField: addField,
-    __removeField: removeField,
-    __validateFields: validateFields,
-  };
+    formOptions,
+    getFormData$,
+    updateFormDataAt,
+    readFieldConfigFromSchema,
+    addField,
+    removeField,
+    validateFields,
+  ]);
 
   return {
     form,
diff --git a/src/plugins/es_ui_shared/static/forms/hook_form_lib/types.ts b/src/plugins/es_ui_shared/static/forms/hook_form_lib/types.ts
index f11b61edaddf4..7e38a33f0c684 100644
--- a/src/plugins/es_ui_shared/static/forms/hook_form_lib/types.ts
+++ b/src/plugins/es_ui_shared/static/forms/hook_form_lib/types.ts
@@ -107,7 +107,7 @@ export interface FieldHook<T = unknown> {
     errorCode?: string;
   }) => string | null;
   onChange: (event: ChangeEvent<{ name?: string; value: string; checked?: boolean }>) => void;
-  setValue: (value: T) => void;
+  setValue: (value: T) => T;
   setErrors: (errors: ValidationError[]) => void;
   clearErrors: (type?: string | string[]) => void;
   validate: (validateData?: {
@@ -115,7 +115,7 @@ export interface FieldHook<T = unknown> {
     value?: unknown;
     validationType?: string;
   }) => FieldValidateResponse | Promise<FieldValidateResponse>;
-  reset: (options?: { resetValue: boolean }) => unknown;
+  reset: (options?: { resetValue: boolean }) => unknown | undefined;
   __serializeOutput: (rawValue?: unknown) => unknown;
 }
 
diff --git a/src/plugins/management/public/plugin.ts b/src/plugins/management/public/plugin.ts
index 17d8cb4adc701..8be130b4028c6 100644
--- a/src/plugins/management/public/plugin.ts
+++ b/src/plugins/management/public/plugin.ts
@@ -65,7 +65,7 @@ export class ManagementPlugin implements Plugin<ManagementSetup, ManagementStart
       title: i18n.translate('management.stackManagement.title', {
         defaultMessage: 'Stack Management',
       }),
-      order: 9003,
+      order: 9040,
       euiIconType: 'managementApp',
       category: DEFAULT_APP_CATEGORIES.management,
       async mount(params: AppMountParameters) {
diff --git a/src/plugins/ui_actions/kibana.json b/src/plugins/ui_actions/kibana.json
index 7b24b3cc5c48b..337c5ddf0fd5c 100644
--- a/src/plugins/ui_actions/kibana.json
+++ b/src/plugins/ui_actions/kibana.json
@@ -7,6 +7,7 @@
     "public/tests/test_samples"
   ],
   "requiredBundles": [
+    "kibanaUtils",
     "kibanaReact"
   ]
 }
diff --git a/src/plugins/ui_actions/public/actions/action.ts b/src/plugins/ui_actions/public/actions/action.ts
index f5dbbc9f923ac..bc5f36acb8f0c 100644
--- a/src/plugins/ui_actions/public/actions/action.ts
+++ b/src/plugins/ui_actions/public/actions/action.ts
@@ -68,6 +68,13 @@ export interface Action<Context extends {} = {}, T = ActionType>
    * Executes the action.
    */
   execute(context: Context): Promise<void>;
+
+  /**
+   * Determines if action should be executed automatically,
+   * without first showing up in context menu.
+   * false by default.
+   */
+  shouldAutoExecute?(context: Context): Promise<boolean>;
 }
 
 /**
@@ -89,6 +96,13 @@ export interface ActionDefinition<Context extends object = object>
    * Executes the action.
    */
   execute(context: Context): Promise<void>;
+
+  /**
+   * Determines if action should be executed automatically,
+   * without first showing up in context menu.
+   * false by default.
+   */
+  shouldAutoExecute?(context: Context): Promise<boolean>;
 }
 
 export type ActionContext<A> = A extends ActionDefinition<infer Context> ? Context : never;
diff --git a/src/plugins/ui_actions/public/actions/action_internal.ts b/src/plugins/ui_actions/public/actions/action_internal.ts
index 10eb760b13089..a22b3fa5b0367 100644
--- a/src/plugins/ui_actions/public/actions/action_internal.ts
+++ b/src/plugins/ui_actions/public/actions/action_internal.ts
@@ -65,4 +65,9 @@ export class ActionInternal<A extends ActionDefinition = ActionDefinition>
     if (!this.definition.getHref) return undefined;
     return await this.definition.getHref(context);
   }
+
+  public async shouldAutoExecute(context: Context<A>): Promise<boolean> {
+    if (!this.definition.shouldAutoExecute) return false;
+    return this.definition.shouldAutoExecute(context);
+  }
 }
diff --git a/src/plugins/ui_actions/public/context_menu/build_eui_context_menu_panels.tsx b/src/plugins/ui_actions/public/context_menu/build_eui_context_menu_panels.tsx
index 74e9ef96b575b..7b87a5992a7f5 100644
--- a/src/plugins/ui_actions/public/context_menu/build_eui_context_menu_panels.tsx
+++ b/src/plugins/ui_actions/public/context_menu/build_eui_context_menu_panels.tsx
@@ -23,28 +23,28 @@ import _ from 'lodash';
 import { i18n } from '@kbn/i18n';
 import { uiToReactComponent } from '../../../kibana_react/public';
 import { Action } from '../actions';
+import { BaseContext } from '../types';
 
 export const defaultTitle = i18n.translate('uiActions.actionPanel.title', {
   defaultMessage: 'Options',
 });
 
+type ActionWithContext<Context extends BaseContext = BaseContext> = [Action<Context>, Context];
+
 /**
  * Transforms an array of Actions to the shape EuiContextMenuPanel expects.
  */
-export async function buildContextMenuForActions<Context extends object>({
+export async function buildContextMenuForActions({
   actions,
-  actionContext,
   title = defaultTitle,
   closeMenu,
 }: {
-  actions: Array<Action<Context>>;
-  actionContext: Context;
+  actions: ActionWithContext[];
   title?: string;
   closeMenu: () => void;
 }): Promise<EuiContextMenuPanelDescriptor> {
-  const menuItems = await buildEuiContextMenuPanelItems<Context>({
+  const menuItems = await buildEuiContextMenuPanelItems({
     actions,
-    actionContext,
     closeMenu,
   });
 
@@ -58,17 +58,15 @@ export async function buildContextMenuForActions<Context extends object>({
 /**
  * Transform an array of Actions into the shape needed to build an EUIContextMenu
  */
-async function buildEuiContextMenuPanelItems<Context extends object>({
+async function buildEuiContextMenuPanelItems({
   actions,
-  actionContext,
   closeMenu,
 }: {
-  actions: Array<Action<Context>>;
-  actionContext: Context;
+  actions: ActionWithContext[];
   closeMenu: () => void;
 }) {
   const items: EuiContextMenuPanelItemDescriptor[] = new Array(actions.length);
-  const promises = actions.map(async (action, index) => {
+  const promises = actions.map(async ([action, actionContext], index) => {
     const isCompatible = await action.isCompatible(actionContext);
     if (!isCompatible) {
       return;
diff --git a/src/plugins/ui_actions/public/service/ui_actions_execution_service.ts b/src/plugins/ui_actions/public/service/ui_actions_execution_service.ts
new file mode 100644
index 0000000000000..7393989672e9d
--- /dev/null
+++ b/src/plugins/ui_actions/public/service/ui_actions_execution_service.ts
@@ -0,0 +1,121 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { uniqBy } from 'lodash';
+import { Action } from '../actions';
+import { BaseContext } from '../types';
+import { defer as createDefer, Defer } from '../../../kibana_utils/public';
+import { buildContextMenuForActions, openContextMenu } from '../context_menu';
+import { Trigger } from '../triggers';
+
+interface ExecuteActionTask {
+  action: Action;
+  context: BaseContext;
+  trigger: Trigger;
+  defer: Defer<void>;
+}
+
+export class UiActionsExecutionService {
+  private readonly batchingQueue: ExecuteActionTask[] = [];
+  private readonly pendingTasks = new Set<ExecuteActionTask>();
+
+  constructor() {}
+
+  async execute({
+    action,
+    context,
+    trigger,
+  }: {
+    action: Action<BaseContext>;
+    context: BaseContext;
+    trigger: Trigger;
+  }): Promise<void> {
+    const shouldBatch = !(await action.shouldAutoExecute?.(context)) ?? false;
+    const task: ExecuteActionTask = {
+      action,
+      context,
+      trigger,
+      defer: createDefer(),
+    };
+
+    if (shouldBatch) {
+      this.batchingQueue.push(task);
+    } else {
+      this.pendingTasks.add(task);
+      try {
+        await action.execute(context);
+        this.pendingTasks.delete(task);
+      } catch (e) {
+        this.pendingTasks.delete(task);
+        throw new Error(e);
+      }
+    }
+
+    this.scheduleFlush();
+
+    return task.defer.promise;
+  }
+
+  private scheduleFlush() {
+    /**
+     * Have to delay at least until next macro task
+     * Otherwise chain:
+     * Trigger -> await action.execute() -> trigger -> action
+     * isn't batched
+     *
+     * This basically needed to support a chain of scheduled micro tasks (async/awaits) within uiActions code
+     */
+    setTimeout(() => {
+      if (this.pendingTasks.size === 0) {
+        const tasks = uniqBy(this.batchingQueue, (t) => t.action.id);
+        if (tasks.length === 1) {
+          this.executeSingleTask(tasks[0]);
+        }
+        if (tasks.length > 1) {
+          this.executeMultipleActions(tasks);
+        }
+
+        this.batchingQueue.splice(0, this.batchingQueue.length);
+      }
+    }, 0);
+  }
+
+  private async executeSingleTask({ context, action, defer }: ExecuteActionTask) {
+    try {
+      await action.execute(context);
+      defer.resolve();
+    } catch (e) {
+      defer.reject(e);
+    }
+  }
+
+  private async executeMultipleActions(tasks: ExecuteActionTask[]) {
+    const panel = await buildContextMenuForActions({
+      actions: tasks.map(({ action, context }) => [action, context]),
+      title: tasks[0].trigger.title, // title of context menu is title of trigger which originated the chain
+      closeMenu: () => {
+        tasks.forEach((t) => t.defer.resolve());
+        session.close();
+      },
+    });
+    const session = openContextMenu([panel], {
+      'data-test-subj': 'multipleActionsContextMenu',
+    });
+  }
+}
diff --git a/src/plugins/ui_actions/public/service/ui_actions_service.ts b/src/plugins/ui_actions/public/service/ui_actions_service.ts
index 11f5769a94648..08efffbb6b5a8 100644
--- a/src/plugins/ui_actions/public/service/ui_actions_service.ts
+++ b/src/plugins/ui_actions/public/service/ui_actions_service.ts
@@ -28,6 +28,7 @@ import { ActionInternal, Action, ActionDefinition, ActionContext } from '../acti
 import { Trigger, TriggerContext } from '../triggers/trigger';
 import { TriggerInternal } from '../triggers/trigger_internal';
 import { TriggerContract } from '../triggers/trigger_contract';
+import { UiActionsExecutionService } from './ui_actions_execution_service';
 
 export interface UiActionsServiceParams {
   readonly triggers?: TriggerRegistry;
@@ -40,6 +41,7 @@ export interface UiActionsServiceParams {
 }
 
 export class UiActionsService {
+  public readonly executionService = new UiActionsExecutionService();
   protected readonly triggers: TriggerRegistry;
   protected readonly actions: ActionRegistry;
   protected readonly triggerToActions: TriggerToActionsRegistry;
diff --git a/src/plugins/ui_actions/public/tests/execute_trigger_actions.test.ts b/src/plugins/ui_actions/public/tests/execute_trigger_actions.test.ts
index 983c6796eeb09..9af46f25b4fec 100644
--- a/src/plugins/ui_actions/public/tests/execute_trigger_actions.test.ts
+++ b/src/plugins/ui_actions/public/tests/execute_trigger_actions.test.ts
@@ -22,6 +22,7 @@ import { openContextMenu } from '../context_menu';
 import { uiActionsPluginMock } from '../mocks';
 import { Trigger } from '../triggers';
 import { TriggerId, ActionType } from '../types';
+import { wait } from '@testing-library/dom';
 
 jest.mock('../context_menu');
 
@@ -36,13 +37,15 @@ const TEST_ACTION_TYPE = 'TEST_ACTION_TYPE' as ActionType;
 
 function createTestAction<C extends object>(
   type: string,
-  checkCompatibility: (context: C) => boolean
+  checkCompatibility: (context: C) => boolean,
+  autoExecutable = false
 ): Action<object> {
   return createAction<typeof TEST_ACTION_TYPE>({
     type: type as ActionType,
     id: type,
     isCompatible: (context: C) => Promise.resolve(checkCompatibility(context)),
     execute: (context) => executeFn(context),
+    shouldAutoExecute: () => Promise.resolve(autoExecutable),
   });
 }
 
@@ -57,6 +60,7 @@ const reset = () => {
 
   executeFn.mockReset();
   openContextMenuSpy.mockReset();
+  jest.useFakeTimers();
 };
 beforeEach(reset);
 
@@ -75,6 +79,8 @@ test('executes a single action mapped to a trigger', async () => {
   const start = doStart();
   await start.executeTriggerActions('MY-TRIGGER' as TriggerId, context);
 
+  jest.runAllTimers();
+
   expect(executeFn).toBeCalledTimes(1);
   expect(executeFn).toBeCalledWith(context);
 });
@@ -117,6 +123,8 @@ test('does not execute an incompatible action', async () => {
   };
   await start.executeTriggerActions('MY-TRIGGER' as TriggerId, context);
 
+  jest.runAllTimers();
+
   expect(executeFn).toBeCalledTimes(1);
 });
 
@@ -139,8 +147,12 @@ test('shows a context menu when more than one action is mapped to a trigger', as
   const context = {};
   await start.executeTriggerActions('MY-TRIGGER' as TriggerId, context);
 
-  expect(executeFn).toBeCalledTimes(0);
-  expect(openContextMenu).toHaveBeenCalledTimes(1);
+  jest.runAllTimers();
+
+  await wait(() => {
+    expect(executeFn).toBeCalledTimes(0);
+    expect(openContextMenu).toHaveBeenCalledTimes(1);
+  });
 });
 
 test('passes whole action context to isCompatible()', async () => {
@@ -161,4 +173,32 @@ test('passes whole action context to isCompatible()', async () => {
 
   const context = { foo: 'bar' };
   await start.executeTriggerActions('MY-TRIGGER' as TriggerId, context);
+  jest.runAllTimers();
+});
+
+test("doesn't show a context menu for auto executable actions", async () => {
+  const { setup, doStart } = uiActions;
+  const trigger: Trigger = {
+    id: 'MY-TRIGGER' as TriggerId,
+    title: 'My trigger',
+  };
+  const action1 = createTestAction('test1', () => true, true);
+  const action2 = createTestAction('test2', () => true, false);
+
+  setup.registerTrigger(trigger);
+  setup.addTriggerAction(trigger.id, action1);
+  setup.addTriggerAction(trigger.id, action2);
+
+  expect(openContextMenu).toHaveBeenCalledTimes(0);
+
+  const start = doStart();
+  const context = {};
+  await start.executeTriggerActions('MY-TRIGGER' as TriggerId, context);
+
+  jest.runAllTimers();
+
+  await wait(() => {
+    expect(executeFn).toBeCalledTimes(2);
+    expect(openContextMenu).toHaveBeenCalledTimes(0);
+  });
 });
diff --git a/src/plugins/ui_actions/public/triggers/trigger_internal.ts b/src/plugins/ui_actions/public/triggers/trigger_internal.ts
index e499c404ae745..c91468d31add5 100644
--- a/src/plugins/ui_actions/public/triggers/trigger_internal.ts
+++ b/src/plugins/ui_actions/public/triggers/trigger_internal.ts
@@ -20,8 +20,6 @@
 import { Trigger } from './trigger';
 import { TriggerContract } from './trigger_contract';
 import { UiActionsService } from '../service';
-import { Action } from '../actions';
-import { buildContextMenuForActions, openContextMenu } from '../context_menu';
 import { TriggerId, TriggerContextMapping } from '../types';
 
 /**
@@ -43,33 +41,14 @@ export class TriggerInternal<T extends TriggerId> {
       );
     }
 
-    if (actions.length === 1) {
-      await this.executeSingleAction(actions[0], context);
-      return;
-    }
-
-    await this.executeMultipleActions(actions, context);
-  }
-
-  private async executeSingleAction(
-    action: Action<TriggerContextMapping[T]>,
-    context: TriggerContextMapping[T]
-  ) {
-    await action.execute(context);
-  }
-
-  private async executeMultipleActions(
-    actions: Array<Action<TriggerContextMapping[T]>>,
-    context: TriggerContextMapping[T]
-  ) {
-    const panel = await buildContextMenuForActions({
-      actions,
-      actionContext: context,
-      title: this.trigger.title,
-      closeMenu: () => session.close(),
-    });
-    const session = openContextMenu([panel], {
-      'data-test-subj': 'multipleActionsContextMenu',
-    });
+    await Promise.all([
+      actions.map((action) =>
+        this.service.executionService.execute({
+          action,
+          context,
+          trigger: this.trigger,
+        })
+      ),
+    ]);
   }
 }
diff --git a/src/plugins/ui_actions/public/types.ts b/src/plugins/ui_actions/public/types.ts
index 9fcd8a32881df..5631441cf9a1b 100644
--- a/src/plugins/ui_actions/public/types.ts
+++ b/src/plugins/ui_actions/public/types.ts
@@ -19,10 +19,9 @@
 
 import { ActionInternal } from './actions/action_internal';
 import { TriggerInternal } from './triggers/trigger_internal';
-import { Filter } from '../../data/public';
 import { SELECT_RANGE_TRIGGER, VALUE_CLICK_TRIGGER, APPLY_FILTER_TRIGGER } from './triggers';
-import { IEmbeddable } from '../../embeddable/public';
-import { RangeSelectContext, ValueClickContext } from '../../embeddable/public';
+import type { RangeSelectContext, ValueClickContext } from '../../embeddable/public';
+import type { ApplyGlobalFilterActionContext } from '../../data/public';
 
 export type TriggerRegistry = Map<TriggerId, TriggerInternal<any>>;
 export type ActionRegistry = Map<string, ActionInternal>;
@@ -39,10 +38,7 @@ export interface TriggerContextMapping {
   [DEFAULT_TRIGGER]: TriggerContext;
   [SELECT_RANGE_TRIGGER]: RangeSelectContext;
   [VALUE_CLICK_TRIGGER]: ValueClickContext;
-  [APPLY_FILTER_TRIGGER]: {
-    embeddable: IEmbeddable;
-    filters: Filter[];
-  };
+  [APPLY_FILTER_TRIGGER]: ApplyGlobalFilterActionContext;
 }
 
 const DEFAULT_ACTION = '';
diff --git a/src/plugins/vis_type_vega/public/vega_view/vega_base_view.js b/src/plugins/vis_type_vega/public/vega_view/vega_base_view.js
index 069664a9c91c1..55c3606bf5e45 100644
--- a/src/plugins/vis_type_vega/public/vega_view/vega_base_view.js
+++ b/src/plugins/vis_type_vega/public/vega_view/vega_base_view.js
@@ -147,7 +147,7 @@ export class VegaBaseView {
             defaultMessage:
               'External URLs are not enabled. Add   {enableExternalUrls}   to {kibanaConfigFileName}',
             values: {
-              enableExternalUrls: 'vega.enableExternalUrls: true',
+              enableExternalUrls: 'vis_type_vega.enableExternalUrls: true',
               kibanaConfigFileName: 'kibana.yml',
             },
           })
diff --git a/src/plugins/visualizations/public/expressions/visualization_function.ts b/src/plugins/visualizations/public/expressions/visualization_function.ts
index 222479158934b..68a153f4272a3 100644
--- a/src/plugins/visualizations/public/expressions/visualization_function.ts
+++ b/src/plugins/visualizations/public/expressions/visualization_function.ts
@@ -21,7 +21,7 @@ import { get } from 'lodash';
 import { i18n } from '@kbn/i18n';
 import { VisResponseValue, PersistedState } from '../../../../plugins/visualizations/public';
 import { ExpressionFunctionDefinition, Render } from '../../../../plugins/expressions/public';
-import { getTypes, getIndexPatterns, getFilterManager } from '../services';
+import { getTypes, getIndexPatterns, getFilterManager, getSearch } from '../services';
 
 interface Arguments {
   index?: string | null;
@@ -31,6 +31,7 @@ interface Arguments {
   schemas?: string;
   visConfig?: string;
   uiState?: string;
+  aggConfigs?: string;
 }
 
 export type ExpressionFunctionVisualization = ExpressionFunctionDefinition<
@@ -84,6 +85,11 @@ export const visualization = (): ExpressionFunctionVisualization => ({
       default: '"{}"',
       help: 'User interface state',
     },
+    aggConfigs: {
+      types: ['string'],
+      default: '"{}"',
+      help: 'Aggregation configurations',
+    },
   },
   async fn(input, args, { inspectorAdapters }) {
     const visConfigParams = args.visConfig ? JSON.parse(args.visConfig) : {};
@@ -94,6 +100,11 @@ export const visualization = (): ExpressionFunctionVisualization => ({
     const uiStateParams = args.uiState ? JSON.parse(args.uiState) : {};
     const uiState = new PersistedState(uiStateParams);
 
+    const aggConfigsState = args.aggConfigs ? JSON.parse(args.aggConfigs) : [];
+    const aggs = indexPattern
+      ? getSearch().aggs.createAggConfigs(indexPattern, aggConfigsState)
+      : undefined;
+
     if (typeof visType.requestHandler === 'function') {
       input = await visType.requestHandler({
         partialRows: args.partialRows,
@@ -107,6 +118,7 @@ export const visualization = (): ExpressionFunctionVisualization => ({
         inspectorAdapters,
         queryFilter: getFilterManager(),
         forceFetch: true,
+        aggs,
       });
     }
 
diff --git a/src/plugins/visualizations/public/legacy/build_pipeline.ts b/src/plugins/visualizations/public/legacy/build_pipeline.ts
index 2ef07bf18c91c..e74a83d91fabf 100644
--- a/src/plugins/visualizations/public/legacy/build_pipeline.ts
+++ b/src/plugins/visualizations/public/legacy/build_pipeline.ts
@@ -535,7 +535,10 @@ export const buildPipeline = async (
     metricsAtAllLevels=${vis.isHierarchical()}
     partialRows=${vis.type.requiresPartialRows || vis.params.showPartialRows || false} `;
     if (indexPattern) {
-      pipeline += `${prepareString('index', indexPattern.id)}`;
+      pipeline += `${prepareString('index', indexPattern.id)} `;
+      if (vis.data.aggs) {
+        pipeline += `${prepareJson('aggConfigs', vis.data.aggs!.aggs)}`;
+      }
     }
   }
 
diff --git a/tasks/config/karma.js b/tasks/config/karma.js
index fa4bdc8ed2266..114e09876406c 100644
--- a/tasks/config/karma.js
+++ b/tasks/config/karma.js
@@ -21,7 +21,6 @@ import { dirname } from 'path';
 import { times } from 'lodash';
 import { makeJunitReportPath } from '@kbn/test';
 import * as UiSharedDeps from '@kbn/ui-shared-deps';
-import { DllCompiler } from '../../src/optimize/dynamic_dll_plugin';
 
 const TOTAL_CI_SHARDS = 4;
 const ROOT = dirname(require.resolve('../../package.json'));
@@ -63,12 +62,6 @@ module.exports = function (grunt) {
       ),
       `http://localhost:5610/${buildHash}/bundles/kbn-ui-shared-deps/${UiSharedDeps.jsFilename}`,
 
-      `http://localhost:5610/${buildHash}/built_assets/dlls/vendors_runtime.bundle.dll.js`,
-      ...DllCompiler.getRawDllConfig().chunks.map(
-        (chunk) =>
-          `http://localhost:5610/${buildHash}/built_assets/dlls/vendors${chunk}.bundle.dll.js`
-      ),
-
       shardNum === undefined
         ? `http://localhost:5610/${buildHash}/bundles/tests.bundle.js`
         : `http://localhost:5610/${buildHash}/bundles/tests.bundle.js?shards=${TOTAL_CI_SHARDS}&shard_num=${shardNum}`,
@@ -77,10 +70,6 @@ module.exports = function (grunt) {
       // this causes tilemap tests to fail, probably because the eui styles haven't been
       // included in the karma harness a long some time, if ever
       // `http://localhost:5610/bundles/kbn-ui-shared-deps/${UiSharedDeps.lightCssDistFilename}`,
-      ...DllCompiler.getRawDllConfig().chunks.map(
-        (chunk) =>
-          `http://localhost:5610/${buildHash}/built_assets/dlls/vendors${chunk}.style.dll.css`
-      ),
       `http://localhost:5610/${buildHash}/bundles/tests.style.css`,
     ];
   }
@@ -133,7 +122,6 @@ module.exports = function (grunt) {
         '/tests/': 'http://localhost:5610/tests/',
         '/test_bundle/': 'http://localhost:5610/test_bundle/',
         [`/${buildHash}/bundles/`]: `http://localhost:5610/${buildHash}/bundles/`,
-        [`/${buildHash}/built_assets/dlls/`]: `http://localhost:5610/${buildHash}/built_assets/dlls/`,
       },
 
       client: {
diff --git a/test/examples/config.js b/test/examples/config.js
index 3c55be216fbc6..43d92ea21f077 100644
--- a/test/examples/config.js
+++ b/test/examples/config.js
@@ -29,6 +29,7 @@ export default async function ({ readConfigFile }) {
       require.resolve('./bfetch_explorer'),
       require.resolve('./ui_actions'),
       require.resolve('./state_sync'),
+      require.resolve('./routing'),
     ],
     services: {
       ...functionalConfig.get('services'),
diff --git a/test/examples/routing/index.ts b/test/examples/routing/index.ts
new file mode 100644
index 0000000000000..f96a7b96b46f6
--- /dev/null
+++ b/test/examples/routing/index.ts
@@ -0,0 +1,72 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import expect from '@kbn/expect';
+import { FtrProviderContext } from 'test/functional/ftr_provider_context';
+
+// eslint-disable-next-line import/no-default-export
+export default function ({ getService, getPageObjects, loadTestFile }: FtrProviderContext) {
+  const retry = getService('retry');
+  const testSubjects = getService('testSubjects');
+  const PageObjects = getPageObjects(['common']);
+
+  describe('routing examples', function () {
+    before(async () => {
+      await PageObjects.common.navigateToApp('routingExample');
+    });
+
+    it('basic get example', async () => {
+      await retry.try(async () => {
+        await testSubjects.click('routingExampleFetchRandomNumber');
+        const numberAsString = await testSubjects.getVisibleText('routingExampleRandomNumber');
+        expect(numberAsString).to.not.be(undefined);
+        const number = parseFloat(numberAsString);
+        expect(number).to.be.lessThan(10);
+        expect(number).to.be.greaterThan(0);
+      });
+    });
+
+    it('basic get example with query param', async () => {
+      await retry.try(async () => {
+        await testSubjects.setValue('routingExampleMaxRandomNumberBetween', '3');
+        await testSubjects.click('routingExampleFetchRandomNumberBetween');
+        const numberAsString = await testSubjects.getVisibleText(
+          'routingExampleRandomNumberBetween'
+        );
+        expect(numberAsString).to.not.be(undefined);
+        const number = parseFloat(numberAsString);
+        expect(number).to.be.lessThan(3);
+        expect(number).to.be.greaterThan(0);
+      });
+    });
+
+    it('post and get message example', async () => {
+      await testSubjects.setValue('routingExampleSetMessageId', '234');
+      await testSubjects.setValue('routingExampleSetMessage', 'hello!');
+      await testSubjects.click('routingExamplePostMessage');
+      await testSubjects.setValue('routingExampleGetMessageId', '234');
+      await testSubjects.click('routingExampleFetchMessage');
+
+      await retry.try(async () => {
+        const message = await testSubjects.getVisibleText('routingExampleGetMessage');
+        expect(message).to.be('hello!');
+      });
+    });
+  });
+}
diff --git a/test/functional/apps/dashboard/dashboard_error_handling.ts b/test/functional/apps/dashboard/dashboard_error_handling.ts
index 6bd8327a110b9..38803739ff129 100644
--- a/test/functional/apps/dashboard/dashboard_error_handling.ts
+++ b/test/functional/apps/dashboard/dashboard_error_handling.ts
@@ -28,7 +28,8 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   /**
    * Common test suite for testing exception scenarious within dashboard
    */
-  describe('dashboard error handling', () => {
+  // Flaky: https://github.com/elastic/kibana/issues/72146
+  describe.skip('dashboard error handling', () => {
     before(async () => {
       await esArchiver.loadIfNeeded('dashboard/current/kibana');
       await PageObjects.common.navigateToApp('dashboard');
diff --git a/test/functional/apps/dashboard/dashboard_filter_bar.js b/test/functional/apps/dashboard/dashboard_filter_bar.js
index f9b0d0a370c06..f3241568bbb3e 100644
--- a/test/functional/apps/dashboard/dashboard_filter_bar.js
+++ b/test/functional/apps/dashboard/dashboard_filter_bar.js
@@ -30,7 +30,8 @@ export default function ({ getService, getPageObjects }) {
   const browser = getService('browser');
   const PageObjects = getPageObjects(['common', 'dashboard', 'header', 'visualize', 'timePicker']);
 
-  describe('dashboard filter bar', () => {
+  // FLAKY: https://github.com/elastic/kibana/issues/71987
+  describe.skip('dashboard filter bar', () => {
     before(async () => {
       await esArchiver.load('dashboard/current/kibana');
       await kibanaServer.uiSettings.replace({
diff --git a/test/functional/apps/management/_create_index_pattern_wizard.js b/test/functional/apps/management/_create_index_pattern_wizard.js
index 97f2641b51d13..160b052e70d30 100644
--- a/test/functional/apps/management/_create_index_pattern_wizard.js
+++ b/test/functional/apps/management/_create_index_pattern_wizard.js
@@ -51,42 +51,6 @@ export default function ({ getService, getPageObjects }) {
       });
     });
 
-    describe('data streams', () => {
-      it('can be an index pattern', async () => {
-        await es.transport.request({
-          path: '/_index_template/generic-logs',
-          method: 'PUT',
-          body: {
-            index_patterns: ['logs-*', 'test_data_stream'],
-            template: {
-              mappings: {
-                properties: {
-                  '@timestamp': {
-                    type: 'date',
-                  },
-                },
-              },
-            },
-            data_stream: {
-              timestamp_field: '@timestamp',
-            },
-          },
-        });
-
-        await es.transport.request({
-          path: '/_data_stream/test_data_stream',
-          method: 'PUT',
-        });
-
-        await PageObjects.settings.createIndexPattern('test_data_stream', false);
-
-        await es.transport.request({
-          path: '/_data_stream/test_data_stream',
-          method: 'DELETE',
-        });
-      });
-    });
-
     describe('index alias', () => {
       it('can be an index pattern', async () => {
         await es.transport.request({
diff --git a/test/functional/apps/visualize/_tsvb_chart.ts b/test/functional/apps/visualize/_tsvb_chart.ts
index 191572e3e1354..5e8d2ef5653f2 100644
--- a/test/functional/apps/visualize/_tsvb_chart.ts
+++ b/test/functional/apps/visualize/_tsvb_chart.ts
@@ -28,7 +28,8 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const security = getService('security');
   const PageObjects = getPageObjects(['visualize', 'visualBuilder', 'timePicker', 'visChart']);
 
-  describe('visual builder', function describeIndexTests() {
+  // FLAKY: https://github.com/elastic/kibana/issues/71979
+  describe.skip('visual builder', function describeIndexTests() {
     this.tags('includeFirefox');
     beforeEach(async () => {
       await security.testUser.setRoles([
diff --git a/test/functional/page_objects/home_page.ts b/test/functional/page_objects/home_page.ts
index 6a503f4f73b66..2d78de49a4f94 100644
--- a/test/functional/page_objects/home_page.ts
+++ b/test/functional/page_objects/home_page.ts
@@ -54,6 +54,10 @@ export function HomePageProvider({ getService, getPageObjects }: FtrProviderCont
     async removeSampleDataSet(id: string) {
       // looks like overkill but we're hitting flaky cases where we click but it doesn't remove
       await testSubjects.waitForEnabled(`removeSampleDataSet${id}`);
+      // https://github.com/elastic/kibana/issues/65949
+      // Even after waiting for the "Remove" button to be enabled we still have failures
+      // where it appears the click just didn't work.
+      await PageObjects.common.sleep(1010);
       await testSubjects.click(`removeSampleDataSet${id}`);
       await this._waitForSampleDataLoadingAction(id);
     }
diff --git a/vars/kibanaTeamAssign.groovy b/vars/kibanaTeamAssign.groovy
new file mode 100644
index 0000000000000..e2298ed43d408
--- /dev/null
+++ b/vars/kibanaTeamAssign.groovy
@@ -0,0 +1,25 @@
+def loadIngestionPipeline(ingestionPipelineName, title) {
+  kibanaPipeline.bash("""
+    source src/dev/ci_setup/setup_env.sh
+    yarn kbn bootstrap --prefer-offline
+
+    . src/dev/code_coverage/shell_scripts/assign_teams.sh '${ingestionPipelineName}'
+  """, title)
+}
+
+def loadWithVault(ingestionPipelineName, title) {
+  def vaultSecret = 'secret/kibana-issues/prod/coverage/elasticsearch'
+  withVaultSecret(secret: vaultSecret, secret_field: 'host', variable_name: 'HOST_FROM_VAULT') {
+    withVaultSecret(secret: vaultSecret, secret_field: 'username', variable_name: 'USER_FROM_VAULT') {
+      withVaultSecret(secret: vaultSecret, secret_field: 'password', variable_name: 'PASS_FROM_VAULT') {
+        loadIngestionPipeline(ingestionPipelineName, title)
+      }
+    }
+  }
+}
+
+def load(ingestionPipelineName, title) {
+  loadWithVault(ingestionPipelineName, title)
+}
+
+return this
diff --git a/vars/prChanges.groovy b/vars/prChanges.groovy
index 414e651177277..adaacf952b5b6 100644
--- a/vars/prChanges.groovy
+++ b/vars/prChanges.groovy
@@ -2,6 +2,8 @@ import groovy.transform.Field
 
 public static @Field PR_CHANGES_CACHE = []
 
+// if all the changed files in a PR match one of these regular
+// expressions then CI will be skipped for that PR
 def getSkippablePaths() {
   return [
     /^docs\//,
@@ -14,6 +16,15 @@ def getSkippablePaths() {
   ]
 }
 
+// exclusion regular expressions that will invalidate paths that
+// match one of the skippable path regular expressions
+def getNotSkippablePaths() {
+  return [
+    // this file is auto-generated and changes to it need to be validated with CI
+    /^docs\/developer\/architecture\/code-exploration.asciidoc$/,
+  ]
+}
+
 def areChangesSkippable() {
   if (!githubPr.isPr()) {
     return false
@@ -21,6 +32,7 @@ def areChangesSkippable() {
 
   try {
     def skippablePaths = getSkippablePaths()
+    def notSkippablePaths = getNotSkippablePaths()
     def files = getChangedFiles()
 
     // 3000 is the max files GH API will return
@@ -29,7 +41,8 @@ def areChangesSkippable() {
     }
 
     files = files.findAll { file ->
-      return !skippablePaths.find { regex -> file =~ regex}
+      def skippable = skippablePaths.find { regex -> file =~ regex} && !notSkippablePaths.find { regex -> file =~ regex }
+      return !skippable
     }
 
     return files.size() < 1
diff --git a/x-pack/package.json b/x-pack/package.json
index 6715fa132c1b5..1de009ae1232f 100644
--- a/x-pack/package.json
+++ b/x-pack/package.json
@@ -72,6 +72,7 @@
     "@types/graphql": "^0.13.2",
     "@types/gulp": "^4.0.6",
     "@types/hapi__wreck": "^15.0.1",
+    "@types/he": "^1.1.1",
     "@types/hoist-non-react-statics": "^3.3.1",
     "@types/history": "^4.7.3",
     "@types/jest": "^25.2.3",
@@ -265,6 +266,7 @@
     "graphql-tools": "^3.0.2",
     "h2o2": "^8.1.2",
     "handlebars": "4.7.6",
+    "he": "^1.2.0",
     "history": "4.9.0",
     "history-extra": "^5.0.1",
     "i18n-iso-countries": "^4.3.1",
diff --git a/x-pack/plugins/actions/server/builtin_action_types/servicenow/api.test.ts b/x-pack/plugins/actions/server/builtin_action_types/servicenow/api.test.ts
index 7daf14e99f254..0bb096ecd0f62 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/servicenow/api.test.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/servicenow/api.test.ts
@@ -71,7 +71,7 @@ describe('api', () => {
       });
 
       test('it calls createIncident correctly', async () => {
-        const params = { ...apiParams, externalId: null, comments: undefined };
+        const params = { ...apiParams, externalId: null, comments: [] };
         await api.pushToService({
           externalService,
           mapping,
diff --git a/x-pack/plugins/actions/server/builtin_action_types/servicenow/api.ts b/x-pack/plugins/actions/server/builtin_action_types/servicenow/api.ts
index bd6f88f5efaa9..3281832941558 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/servicenow/api.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/servicenow/api.ts
@@ -53,7 +53,7 @@ const pushToServiceHandler = async ({
 
   let incident = {};
   // TODO: should be removed later but currently keep it for the Case implementation support
-  if (mapping) {
+  if (mapping && Array.isArray(params.comments)) {
     const fields = prepareFieldsForTransformation({
       externalCase: params.externalObject,
       mapping,
diff --git a/x-pack/plugins/apm/common/__snapshots__/apm_telemetry.test.ts.snap b/x-pack/plugins/apm/common/__snapshots__/apm_telemetry.test.ts.snap
index 1d8cfa28aea75..708758f2c6e58 100644
--- a/x-pack/plugins/apm/common/__snapshots__/apm_telemetry.test.ts.snap
+++ b/x-pack/plugins/apm/common/__snapshots__/apm_telemetry.test.ts.snap
@@ -527,6 +527,70 @@ exports[`APM telemetry helpers getApmTelemetry generates a JSON object with the
                         }
                       }
                     },
+                    "aggregated_transactions": {
+                      "properties": {
+                        "current_implementation": {
+                          "properties": {
+                            "expected_metric_document_count": {
+                              "type": "long"
+                            },
+                            "transaction_count": {
+                              "type": "long"
+                            }
+                          }
+                        },
+                        "no_observer_name": {
+                          "properties": {
+                            "expected_metric_document_count": {
+                              "type": "long"
+                            },
+                            "transaction_count": {
+                              "type": "long"
+                            }
+                          }
+                        },
+                        "no_rum": {
+                          "properties": {
+                            "expected_metric_document_count": {
+                              "type": "long"
+                            },
+                            "transaction_count": {
+                              "type": "long"
+                            }
+                          }
+                        },
+                        "no_rum_no_observer_name": {
+                          "properties": {
+                            "expected_metric_document_count": {
+                              "type": "long"
+                            },
+                            "transaction_count": {
+                              "type": "long"
+                            }
+                          }
+                        },
+                        "only_rum": {
+                          "properties": {
+                            "expected_metric_document_count": {
+                              "type": "long"
+                            },
+                            "transaction_count": {
+                              "type": "long"
+                            }
+                          }
+                        },
+                        "only_rum_no_observer_name": {
+                          "properties": {
+                            "expected_metric_document_count": {
+                              "type": "long"
+                            },
+                            "transaction_count": {
+                              "type": "long"
+                            }
+                          }
+                        }
+                      }
+                    },
                     "cloud": {
                       "properties": {
                         "availability_zone": {
@@ -647,12 +711,14 @@ exports[`APM telemetry helpers getApmTelemetry generates a JSON object with the
                         "client": {
                           "properties": {
                             "geo": {
-                              "properites": {
+                              "properties": {
                                 "country_iso_code": {
-                                  "rum": {
-                                    "properties": {
-                                      "1d": {
-                                        "type": "long"
+                                  "properties": {
+                                    "rum": {
+                                      "properties": {
+                                        "1d": {
+                                          "type": "long"
+                                        }
                                       }
                                     }
                                   }
@@ -831,6 +897,17 @@ exports[`APM telemetry helpers getApmTelemetry generates a JSON object with the
                     },
                     "tasks": {
                       "properties": {
+                        "aggregated_transactions": {
+                          "properties": {
+                            "took": {
+                              "properties": {
+                                "ms": {
+                                  "type": "long"
+                                }
+                              }
+                            }
+                          }
+                        },
                         "agent_configuration": {
                           "properties": {
                             "took": {
diff --git a/x-pack/plugins/apm/common/__snapshots__/elasticsearch_fieldnames.test.ts.snap b/x-pack/plugins/apm/common/__snapshots__/elasticsearch_fieldnames.test.ts.snap
index f7f2836745384..7c42fb6f12a54 100644
--- a/x-pack/plugins/apm/common/__snapshots__/elasticsearch_fieldnames.test.ts.snap
+++ b/x-pack/plugins/apm/common/__snapshots__/elasticsearch_fieldnames.test.ts.snap
@@ -70,6 +70,8 @@ exports[`Error METRIC_SYSTEM_TOTAL_MEMORY 1`] = `undefined`;
 
 exports[`Error OBSERVER_LISTENING 1`] = `undefined`;
 
+exports[`Error OBSERVER_NAME 1`] = `"an observer"`;
+
 exports[`Error OBSERVER_VERSION_MAJOR 1`] = `8`;
 
 exports[`Error PARENT_ID 1`] = `"parentId"`;
@@ -216,6 +218,8 @@ exports[`Span METRIC_SYSTEM_TOTAL_MEMORY 1`] = `undefined`;
 
 exports[`Span OBSERVER_LISTENING 1`] = `undefined`;
 
+exports[`Span OBSERVER_NAME 1`] = `"an observer"`;
+
 exports[`Span OBSERVER_VERSION_MAJOR 1`] = `8`;
 
 exports[`Span PARENT_ID 1`] = `"parentId"`;
@@ -362,6 +366,8 @@ exports[`Transaction METRIC_SYSTEM_TOTAL_MEMORY 1`] = `undefined`;
 
 exports[`Transaction OBSERVER_LISTENING 1`] = `undefined`;
 
+exports[`Transaction OBSERVER_NAME 1`] = `"an observer"`;
+
 exports[`Transaction OBSERVER_VERSION_MAJOR 1`] = `8`;
 
 exports[`Transaction PARENT_ID 1`] = `"parentId"`;
diff --git a/x-pack/plugins/apm/common/apm_telemetry.test.ts b/x-pack/plugins/apm/common/apm_telemetry.test.ts
index 035c546a5b49a..38f8e17d07485 100644
--- a/x-pack/plugins/apm/common/apm_telemetry.test.ts
+++ b/x-pack/plugins/apm/common/apm_telemetry.test.ts
@@ -4,7 +4,10 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { getApmTelemetryMapping } from './apm_telemetry';
+import {
+  getApmTelemetryMapping,
+  mergeApmTelemetryMapping,
+} from './apm_telemetry';
 
 // Add this snapshot serializer for this test. The default snapshot serializer
 // prints "Object" next to objects in the JSON output, but we want to be able to
@@ -43,4 +46,43 @@ describe('APM telemetry helpers', () => {
       }).toMatchSnapshot();
     });
   });
+
+  describe('mergeApmTelemetryMapping', () => {
+    describe('with an invalid mapping', () => {
+      it('throws an error', () => {
+        expect(() => mergeApmTelemetryMapping({})).toThrowError();
+      });
+    });
+
+    describe('with a valid mapping', () => {
+      it('merges the mapping', () => {
+        // This is "valid" in the sense that it has all of the deep fields
+        // needed to merge. It's not a valid mapping opbject.
+        const validTelemetryMapping = {
+          mappings: {
+            properties: {
+              stack_stats: {
+                properties: {
+                  kibana: {
+                    properties: {
+                      plugins: {
+                        properties: {
+                          apm: getApmTelemetryMapping(),
+                        },
+                      },
+                    },
+                  },
+                },
+              },
+            },
+          },
+        };
+
+        expect(
+          mergeApmTelemetryMapping(validTelemetryMapping)?.mappings.properties
+            .stack_stats.properties.kibana.properties.plugins.properties.apm
+        ).toEqual(getApmTelemetryMapping());
+      });
+    });
+  });
 });
diff --git a/x-pack/plugins/apm/common/apm_telemetry.ts b/x-pack/plugins/apm/common/apm_telemetry.ts
index 5fb6414674d1c..318b956cd3b3e 100644
--- a/x-pack/plugins/apm/common/apm_telemetry.ts
+++ b/x-pack/plugins/apm/common/apm_telemetry.ts
@@ -3,6 +3,7 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
+import { produce } from 'immer';
 import { AGENT_NAMES } from './agent_name';
 
 /**
@@ -73,6 +74,13 @@ export function getApmTelemetryMapping() {
     },
   };
 
+  const aggregatedTransactionsProperties = {
+    properties: {
+      expected_metric_document_count: long,
+      transaction_count: long,
+    },
+  };
+
   return {
     properties: {
       agents: {
@@ -90,6 +98,16 @@ export function getApmTelemetryMapping() {
           {}
         ),
       },
+      aggregated_transactions: {
+        properties: {
+          current_implementation: aggregatedTransactionsProperties,
+          no_observer_name: aggregatedTransactionsProperties,
+          no_rum: aggregatedTransactionsProperties,
+          no_rum_no_observer_name: aggregatedTransactionsProperties,
+          only_rum: aggregatedTransactionsProperties,
+          only_rum_no_observer_name: aggregatedTransactionsProperties,
+        },
+      },
       cloud: {
         properties: {
           availability_zone: keyword,
@@ -117,8 +135,8 @@ export function getApmTelemetryMapping() {
           client: {
             properties: {
               geo: {
-                properites: {
-                  country_iso_code: { rum: oneDayProperties },
+                properties: {
+                  country_iso_code: { properties: { rum: oneDayProperties } },
                 },
               },
             },
@@ -204,6 +222,7 @@ export function getApmTelemetryMapping() {
       },
       tasks: {
         properties: {
+          aggregated_transactions: tookProperties,
           agent_configuration: tookProperties,
           agents: tookProperties,
           cardinality: tookProperties,
@@ -230,3 +249,16 @@ export function getApmTelemetryMapping() {
     },
   };
 }
+
+/**
+ * Merge a telemetry mapping object (from https://github.com/elastic/telemetry/blob/master/config/templates/xpack-phone-home.json)
+ * with the output from `getApmTelemetryMapping`.
+ */
+export function mergeApmTelemetryMapping(
+  xpackPhoneHomeMapping: Record<string, any>
+) {
+  return produce(xpackPhoneHomeMapping, (draft: Record<string, any>) => {
+    draft.mappings.properties.stack_stats.properties.kibana.properties.plugins.properties.apm = getApmTelemetryMapping();
+    return draft;
+  });
+}
diff --git a/x-pack/plugins/apm/common/elasticsearch_fieldnames.test.ts b/x-pack/plugins/apm/common/elasticsearch_fieldnames.test.ts
index a9eb95cf37d4d..2b9b2c85e0bb5 100644
--- a/x-pack/plugins/apm/common/elasticsearch_fieldnames.test.ts
+++ b/x-pack/plugins/apm/common/elasticsearch_fieldnames.test.ts
@@ -16,6 +16,7 @@ describe('Transaction', () => {
     '@timestamp': new Date().toString(),
     '@metadata': 'whatever',
     observer: {
+      name: 'an observer',
       version: 'whatever',
       version_major: 8,
     },
@@ -72,6 +73,7 @@ describe('Span', () => {
     '@timestamp': new Date().toString(),
     '@metadata': 'whatever',
     observer: {
+      name: 'an observer',
       version: 'whatever',
       version_major: 8,
     },
@@ -124,6 +126,7 @@ describe('Error', () => {
   const errorDoc: AllowUnknownProperties<APMError> = {
     '@metadata': 'whatever',
     observer: {
+      name: 'an observer',
       version: 'whatever',
       version_major: 8,
     },
diff --git a/x-pack/plugins/apm/common/elasticsearch_fieldnames.ts b/x-pack/plugins/apm/common/elasticsearch_fieldnames.ts
index d8d3827909b07..610a32e8e9b99 100644
--- a/x-pack/plugins/apm/common/elasticsearch_fieldnames.ts
+++ b/x-pack/plugins/apm/common/elasticsearch_fieldnames.ts
@@ -31,6 +31,7 @@ export const USER_AGENT_NAME = 'user_agent.name';
 
 export const DESTINATION_ADDRESS = 'destination.address';
 
+export const OBSERVER_NAME = 'observer.name';
 export const OBSERVER_VERSION_MAJOR = 'observer.version_major';
 export const OBSERVER_LISTENING = 'observer.listening';
 export const PROCESSOR_EVENT = 'processor.event';
diff --git a/x-pack/plugins/apm/e2e/cypress/support/step_definitions/rum/rum_dashboard.ts b/x-pack/plugins/apm/e2e/cypress/support/step_definitions/rum/rum_dashboard.ts
index ac7aaf33b7849..8e010d5180f88 100644
--- a/x-pack/plugins/apm/e2e/cypress/support/step_definitions/rum/rum_dashboard.ts
+++ b/x-pack/plugins/apm/e2e/cypress/support/step_definitions/rum/rum_dashboard.ts
@@ -61,7 +61,10 @@ Then(`should display chart legend`, () => {
   cy.get('kbnLoadingIndicator').should('not.be.visible');
   cy.get('.euiLoadingChart').should('not.be.visible');
 
-  cy.get(chartLegend).eq(0).invoke('text').snapshot();
+  cy.get(chartLegend, { timeout: DEFAULT_TIMEOUT })
+    .eq(0)
+    .invoke('text')
+    .snapshot();
 });
 
 Then(`should display tooltip on hover`, () => {
@@ -73,7 +76,7 @@ Then(`should display tooltip on hover`, () => {
   cy.get('kbnLoadingIndicator').should('not.be.visible');
   cy.get('.euiLoadingChart').should('not.be.visible');
 
-  const marker = cy.get(pMarkers).eq(0);
+  const marker = cy.get(pMarkers, { timeout: DEFAULT_TIMEOUT }).eq(0);
   marker.invoke('show');
   marker.trigger('mouseover', { force: true });
   cy.get('span[data-cy=percentileTooltipTitle]').should('be.visible');
diff --git a/x-pack/plugins/apm/public/application/index.tsx b/x-pack/plugins/apm/public/application/index.tsx
index 0a6cca8434a85..c39afe6da215e 100644
--- a/x-pack/plugins/apm/public/application/index.tsx
+++ b/x-pack/plugins/apm/public/application/index.tsx
@@ -26,7 +26,6 @@ import {
 } from '../../../../../src/plugins/kibana_react/public';
 import { px, units } from '../style/variables';
 import { UpdateBreadcrumbs } from '../components/app/Main/UpdateBreadcrumbs';
-import { APMIndicesPermission } from '../components/app/APMIndicesPermission';
 import { ScrollToTopOnPathChange } from '../components/app/Main/ScrollToTopOnPathChange';
 import { routes } from '../components/app/Main/route_config';
 import { history, resetHistory } from '../utils/history';
@@ -52,13 +51,11 @@ const App = () => {
       <MainContainer data-test-subj="apmMainContainer" role="main">
         <UpdateBreadcrumbs routes={routes} />
         <Route component={ScrollToTopOnPathChange} />
-        <APMIndicesPermission>
-          <Switch>
-            {routes.map((route, i) => (
-              <ApmRoute key={i} {...route} />
-            ))}
-          </Switch>
-        </APMIndicesPermission>
+        <Switch>
+          {routes.map((route, i) => (
+            <ApmRoute key={i} {...route} />
+          ))}
+        </Switch>
       </MainContainer>
     </ThemeProvider>
   );
diff --git a/x-pack/plugins/apm/public/components/app/APMIndicesPermission/index.test.tsx b/x-pack/plugins/apm/public/components/app/APMIndicesPermission/index.test.tsx
deleted file mode 100644
index f5d3edf98662e..0000000000000
--- a/x-pack/plugins/apm/public/components/app/APMIndicesPermission/index.test.tsx
+++ /dev/null
@@ -1,151 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-import React from 'react';
-import { render, fireEvent, act } from '@testing-library/react';
-import { shallow } from 'enzyme';
-import { APMIndicesPermission } from './';
-
-import * as hooks from '../../../hooks/useFetcher';
-import {
-  expectTextsInDocument,
-  expectTextsNotInDocument,
-} from '../../../utils/testHelpers';
-import { MockApmPluginContextWrapper } from '../../../context/ApmPluginContext/MockApmPluginContext';
-
-describe('APMIndicesPermission', () => {
-  it('returns empty component when api status is loading', () => {
-    jest.spyOn(hooks, 'useFetcher').mockReturnValue({
-      status: hooks.FETCH_STATUS.LOADING,
-      refetch: jest.fn(),
-    });
-    const component = shallow(<APMIndicesPermission />);
-    expect(component.isEmptyRender()).toBeTruthy();
-  });
-  it('returns empty component when api status is pending', () => {
-    jest.spyOn(hooks, 'useFetcher').mockReturnValue({
-      status: hooks.FETCH_STATUS.PENDING,
-      refetch: jest.fn(),
-    });
-    const component = shallow(<APMIndicesPermission />);
-    expect(component.isEmptyRender()).toBeTruthy();
-  });
-  it('renders missing permission page', () => {
-    jest.spyOn(hooks, 'useFetcher').mockReturnValue({
-      status: hooks.FETCH_STATUS.SUCCESS,
-      data: {
-        has_all_requested: false,
-        index: {
-          'apm-*': { read: false },
-        },
-      },
-      refetch: jest.fn(),
-    });
-    const component = render(
-      <MockApmPluginContextWrapper>
-        <APMIndicesPermission />
-      </MockApmPluginContextWrapper>
-    );
-    expectTextsInDocument(component, [
-      'Missing permissions to access APM',
-      'Dismiss',
-      'apm-*',
-    ]);
-  });
-
-  it('shows children component when no index is returned', () => {
-    jest.spyOn(hooks, 'useFetcher').mockReturnValue({
-      status: hooks.FETCH_STATUS.SUCCESS,
-      data: {
-        has_all_requested: false,
-        index: {},
-      },
-      refetch: jest.fn(),
-    });
-    const component = render(
-      <MockApmPluginContextWrapper>
-        <APMIndicesPermission>
-          <p>My amazing component</p>
-        </APMIndicesPermission>
-      </MockApmPluginContextWrapper>
-    );
-    expectTextsNotInDocument(component, ['Missing permissions to access APM']);
-    expectTextsInDocument(component, ['My amazing component']);
-  });
-
-  it('shows children component when indices have read privileges', () => {
-    jest.spyOn(hooks, 'useFetcher').mockReturnValue({
-      status: hooks.FETCH_STATUS.SUCCESS,
-      data: {
-        has_all_requested: true,
-        index: {},
-      },
-      refetch: jest.fn(),
-    });
-    const component = render(
-      <MockApmPluginContextWrapper>
-        <APMIndicesPermission>
-          <p>My amazing component</p>
-        </APMIndicesPermission>
-      </MockApmPluginContextWrapper>
-    );
-    expectTextsNotInDocument(component, ['Missing permissions to access APM']);
-    expectTextsInDocument(component, ['My amazing component']);
-  });
-
-  it('dismesses the warning by clicking on the escape hatch', () => {
-    jest.spyOn(hooks, 'useFetcher').mockReturnValue({
-      status: hooks.FETCH_STATUS.SUCCESS,
-      data: {
-        has_all_requested: false,
-        index: {
-          'apm-error-*': { read: false },
-          'apm-trasanction-*': { read: false },
-          'apm-metrics-*': { read: true },
-          'apm-span-*': { read: true },
-        },
-      },
-      refetch: jest.fn(),
-    });
-    const component = render(
-      <MockApmPluginContextWrapper>
-        <APMIndicesPermission>
-          <p>My amazing component</p>
-        </APMIndicesPermission>
-      </MockApmPluginContextWrapper>
-    );
-    expectTextsInDocument(component, [
-      'Dismiss',
-      'apm-error-*',
-      'apm-trasanction-*',
-    ]);
-    act(() => {
-      fireEvent.click(component.getByText('Dismiss'));
-    });
-    expectTextsInDocument(component, ['My amazing component']);
-  });
-
-  it("shows children component when api doesn't return value", () => {
-    jest.spyOn(hooks, 'useFetcher').mockReturnValue({
-      status: hooks.FETCH_STATUS.SUCCESS,
-      refetch: jest.fn(),
-    });
-    const component = render(
-      <MockApmPluginContextWrapper>
-        <APMIndicesPermission>
-          <p>My amazing component</p>
-        </APMIndicesPermission>
-      </MockApmPluginContextWrapper>
-    );
-    expectTextsNotInDocument(component, [
-      'Missing permissions to access APM',
-      'apm-7.5.1-error-*',
-      'apm-7.5.1-metric-*',
-      'apm-7.5.1-transaction-*',
-      'apm-7.5.1-span-*',
-    ]);
-    expectTextsInDocument(component, ['My amazing component']);
-  });
-});
diff --git a/x-pack/plugins/apm/public/components/app/APMIndicesPermission/index.tsx b/x-pack/plugins/apm/public/components/app/APMIndicesPermission/index.tsx
deleted file mode 100644
index f55f26fe7fc3c..0000000000000
--- a/x-pack/plugins/apm/public/components/app/APMIndicesPermission/index.tsx
+++ /dev/null
@@ -1,167 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import {
-  EuiButton,
-  EuiEmptyPrompt,
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiLink,
-  EuiPanel,
-  EuiText,
-  EuiTitle,
-} from '@elastic/eui';
-import { i18n } from '@kbn/i18n';
-import React, { useState } from 'react';
-import styled from 'styled-components';
-import { isEmpty } from 'lodash';
-import { FETCH_STATUS, useFetcher } from '../../../hooks/useFetcher';
-import { fontSize, pct, px, units } from '../../../style/variables';
-import { ElasticDocsLink } from '../../shared/Links/ElasticDocsLink';
-import { SetupInstructionsLink } from '../../shared/Links/SetupInstructionsLink';
-
-export const APMIndicesPermission: React.FC = ({ children }) => {
-  const [
-    isPermissionWarningDismissed,
-    setIsPermissionWarningDismissed,
-  ] = useState(false);
-
-  const { data: indicesPrivileges, status } = useFetcher((callApmApi) => {
-    return callApmApi({
-      pathname: '/api/apm/security/indices_privileges',
-    });
-  }, []);
-
-  // Return null until receive the reponse of the api.
-  if (status === FETCH_STATUS.LOADING || status === FETCH_STATUS.PENDING) {
-    return null;
-  }
-
-  // Show permission warning when a user has at least one index without Read privilege,
-  // and they have not manually dismissed the warning
-  if (
-    indicesPrivileges &&
-    !indicesPrivileges.has_all_requested &&
-    !isEmpty(indicesPrivileges.index) &&
-    !isPermissionWarningDismissed
-  ) {
-    const indicesWithoutPermission = Object.keys(
-      indicesPrivileges.index
-    ).filter((index) => !indicesPrivileges.index[index].read);
-    return (
-      <PermissionWarning
-        indicesWithoutPermission={indicesWithoutPermission}
-        onEscapeHatchClick={() => setIsPermissionWarningDismissed(true)}
-      />
-    );
-  }
-
-  return <>{children}</>;
-};
-
-const CentralizedContainer = styled.div`
-  height: ${pct(100)};
-  display: flex;
-  justify-content: center;
-  align-items: center;
-`;
-
-const EscapeHatch = styled.div`
-  width: ${pct(100)};
-  margin-top: ${px(units.plus)};
-  justify-content: center;
-  display: flex;
-`;
-
-interface Props {
-  indicesWithoutPermission: string[];
-  onEscapeHatchClick: () => void;
-}
-
-const PermissionWarning = ({
-  indicesWithoutPermission,
-  onEscapeHatchClick,
-}: Props) => {
-  return (
-    <div style={{ height: pct(95) }}>
-      <EuiFlexGroup alignItems="center">
-        <EuiFlexItem grow={false}>
-          <EuiTitle size="l">
-            <h1>
-              {i18n.translate('xpack.apm.permission.apm', {
-                defaultMessage: 'APM',
-              })}
-            </h1>
-          </EuiTitle>
-        </EuiFlexItem>
-        <EuiFlexItem grow={false}>
-          <SetupInstructionsLink />
-        </EuiFlexItem>
-      </EuiFlexGroup>
-      <CentralizedContainer>
-        <div>
-          <EuiPanel paddingSize="none">
-            <EuiEmptyPrompt
-              iconType="apmApp"
-              iconColor={''}
-              title={
-                <h2>
-                  {i18n.translate('xpack.apm.permission.title', {
-                    defaultMessage: 'Missing permissions to access APM',
-                  })}
-                </h2>
-              }
-              body={
-                <>
-                  <p>
-                    {i18n.translate('xpack.apm.permission.description', {
-                      defaultMessage:
-                        "Your user doesn't have access to all APM indices. You can still use the APM app but some data may be missing. You must be granted access to the following indices:",
-                    })}
-                  </p>
-                  <ul style={{ listStyleType: 'none' }}>
-                    {indicesWithoutPermission.map((index) => (
-                      <li key={index} style={{ marginTop: units.half }}>
-                        <EuiText size="s">{index}</EuiText>
-                      </li>
-                    ))}
-                  </ul>
-                </>
-              }
-              actions={
-                <>
-                  <ElasticDocsLink
-                    section="/apm/server"
-                    path="/feature-roles.html"
-                  >
-                    {(href: string) => (
-                      <EuiButton color="primary" fill href={href}>
-                        {i18n.translate('xpack.apm.permission.learnMore', {
-                          defaultMessage: 'Learn more about APM permissions',
-                        })}
-                      </EuiButton>
-                    )}
-                  </ElasticDocsLink>
-                  <EscapeHatch>
-                    <EuiLink
-                      color="subdued"
-                      onClick={onEscapeHatchClick}
-                      style={{ fontSize }}
-                    >
-                      {i18n.translate('xpack.apm.permission.dismissWarning', {
-                        defaultMessage: 'Dismiss',
-                      })}
-                    </EuiLink>
-                  </EscapeHatch>
-                </>
-              }
-            />
-          </EuiPanel>
-        </div>
-      </CentralizedContainer>
-    </div>
-  );
-};
diff --git a/x-pack/plugins/apm/public/components/app/ServiceMap/Popover/ServiceStatsList.tsx b/x-pack/plugins/apm/public/components/app/ServiceMap/Popover/ServiceStatsList.tsx
index 4a1a291249f50..be52018735099 100644
--- a/x-pack/plugins/apm/public/components/app/ServiceMap/Popover/ServiceStatsList.tsx
+++ b/x-pack/plugins/apm/public/components/app/ServiceMap/Popover/ServiceStatsList.tsx
@@ -59,7 +59,7 @@ export function ServiceStatsList({
     },
     {
       title: i18n.translate('xpack.apm.serviceMap.errorRatePopoverStat', {
-        defaultMessage: 'Error rate (avg.)',
+        defaultMessage: 'Trans. error rate (avg.)',
       }),
       description: isNumber(avgErrorRate) ? asPercent(avgErrorRate, 1) : null,
     },
diff --git a/x-pack/plugins/apm/scripts/package.json b/x-pack/plugins/apm/scripts/package.json
index c5a9df792f856..4d0906514b5e1 100644
--- a/x-pack/plugins/apm/scripts/package.json
+++ b/x-pack/plugins/apm/scripts/package.json
@@ -4,7 +4,7 @@
   "main": "index.js",
   "license": "MIT",
   "dependencies": {
-    "@elastic/elasticsearch": "^7.6.1",
+    "@elastic/elasticsearch": "7.9.0-rc.1",
     "@octokit/rest": "^16.35.0",
     "@types/console-stamp": "^0.2.32",
     "console-stamp": "^0.2.9",
diff --git a/x-pack/plugins/apm/server/lib/apm_telemetry/collect_data_telemetry/tasks.test.ts b/x-pack/plugins/apm/server/lib/apm_telemetry/collect_data_telemetry/tasks.test.ts
index ea2b57c01acff..eafd0f04b9d10 100644
--- a/x-pack/plugins/apm/server/lib/apm_telemetry/collect_data_telemetry/tasks.test.ts
+++ b/x-pack/plugins/apm/server/lib/apm_telemetry/collect_data_telemetry/tasks.test.ts
@@ -4,8 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { tasks } from './tasks';
+import { AGENT_NAME } from '../../../../common/elasticsearch_fieldnames';
 import { ApmIndicesConfig } from '../../settings/apm_indices/get_apm_indices';
+import { tasks } from './tasks';
 
 describe('data telemetry collection tasks', () => {
   const indices = {
@@ -15,6 +16,109 @@ describe('data telemetry collection tasks', () => {
     'apm_oss.transactionIndices': 'apm-8.0.0-transaction',
   } as ApmIndicesConfig;
 
+  describe('aggregated_transactions', () => {
+    const task = tasks.find((t) => t.name === 'aggregated_transactions');
+
+    it('returns aggregated transaction counts', async () => {
+      // This mock implementation returns different values based on the parameters,
+      // which should simulate all the queries that are done. For most of them we'll
+      // simulate the number of buckets by using the length of the key, but for a
+      // couple we'll simulate being paginated by returning an after_key.
+      const search = jest.fn().mockImplementation((params) => {
+        const isRumResult =
+          params.body.query.bool.filter &&
+          params.body.query.bool.filter.some(
+            (filter: any) =>
+              filter.terms && filter.terms[AGENT_NAME]?.includes('rum-js')
+          );
+        const isNonRumResult =
+          params.body.query.bool.filter &&
+          params.body.query.bool.filter.some(
+            (filter: any) =>
+              filter.terms && !filter.terms[AGENT_NAME]?.includes('rum-js')
+          );
+        const isPagedResult =
+          !!params.body.aggs?.current_implementation?.composite.after ||
+          !!params.body.aggs?.no_observer_name?.composite.after;
+        const isTotalResult = 'track_total_hits' in params.body;
+        const key = Object.keys(params.body.aggs ?? [])[0];
+
+        if (isRumResult) {
+          if (isTotalResult) {
+            return Promise.resolve({ hits: { total: { value: 3000 } } });
+          }
+        }
+
+        if (isNonRumResult) {
+          if (isTotalResult) {
+            return Promise.resolve({ hits: { total: { value: 2000 } } });
+          }
+        }
+
+        if (isPagedResult && key) {
+          return Promise.resolve({
+            hits: { total: { value: key.length } },
+            aggregations: { [key]: { buckets: [{}] } },
+          });
+        }
+
+        if (isTotalResult) {
+          return Promise.resolve({ hits: { total: { value: 1000 } } });
+        }
+
+        if (
+          key === 'current_implementation' ||
+          (key === 'no_observer_name' && !isPagedResult)
+        ) {
+          return Promise.resolve({
+            hits: { total: { value: key.length } },
+            aggregations: {
+              [key]: { after_key: {}, buckets: key.split('').map((_) => ({})) },
+            },
+          });
+        }
+
+        if (key) {
+          return Promise.resolve({
+            hits: { total: { value: key.length } },
+            aggregations: {
+              [key]: { buckets: key.split('').map((_) => ({})) },
+            },
+          });
+        }
+      });
+
+      expect(await task?.executor({ indices, search } as any)).toEqual({
+        aggregated_transactions: {
+          current_implementation: {
+            expected_metric_document_count: 23,
+            transaction_count: 1000,
+          },
+          no_observer_name: {
+            expected_metric_document_count: 17,
+            transaction_count: 1000,
+          },
+          no_rum: {
+            expected_metric_document_count: 6,
+            transaction_count: 2000,
+          },
+          no_rum_no_observer_name: {
+            expected_metric_document_count: 23,
+            transaction_count: 2000,
+          },
+          only_rum: {
+            expected_metric_document_count: 8,
+            transaction_count: 3000,
+          },
+          only_rum_no_observer_name: {
+            expected_metric_document_count: 25,
+            transaction_count: 3000,
+          },
+        },
+      });
+    });
+  });
+
   describe('cloud', () => {
     const task = tasks.find((t) => t.name === 'cloud');
 
diff --git a/x-pack/plugins/apm/server/lib/apm_telemetry/collect_data_telemetry/tasks.ts b/x-pack/plugins/apm/server/lib/apm_telemetry/collect_data_telemetry/tasks.ts
index 2ecb5a935893f..840f47b043418 100644
--- a/x-pack/plugins/apm/server/lib/apm_telemetry/collect_data_telemetry/tasks.ts
+++ b/x-pack/plugins/apm/server/lib/apm_telemetry/collect_data_telemetry/tasks.ts
@@ -5,7 +5,7 @@
  */
 import { flatten, merge, sortBy, sum } from 'lodash';
 import { TelemetryTask } from '.';
-import { AGENT_NAMES } from '../../../../common/agent_name';
+import { AGENT_NAMES, RUM_AGENTS } from '../../../../common/agent_name';
 import {
   AGENT_NAME,
   AGENT_VERSION,
@@ -13,9 +13,14 @@ import {
   CLOUD_AVAILABILITY_ZONE,
   CLOUD_PROVIDER,
   CLOUD_REGION,
+  CONTAINER_ID,
   ERROR_GROUP_ID,
+  HOST_NAME,
+  OBSERVER_NAME,
   PARENT_ID,
+  POD_NAME,
   PROCESSOR_EVENT,
+  SERVICE_ENVIRONMENT,
   SERVICE_FRAMEWORK_NAME,
   SERVICE_FRAMEWORK_VERSION,
   SERVICE_LANGUAGE_NAME,
@@ -23,9 +28,14 @@ import {
   SERVICE_NAME,
   SERVICE_RUNTIME_NAME,
   SERVICE_RUNTIME_VERSION,
+  SERVICE_VERSION,
   TRANSACTION_NAME,
+  TRANSACTION_RESULT,
+  TRANSACTION_TYPE,
+  USER_AGENT_NAME,
   USER_AGENT_ORIGINAL,
 } from '../../../../common/elasticsearch_fieldnames';
+import { ESFilter } from '../../../../typings/elasticsearch';
 import { APMError } from '../../../../typings/es_schemas/ui/apm_error';
 import { AgentName } from '../../../../typings/es_schemas/ui/fields/agent';
 import { Span } from '../../../../typings/es_schemas/ui/span';
@@ -39,6 +49,166 @@ const range1d = { range: { '@timestamp': { gte: 'now-1d' } } };
 const timeout = '5m';
 
 export const tasks: TelemetryTask[] = [
+  {
+    name: 'aggregated_transactions',
+    // Record the number of metric documents we can expect in different scenarios. We simulate this by requesting data for 1m,
+    // adding a composite aggregation on a number of fields and counting the number of buckets. The resulting count is an
+    // approximation of the amount of metric documents that will be created. We record both the expected metric document count plus
+    // the transaction count for that time range.
+    executor: async ({ indices, search }) => {
+      async function getBucketCountFromPaginatedQuery(
+        key: string,
+        filter: ESFilter[],
+        count: number = 0,
+        after?: any
+      ) {
+        const params = {
+          index: [indices['apm_oss.transactionIndices']],
+          body: {
+            size: 0,
+            timeout,
+            query: { bool: { filter } },
+            aggs: {
+              [key]: {
+                composite: {
+                  ...(after ? { after } : {}),
+                  size: 10000,
+                  sources: fieldMap[key].map((field) => ({
+                    [field]: { terms: { field, missing_bucket: true } },
+                  })),
+                },
+              },
+            },
+          },
+        };
+        const result = await search(params);
+        let nextAfter: any;
+
+        if (result.aggregations) {
+          nextAfter = result.aggregations[key].after_key;
+          count += result.aggregations[key].buckets.length;
+        }
+
+        if (nextAfter) {
+          count = await getBucketCountFromPaginatedQuery(
+            key,
+            filter,
+            count,
+            nextAfter
+          );
+        }
+
+        return count;
+      }
+
+      async function totalSearch(filter: ESFilter[]) {
+        const result = await search({
+          index: [indices['apm_oss.transactionIndices']],
+          body: {
+            size: 0,
+            timeout,
+            query: { bool: { filter } },
+            track_total_hits: true,
+          },
+        });
+
+        return result.hits.total.value;
+      }
+
+      const nonRumAgentNames = AGENT_NAMES.filter(
+        (name) => !RUM_AGENTS.includes(name)
+      );
+
+      const filter: ESFilter[] = [
+        { term: { [PROCESSOR_EVENT]: 'transaction' } },
+        { range: { '@timestamp': { gte: 'now-1m' } } },
+      ];
+      const noRumFilter = [
+        ...filter,
+        { terms: { [AGENT_NAME]: nonRumAgentNames } },
+      ];
+      const rumFilter = [...filter, { terms: { [AGENT_NAME]: RUM_AGENTS } }];
+
+      const baseFields = [
+        TRANSACTION_NAME,
+        TRANSACTION_RESULT,
+        TRANSACTION_TYPE,
+        AGENT_NAME,
+        SERVICE_ENVIRONMENT,
+        SERVICE_VERSION,
+        HOST_NAME,
+        CONTAINER_ID,
+        POD_NAME,
+      ];
+
+      const fieldMap: Record<string, string[]> = {
+        current_implementation: [OBSERVER_NAME, ...baseFields, USER_AGENT_NAME],
+        no_observer_name: [...baseFields, USER_AGENT_NAME],
+        no_rum: [OBSERVER_NAME, ...baseFields],
+        no_rum_no_observer_name: baseFields,
+        only_rum: [OBSERVER_NAME, ...baseFields, USER_AGENT_NAME],
+        only_rum_no_observer_name: [...baseFields, USER_AGENT_NAME],
+      };
+
+      // It would be more performant to do these in parallel, but we have different filters and keys and it's easier to
+      // understand if we make the code slower and longer
+      const countMap: Record<string, number> = {
+        current_implementation: await getBucketCountFromPaginatedQuery(
+          'current_implementation',
+          filter
+        ),
+        no_observer_name: await getBucketCountFromPaginatedQuery(
+          'no_observer_name',
+          filter
+        ),
+        no_rum: await getBucketCountFromPaginatedQuery('no_rum', noRumFilter),
+        no_rum_no_observer_name: await getBucketCountFromPaginatedQuery(
+          'no_rum_no_observer_name',
+          noRumFilter
+        ),
+        only_rum: await getBucketCountFromPaginatedQuery('only_rum', rumFilter),
+        only_rum_no_observer_name: await getBucketCountFromPaginatedQuery(
+          'only_rum_no_observer_name',
+          rumFilter
+        ),
+      };
+
+      const [allCount, noRumCount, rumCount] = await Promise.all([
+        totalSearch(filter),
+        totalSearch(noRumFilter),
+        totalSearch(rumFilter),
+      ]);
+
+      return {
+        aggregated_transactions: {
+          current_implementation: {
+            transaction_count: allCount,
+            expected_metric_document_count: countMap.current_implementation,
+          },
+          no_observer_name: {
+            transaction_count: allCount,
+            expected_metric_document_count: countMap.no_observer_name,
+          },
+          no_rum: {
+            transaction_count: noRumCount,
+            expected_metric_document_count: countMap.no_rum,
+          },
+          no_rum_no_observer_name: {
+            transaction_count: noRumCount,
+            expected_metric_document_count: countMap.no_rum_no_observer_name,
+          },
+          only_rum: {
+            transaction_count: rumCount,
+            expected_metric_document_count: countMap.only_rum,
+          },
+          only_rum_no_observer_name: {
+            transaction_count: rumCount,
+            expected_metric_document_count: countMap.only_rum_no_observer_name,
+          },
+        },
+      };
+    },
+  },
   {
     name: 'cloud',
     executor: async ({ indices, search }) => {
@@ -742,10 +912,7 @@ export const tasks: TelemetryTask[] = [
           timeout,
           query: {
             bool: {
-              filter: [
-                range1d,
-                { terms: { [AGENT_NAME]: ['rum-js', 'js-base'] } },
-              ],
+              filter: [range1d, { terms: { [AGENT_NAME]: RUM_AGENTS } }],
             },
           },
           aggs: {
diff --git a/x-pack/plugins/apm/server/lib/apm_telemetry/types.ts b/x-pack/plugins/apm/server/lib/apm_telemetry/types.ts
index 4c376aac52f5b..82e4d1e395ed3 100644
--- a/x-pack/plugins/apm/server/lib/apm_telemetry/types.ts
+++ b/x-pack/plugins/apm/server/lib/apm_telemetry/types.ts
@@ -15,6 +15,11 @@ export interface TimeframeMap {
 export type TimeframeMap1d = Pick<TimeframeMap, '1d'>;
 export type TimeframeMapAll = Pick<TimeframeMap, 'all'>;
 
+export interface AggregatedTransactionsCounts {
+  expected_metric_document_count: number;
+  transaction_count: number;
+}
+
 export type APMDataTelemetry = DeepPartial<{
   has_any_services: boolean;
   services_per_agent: Record<AgentName, number>;
@@ -25,6 +30,14 @@ export type APMDataTelemetry = DeepPartial<{
       patch: number;
     };
   };
+  aggregated_transactions: {
+    current_implementation: AggregatedTransactionsCounts;
+    no_observer_name: AggregatedTransactionsCounts;
+    no_rum: AggregatedTransactionsCounts;
+    no_rum_no_observer_name: AggregatedTransactionsCounts;
+    only_rum: AggregatedTransactionsCounts;
+    only_rum_no_observer_name: AggregatedTransactionsCounts;
+  };
   cloud: {
     availability_zone: string[];
     provider: string[];
@@ -108,6 +121,7 @@ export type APMDataTelemetry = DeepPartial<{
     };
   };
   tasks: Record<
+    | 'aggregated_transactions'
     | 'cloud'
     | 'processor_events'
     | 'agent_configuration'
diff --git a/x-pack/plugins/apm/server/lib/security/get_indices_privileges.test.ts b/x-pack/plugins/apm/server/lib/security/get_indices_privileges.test.ts
deleted file mode 100644
index 9665d231d20a9..0000000000000
--- a/x-pack/plugins/apm/server/lib/security/get_indices_privileges.test.ts
+++ /dev/null
@@ -1,148 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-import { Setup } from '../helpers/setup_request';
-import { getIndicesPrivileges } from './get_indices_privileges';
-
-describe('getIndicesPrivileges', () => {
-  const indices = {
-    apm_oss: {
-      errorIndices: 'apm-*',
-      metricsIndices: 'apm-*',
-      transactionIndices: 'apm-*',
-      spanIndices: 'apm-*',
-    },
-  };
-  it('return that the user has privileges when security plugin is disabled', async () => {
-    const setup = ({
-      indices,
-      client: {
-        hasPrivileges: () => {
-          const error = {
-            message:
-              'no handler found for uri [/_security/user/_has_privileges]',
-            statusCode: 400,
-          };
-          throw error;
-        },
-      },
-    } as unknown) as Setup;
-    const privileges = await getIndicesPrivileges({
-      setup,
-      isSecurityPluginEnabled: false,
-    });
-    expect(privileges).toEqual({
-      has_all_requested: true,
-      index: {},
-    });
-  });
-  it('throws when an error happens while fetching indices privileges', async () => {
-    const setup = ({
-      indices,
-      client: {
-        hasPrivileges: () => {
-          throw new Error('unknow error');
-        },
-      },
-    } as unknown) as Setup;
-    await expect(
-      getIndicesPrivileges({ setup, isSecurityPluginEnabled: true })
-    ).rejects.toThrowError('unknow error');
-  });
-  it("has privileges to read from 'apm-*'", async () => {
-    const setup = ({
-      indices,
-      client: {
-        hasPrivileges: () => {
-          return Promise.resolve({
-            has_all_requested: true,
-            index: { 'apm-*': { read: true } },
-          });
-        },
-      },
-    } as unknown) as Setup;
-    const privileges = await getIndicesPrivileges({
-      setup,
-      isSecurityPluginEnabled: true,
-    });
-
-    expect(privileges).toEqual({
-      has_all_requested: true,
-      index: {
-        'apm-*': {
-          read: true,
-        },
-      },
-    });
-  });
-
-  it("doesn't have privileges to read from 'apm-*'", async () => {
-    const setup = ({
-      indices,
-      client: {
-        hasPrivileges: () => {
-          return Promise.resolve({
-            has_all_requested: false,
-            index: { 'apm-*': { read: false } },
-          });
-        },
-      },
-    } as unknown) as Setup;
-
-    const privileges = await getIndicesPrivileges({
-      setup,
-      isSecurityPluginEnabled: true,
-    });
-
-    expect(privileges).toEqual({
-      has_all_requested: false,
-      index: {
-        'apm-*': {
-          read: false,
-        },
-      },
-    });
-  });
-  it("doesn't have privileges on multiple indices", async () => {
-    const setup = ({
-      indices: {
-        apm_oss: {
-          errorIndices: 'apm-error-*',
-          metricsIndices: 'apm-metrics-*',
-          transactionIndices: 'apm-trasanction-*',
-          spanIndices: 'apm-span-*',
-        },
-      },
-      client: {
-        hasPrivileges: () => {
-          return Promise.resolve({
-            has_all_requested: false,
-            index: {
-              'apm-error-*': { read: false },
-              'apm-trasanction-*': { read: false },
-              'apm-metrics-*': { read: true },
-              'apm-span-*': { read: true },
-            },
-          });
-        },
-      },
-    } as unknown) as Setup;
-
-    const privileges = await getIndicesPrivileges({
-      setup,
-      isSecurityPluginEnabled: true,
-    });
-
-    expect(privileges).toEqual({
-      has_all_requested: false,
-      index: {
-        'apm-error-*': { read: false },
-        'apm-trasanction-*': { read: false },
-        'apm-metrics-*': { read: true },
-        'apm-span-*': { read: true },
-      },
-    });
-  });
-});
diff --git a/x-pack/plugins/apm/server/lib/security/get_indices_privileges.ts b/x-pack/plugins/apm/server/lib/security/get_indices_privileges.ts
deleted file mode 100644
index 729a81a13b8cf..0000000000000
--- a/x-pack/plugins/apm/server/lib/security/get_indices_privileges.ts
+++ /dev/null
@@ -1,36 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-import { Setup } from '../helpers/setup_request';
-import { IndexPrivileges } from '../helpers/es_client';
-
-export async function getIndicesPrivileges({
-  setup,
-  isSecurityPluginEnabled,
-}: {
-  setup: Setup;
-  isSecurityPluginEnabled: boolean;
-}): Promise<IndexPrivileges> {
-  // When security plugin is not enabled, returns that the user has all requested privileges.
-  if (!isSecurityPluginEnabled) {
-    return { has_all_requested: true, index: {} };
-  }
-
-  const { client, indices } = setup;
-  const response = await client.hasPrivileges({
-    index: [
-      {
-        names: [
-          indices['apm_oss.errorIndices'],
-          indices['apm_oss.metricsIndices'],
-          indices['apm_oss.transactionIndices'],
-          indices['apm_oss.spanIndices'],
-        ],
-        privileges: ['read'],
-      },
-    ],
-  });
-  return response;
-}
diff --git a/x-pack/plugins/apm/server/routes/create_apm_api.ts b/x-pack/plugins/apm/server/routes/create_apm_api.ts
index 11911cda79c17..5dff13e5b37e0 100644
--- a/x-pack/plugins/apm/server/routes/create_apm_api.ts
+++ b/x-pack/plugins/apm/server/routes/create_apm_api.ts
@@ -63,7 +63,6 @@ import {
 } from './ui_filters';
 import { createApi } from './create_api';
 import { serviceMapRoute, serviceMapServiceNodeRoute } from './service_map';
-import { indicesPrivilegesRoute } from './security';
 import {
   createCustomLinkRoute,
   updateCustomLinkRoute,
@@ -158,9 +157,6 @@ const createApmApi = () => {
     .add(serviceMapRoute)
     .add(serviceMapServiceNodeRoute)
 
-    // security
-    .add(indicesPrivilegesRoute)
-
     // Custom links
     .add(createCustomLinkRoute)
     .add(updateCustomLinkRoute)
diff --git a/x-pack/plugins/apm/server/routes/security.ts b/x-pack/plugins/apm/server/routes/security.ts
deleted file mode 100644
index ce5a7313012f2..0000000000000
--- a/x-pack/plugins/apm/server/routes/security.ts
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { createRoute } from './create_route';
-import { setupRequest } from '../lib/helpers/setup_request';
-import { getIndicesPrivileges } from '../lib/security/get_indices_privileges';
-
-export const indicesPrivilegesRoute = createRoute(() => ({
-  path: '/api/apm/security/indices_privileges',
-  handler: async ({ context, request }) => {
-    const setup = await setupRequest(context, request);
-    return getIndicesPrivileges({
-      setup,
-      isSecurityPluginEnabled:
-        context.plugins.security?.license.isEnabled() ?? false,
-    });
-  },
-}));
diff --git a/x-pack/plugins/apm/typings/es_schemas/raw/fields/observer.ts b/x-pack/plugins/apm/typings/es_schemas/raw/fields/observer.ts
index 42843130ec47f..0815b7cd88163 100644
--- a/x-pack/plugins/apm/typings/es_schemas/raw/fields/observer.ts
+++ b/x-pack/plugins/apm/typings/es_schemas/raw/fields/observer.ts
@@ -5,6 +5,7 @@
  */
 
 export interface Observer {
+  name?: string;
   version: string;
   version_major: number;
 }
diff --git a/x-pack/plugins/embeddable_enhanced/README.asciidoc b/x-pack/plugins/embeddable_enhanced/README.asciidoc
new file mode 100644
index 0000000000000..9a7fe9c2669d9
--- /dev/null
+++ b/x-pack/plugins/embeddable_enhanced/README.asciidoc
@@ -0,0 +1,6 @@
+[[enhanced-embeddables-plugin]]
+== Enhanced embeddables plugin
+
+Enhances Embeddables by registering a custom factory provider. The enhanced factory provider
+adds dynamic actions to every embeddables state, in order to support drilldowns.
+
diff --git a/x-pack/plugins/embeddable_enhanced/README.md b/x-pack/plugins/embeddable_enhanced/README.md
deleted file mode 100644
index a0be90731fdb0..0000000000000
--- a/x-pack/plugins/embeddable_enhanced/README.md
+++ /dev/null
@@ -1 +0,0 @@
-# X-Pack part of `embeddable` plugin
diff --git a/x-pack/plugins/event_log/kibana.json b/x-pack/plugins/event_log/kibana.json
index 7231d967b4c8d..0231bb6234471 100644
--- a/x-pack/plugins/event_log/kibana.json
+++ b/x-pack/plugins/event_log/kibana.json
@@ -3,6 +3,7 @@
   "version": "0.0.1",
   "kibanaVersion": "kibana",
   "configPath": ["xpack", "eventLog"],
+  "optionalPlugins": ["spaces"],
   "server": true,
   "ui": false
 }
diff --git a/x-pack/plugins/event_log/server/es/cluster_client_adapter.test.ts b/x-pack/plugins/event_log/server/es/cluster_client_adapter.test.ts
index ee6f0a301e9f8..6e787c905d400 100644
--- a/x-pack/plugins/event_log/server/es/cluster_client_adapter.test.ts
+++ b/x-pack/plugins/event_log/server/es/cluster_client_adapter.test.ts
@@ -4,10 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { LegacyClusterClient, Logger } from '../../../../../src/core/server';
-import { elasticsearchServiceMock, loggingSystemMock } from '../../../../../src/core/server/mocks';
+import { LegacyClusterClient, Logger } from 'src/core/server';
+import { elasticsearchServiceMock, loggingSystemMock } from 'src/core/server/mocks';
 import { ClusterClientAdapter, IClusterClientAdapter } from './cluster_client_adapter';
-import moment from 'moment';
 import { findOptionsSchema } from '../event_log_client';
 
 type EsClusterClient = Pick<jest.Mocked<LegacyClusterClient>, 'callAsInternalUser' | 'asScoped'>;
@@ -205,7 +204,7 @@ describe('createIndex', () => {
 describe('queryEventsBySavedObject', () => {
   const DEFAULT_OPTIONS = findOptionsSchema.validate({});
 
-  test('should call cluster with proper arguments', async () => {
+  test('should call cluster with proper arguments with non-default namespace', async () => {
     clusterClient.callAsInternalUser.mockResolvedValue({
       hits: {
         hits: [],
@@ -214,6 +213,7 @@ describe('queryEventsBySavedObject', () => {
     });
     await clusterClientAdapter.queryEventsBySavedObject(
       'index-name',
+      'namespace',
       'saved-object-type',
       'saved-object-id',
       DEFAULT_OPTIONS
@@ -221,52 +221,147 @@ describe('queryEventsBySavedObject', () => {
 
     const [method, query] = clusterClient.callAsInternalUser.mock.calls[0];
     expect(method).toEqual('search');
-    expect(query).toMatchObject({
-      index: 'index-name',
-      body: {
-        from: 0,
-        size: 10,
-        sort: { '@timestamp': { order: 'asc' } },
-        query: {
-          bool: {
-            must: [
-              {
-                nested: {
-                  path: 'kibana.saved_objects',
-                  query: {
-                    bool: {
-                      must: [
-                        {
-                          term: {
-                            'kibana.saved_objects.rel': {
-                              value: 'primary',
+    expect(query).toMatchInlineSnapshot(`
+      Object {
+        "body": Object {
+          "from": 0,
+          "query": Object {
+            "bool": Object {
+              "must": Array [
+                Object {
+                  "nested": Object {
+                    "path": "kibana.saved_objects",
+                    "query": Object {
+                      "bool": Object {
+                        "must": Array [
+                          Object {
+                            "term": Object {
+                              "kibana.saved_objects.rel": Object {
+                                "value": "primary",
+                              },
                             },
                           },
-                        },
-                        {
-                          term: {
-                            'kibana.saved_objects.type': {
-                              value: 'saved-object-type',
+                          Object {
+                            "term": Object {
+                              "kibana.saved_objects.type": Object {
+                                "value": "saved-object-type",
+                              },
                             },
                           },
-                        },
-                        {
-                          term: {
-                            'kibana.saved_objects.id': {
-                              value: 'saved-object-id',
+                          Object {
+                            "term": Object {
+                              "kibana.saved_objects.id": Object {
+                                "value": "saved-object-id",
+                              },
                             },
                           },
-                        },
-                      ],
+                          Object {
+                            "term": Object {
+                              "kibana.saved_objects.namespace": Object {
+                                "value": "namespace",
+                              },
+                            },
+                          },
+                        ],
+                      },
                     },
                   },
                 },
-              },
-            ],
+              ],
+            },
+          },
+          "size": 10,
+          "sort": Object {
+            "@timestamp": Object {
+              "order": "asc",
+            },
           },
         },
+        "index": "index-name",
+        "rest_total_hits_as_int": true,
+      }
+    `);
+  });
+
+  test('should call cluster with proper arguments with default namespace', async () => {
+    clusterClient.callAsInternalUser.mockResolvedValue({
+      hits: {
+        hits: [],
+        total: { value: 0 },
       },
     });
+    await clusterClientAdapter.queryEventsBySavedObject(
+      'index-name',
+      undefined,
+      'saved-object-type',
+      'saved-object-id',
+      DEFAULT_OPTIONS
+    );
+
+    const [method, query] = clusterClient.callAsInternalUser.mock.calls[0];
+    expect(method).toEqual('search');
+    expect(query).toMatchInlineSnapshot(`
+      Object {
+        "body": Object {
+          "from": 0,
+          "query": Object {
+            "bool": Object {
+              "must": Array [
+                Object {
+                  "nested": Object {
+                    "path": "kibana.saved_objects",
+                    "query": Object {
+                      "bool": Object {
+                        "must": Array [
+                          Object {
+                            "term": Object {
+                              "kibana.saved_objects.rel": Object {
+                                "value": "primary",
+                              },
+                            },
+                          },
+                          Object {
+                            "term": Object {
+                              "kibana.saved_objects.type": Object {
+                                "value": "saved-object-type",
+                              },
+                            },
+                          },
+                          Object {
+                            "term": Object {
+                              "kibana.saved_objects.id": Object {
+                                "value": "saved-object-id",
+                              },
+                            },
+                          },
+                          Object {
+                            "bool": Object {
+                              "must_not": Object {
+                                "exists": Object {
+                                  "field": "kibana.saved_objects.namespace",
+                                },
+                              },
+                            },
+                          },
+                        ],
+                      },
+                    },
+                  },
+                },
+              ],
+            },
+          },
+          "size": 10,
+          "sort": Object {
+            "@timestamp": Object {
+              "order": "asc",
+            },
+          },
+        },
+        "index": "index-name",
+        "rest_total_hits_as_int": true,
+      }
+    `);
   });
 
   test('should call cluster with sort', async () => {
@@ -278,6 +373,7 @@ describe('queryEventsBySavedObject', () => {
     });
     await clusterClientAdapter.queryEventsBySavedObject(
       'index-name',
+      'namespace',
       'saved-object-type',
       'saved-object-id',
       { ...DEFAULT_OPTIONS, sort_field: 'event.end', sort_order: 'desc' }
@@ -301,10 +397,11 @@ describe('queryEventsBySavedObject', () => {
       },
     });
 
-    const start = moment().subtract(1, 'days').toISOString();
+    const start = '2020-07-08T00:52:28.350Z';
 
     await clusterClientAdapter.queryEventsBySavedObject(
       'index-name',
+      'namespace',
       'saved-object-type',
       'saved-object-id',
       { ...DEFAULT_OPTIONS, start }
@@ -312,56 +409,73 @@ describe('queryEventsBySavedObject', () => {
 
     const [method, query] = clusterClient.callAsInternalUser.mock.calls[0];
     expect(method).toEqual('search');
-    expect(query).toMatchObject({
-      index: 'index-name',
-      body: {
-        query: {
-          bool: {
-            must: [
-              {
-                nested: {
-                  path: 'kibana.saved_objects',
-                  query: {
-                    bool: {
-                      must: [
-                        {
-                          term: {
-                            'kibana.saved_objects.rel': {
-                              value: 'primary',
+    expect(query).toMatchInlineSnapshot(`
+      Object {
+        "body": Object {
+          "from": 0,
+          "query": Object {
+            "bool": Object {
+              "must": Array [
+                Object {
+                  "nested": Object {
+                    "path": "kibana.saved_objects",
+                    "query": Object {
+                      "bool": Object {
+                        "must": Array [
+                          Object {
+                            "term": Object {
+                              "kibana.saved_objects.rel": Object {
+                                "value": "primary",
+                              },
                             },
                           },
-                        },
-                        {
-                          term: {
-                            'kibana.saved_objects.type': {
-                              value: 'saved-object-type',
+                          Object {
+                            "term": Object {
+                              "kibana.saved_objects.type": Object {
+                                "value": "saved-object-type",
+                              },
                             },
                           },
-                        },
-                        {
-                          term: {
-                            'kibana.saved_objects.id': {
-                              value: 'saved-object-id',
+                          Object {
+                            "term": Object {
+                              "kibana.saved_objects.id": Object {
+                                "value": "saved-object-id",
+                              },
                             },
                           },
-                        },
-                      ],
+                          Object {
+                            "term": Object {
+                              "kibana.saved_objects.namespace": Object {
+                                "value": "namespace",
+                              },
+                            },
+                          },
+                        ],
+                      },
                     },
                   },
                 },
-              },
-              {
-                range: {
-                  '@timestamp': {
-                    gte: start,
+                Object {
+                  "range": Object {
+                    "@timestamp": Object {
+                      "gte": "2020-07-08T00:52:28.350Z",
+                    },
                   },
                 },
-              },
-            ],
+              ],
+            },
+          },
+          "size": 10,
+          "sort": Object {
+            "@timestamp": Object {
+              "order": "asc",
+            },
           },
         },
-      },
-    });
+        "index": "index-name",
+        "rest_total_hits_as_int": true,
+      }
+    `);
   });
 
   test('supports optional date range', async () => {
@@ -372,11 +486,12 @@ describe('queryEventsBySavedObject', () => {
       },
     });
 
-    const start = moment().subtract(1, 'days').toISOString();
-    const end = moment().add(1, 'days').toISOString();
+    const start = '2020-07-08T00:52:28.350Z';
+    const end = '2020-07-08T00:00:00.000Z';
 
     await clusterClientAdapter.queryEventsBySavedObject(
       'index-name',
+      'namespace',
       'saved-object-type',
       'saved-object-id',
       { ...DEFAULT_OPTIONS, start, end }
@@ -384,62 +499,79 @@ describe('queryEventsBySavedObject', () => {
 
     const [method, query] = clusterClient.callAsInternalUser.mock.calls[0];
     expect(method).toEqual('search');
-    expect(query).toMatchObject({
-      index: 'index-name',
-      body: {
-        query: {
-          bool: {
-            must: [
-              {
-                nested: {
-                  path: 'kibana.saved_objects',
-                  query: {
-                    bool: {
-                      must: [
-                        {
-                          term: {
-                            'kibana.saved_objects.rel': {
-                              value: 'primary',
+    expect(query).toMatchInlineSnapshot(`
+      Object {
+        "body": Object {
+          "from": 0,
+          "query": Object {
+            "bool": Object {
+              "must": Array [
+                Object {
+                  "nested": Object {
+                    "path": "kibana.saved_objects",
+                    "query": Object {
+                      "bool": Object {
+                        "must": Array [
+                          Object {
+                            "term": Object {
+                              "kibana.saved_objects.rel": Object {
+                                "value": "primary",
+                              },
                             },
                           },
-                        },
-                        {
-                          term: {
-                            'kibana.saved_objects.type': {
-                              value: 'saved-object-type',
+                          Object {
+                            "term": Object {
+                              "kibana.saved_objects.type": Object {
+                                "value": "saved-object-type",
+                              },
                             },
                           },
-                        },
-                        {
-                          term: {
-                            'kibana.saved_objects.id': {
-                              value: 'saved-object-id',
+                          Object {
+                            "term": Object {
+                              "kibana.saved_objects.id": Object {
+                                "value": "saved-object-id",
+                              },
                             },
                           },
-                        },
-                      ],
+                          Object {
+                            "term": Object {
+                              "kibana.saved_objects.namespace": Object {
+                                "value": "namespace",
+                              },
+                            },
+                          },
+                        ],
+                      },
                     },
                   },
                 },
-              },
-              {
-                range: {
-                  '@timestamp': {
-                    gte: start,
+                Object {
+                  "range": Object {
+                    "@timestamp": Object {
+                      "gte": "2020-07-08T00:52:28.350Z",
+                    },
                   },
                 },
-              },
-              {
-                range: {
-                  '@timestamp': {
-                    lte: end,
+                Object {
+                  "range": Object {
+                    "@timestamp": Object {
+                      "lte": "2020-07-08T00:00:00.000Z",
+                    },
                   },
                 },
-              },
-            ],
+              ],
+            },
+          },
+          "size": 10,
+          "sort": Object {
+            "@timestamp": Object {
+              "order": "asc",
+            },
           },
         },
-      },
-    });
+        "index": "index-name",
+        "rest_total_hits_as_int": true,
+      }
+    `);
   });
 });
diff --git a/x-pack/plugins/event_log/server/es/cluster_client_adapter.ts b/x-pack/plugins/event_log/server/es/cluster_client_adapter.ts
index 3478358f88a54..f86e5d9ca0e32 100644
--- a/x-pack/plugins/event_log/server/es/cluster_client_adapter.ts
+++ b/x-pack/plugins/event_log/server/es/cluster_client_adapter.ts
@@ -6,8 +6,9 @@
 
 import { reject, isUndefined } from 'lodash';
 import { SearchResponse, Client } from 'elasticsearch';
-import { Logger, LegacyClusterClient } from '../../../../../src/core/server';
-import { IEvent, SAVED_OBJECT_REL_PRIMARY } from '../types';
+import { Logger, LegacyClusterClient } from 'src/core/server';
+
+import { IValidatedEvent, SAVED_OBJECT_REL_PRIMARY } from '../types';
 import { FindOptionsType } from '../event_log_client';
 
 export type EsClusterClient = Pick<LegacyClusterClient, 'callAsInternalUser' | 'asScoped'>;
@@ -22,7 +23,7 @@ export interface QueryEventsBySavedObjectResult {
   page: number;
   per_page: number;
   total: number;
-  data: IEvent[];
+  data: IValidatedEvent[];
 }
 
 export class ClusterClientAdapter {
@@ -129,84 +130,106 @@ export class ClusterClientAdapter {
 
   public async queryEventsBySavedObject(
     index: string,
+    namespace: string | undefined,
     type: string,
     id: string,
     { page, per_page: perPage, start, end, sort_field, sort_order }: FindOptionsType
   ): Promise<QueryEventsBySavedObjectResult> {
-    try {
-      const {
-        hits: { hits, total },
-      }: SearchResponse<unknown> = await this.callEs('search', {
-        index,
-        // The SearchResponse type only supports total as an int,
-        // so we're forced to explicitly request that it return as an int
-        rest_total_hits_as_int: true,
-        body: {
-          size: perPage,
-          from: (page - 1) * perPage,
-          sort: { [sort_field]: { order: sort_order } },
-          query: {
-            bool: {
-              must: reject(
-                [
-                  {
-                    nested: {
-                      path: 'kibana.saved_objects',
-                      query: {
-                        bool: {
-                          must: [
-                            {
-                              term: {
-                                'kibana.saved_objects.rel': {
-                                  value: SAVED_OBJECT_REL_PRIMARY,
-                                },
-                              },
+    const defaultNamespaceQuery = {
+      bool: {
+        must_not: {
+          exists: {
+            field: 'kibana.saved_objects.namespace',
+          },
+        },
+      },
+    };
+    const namedNamespaceQuery = {
+      term: {
+        'kibana.saved_objects.namespace': {
+          value: namespace,
+        },
+      },
+    };
+    const namespaceQuery = namespace === undefined ? defaultNamespaceQuery : namedNamespaceQuery;
+
+    const body = {
+      size: perPage,
+      from: (page - 1) * perPage,
+      sort: { [sort_field]: { order: sort_order } },
+      query: {
+        bool: {
+          must: reject(
+            [
+              {
+                nested: {
+                  path: 'kibana.saved_objects',
+                  query: {
+                    bool: {
+                      must: [
+                        {
+                          term: {
+                            'kibana.saved_objects.rel': {
+                              value: SAVED_OBJECT_REL_PRIMARY,
                             },
-                            {
-                              term: {
-                                'kibana.saved_objects.type': {
-                                  value: type,
-                                },
-                              },
+                          },
+                        },
+                        {
+                          term: {
+                            'kibana.saved_objects.type': {
+                              value: type,
                             },
-                            {
-                              term: {
-                                'kibana.saved_objects.id': {
-                                  value: id,
-                                },
-                              },
+                          },
+                        },
+                        {
+                          term: {
+                            'kibana.saved_objects.id': {
+                              value: id,
                             },
-                          ],
+                          },
                         },
-                      },
+                        namespaceQuery,
+                      ],
                     },
                   },
-                  start && {
-                    range: {
-                      '@timestamp': {
-                        gte: start,
-                      },
-                    },
+                },
+              },
+              start && {
+                range: {
+                  '@timestamp': {
+                    gte: start,
                   },
-                  end && {
-                    range: {
-                      '@timestamp': {
-                        lte: end,
-                      },
-                    },
+                },
+              },
+              end && {
+                range: {
+                  '@timestamp': {
+                    lte: end,
                   },
-                ],
-                isUndefined
-              ),
-            },
-          },
+                },
+              },
+            ],
+            isUndefined
+          ),
         },
+      },
+    };
+
+    try {
+      const {
+        hits: { hits, total },
+      }: SearchResponse<unknown> = await this.callEs('search', {
+        index,
+        // The SearchResponse type only supports total as an int,
+        // so we're forced to explicitly request that it return as an int
+        rest_total_hits_as_int: true,
+        body,
       });
       return {
         page,
         per_page: perPage,
         total,
-        data: hits.map((hit) => hit._source) as IEvent[],
+        data: hits.map((hit) => hit._source) as IValidatedEvent[],
       };
     } catch (err) {
       throw new Error(
diff --git a/x-pack/plugins/event_log/server/es/context.mock.ts b/x-pack/plugins/event_log/server/es/context.mock.ts
index 8d5483b88c4fa..aac7c684218aa 100644
--- a/x-pack/plugins/event_log/server/es/context.mock.ts
+++ b/x-pack/plugins/event_log/server/es/context.mock.ts
@@ -4,10 +4,11 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { loggingSystemMock } from 'src/core/server/mocks';
+
 import { EsContext } from './context';
 import { namesMock } from './names.mock';
 import { IClusterClientAdapter } from './cluster_client_adapter';
-import { loggingSystemMock } from '../../../../../src/core/server/mocks';
 import { clusterClientAdapterMock } from './cluster_client_adapter.mock';
 
 const createContextMock = () => {
diff --git a/x-pack/plugins/event_log/server/event_log_client.test.ts b/x-pack/plugins/event_log/server/event_log_client.test.ts
index 16e5fa69d36f6..917d517a6e27d 100644
--- a/x-pack/plugins/event_log/server/event_log_client.test.ts
+++ b/x-pack/plugins/event_log/server/event_log_client.test.ts
@@ -4,6 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { KibanaRequest } from 'src/core/server';
 import { EventLogClient } from './event_log_client';
 import { contextMock } from './es/context.mock';
 import { savedObjectsClientMock } from 'src/core/server/mocks';
@@ -18,6 +19,7 @@ describe('EventLogStart', () => {
       const eventLogClient = new EventLogClient({
         esContext,
         savedObjectsClient,
+        request: FakeRequest(),
       });
 
       savedObjectsClient.get.mockResolvedValueOnce({
@@ -38,6 +40,7 @@ describe('EventLogStart', () => {
       const eventLogClient = new EventLogClient({
         esContext,
         savedObjectsClient,
+        request: FakeRequest(),
       });
 
       savedObjectsClient.get.mockRejectedValue(new Error('Fail'));
@@ -53,6 +56,7 @@ describe('EventLogStart', () => {
       const eventLogClient = new EventLogClient({
         esContext,
         savedObjectsClient,
+        request: FakeRequest(),
       });
 
       savedObjectsClient.get.mockResolvedValueOnce({
@@ -107,6 +111,7 @@ describe('EventLogStart', () => {
 
       expect(esContext.esAdapter.queryEventsBySavedObject).toHaveBeenCalledWith(
         esContext.esNames.alias,
+        undefined,
         'saved-object-type',
         'saved-object-id',
         {
@@ -124,6 +129,7 @@ describe('EventLogStart', () => {
       const eventLogClient = new EventLogClient({
         esContext,
         savedObjectsClient,
+        request: FakeRequest(),
       });
 
       savedObjectsClient.get.mockResolvedValueOnce({
@@ -184,6 +190,7 @@ describe('EventLogStart', () => {
 
       expect(esContext.esAdapter.queryEventsBySavedObject).toHaveBeenCalledWith(
         esContext.esNames.alias,
+        undefined,
         'saved-object-type',
         'saved-object-id',
         {
@@ -203,6 +210,7 @@ describe('EventLogStart', () => {
       const eventLogClient = new EventLogClient({
         esContext,
         savedObjectsClient,
+        request: FakeRequest(),
       });
 
       savedObjectsClient.get.mockResolvedValueOnce({
@@ -232,6 +240,7 @@ describe('EventLogStart', () => {
       const eventLogClient = new EventLogClient({
         esContext,
         savedObjectsClient,
+        request: FakeRequest(),
       });
 
       savedObjectsClient.get.mockResolvedValueOnce({
@@ -286,3 +295,22 @@ function fakeEvent(overrides = {}) {
     overrides
   );
 }
+
+function FakeRequest(): KibanaRequest {
+  const savedObjectsClient = savedObjectsClientMock.create();
+  return ({
+    headers: {},
+    getBasePath: () => '',
+    path: '/',
+    route: { settings: {} },
+    url: {
+      href: '/',
+    },
+    raw: {
+      req: {
+        url: '/',
+      },
+    },
+    getSavedObjectsClient: () => savedObjectsClient,
+  } as unknown) as KibanaRequest;
+}
diff --git a/x-pack/plugins/event_log/server/event_log_client.ts b/x-pack/plugins/event_log/server/event_log_client.ts
index e7ba598de2ac6..f4115e06160d7 100644
--- a/x-pack/plugins/event_log/server/event_log_client.ts
+++ b/x-pack/plugins/event_log/server/event_log_client.ts
@@ -5,20 +5,16 @@
  */
 
 import { Observable } from 'rxjs';
-import { LegacyClusterClient, SavedObjectsClientContract } from 'src/core/server';
-
 import { schema, TypeOf } from '@kbn/config-schema';
+import { LegacyClusterClient, SavedObjectsClientContract, KibanaRequest } from 'src/core/server';
+import { SpacesServiceSetup } from '../../spaces/server';
+
 import { EsContext } from './es';
 import { IEventLogClient } from './types';
 import { QueryEventsBySavedObjectResult } from './es/cluster_client_adapter';
 export type PluginClusterClient = Pick<LegacyClusterClient, 'callAsInternalUser' | 'asScoped'>;
 export type AdminClusterClient$ = Observable<PluginClusterClient>;
 
-interface EventLogServiceCtorParams {
-  esContext: EsContext;
-  savedObjectsClient: SavedObjectsClientContract;
-}
-
 const optionalDateFieldSchema = schema.maybe(
   schema.string({
     validate(value) {
@@ -60,14 +56,30 @@ export type FindOptionsType = Pick<
 > &
   Partial<TypeOf<typeof findOptionsSchema>>;
 
+interface EventLogServiceCtorParams {
+  esContext: EsContext;
+  savedObjectsClient: SavedObjectsClientContract;
+  spacesService?: SpacesServiceSetup;
+  request: KibanaRequest;
+}
+
 // note that clusterClient may be null, indicating we can't write to ES
 export class EventLogClient implements IEventLogClient {
   private esContext: EsContext;
   private savedObjectsClient: SavedObjectsClientContract;
+  private spacesService?: SpacesServiceSetup;
+  private request: KibanaRequest;
 
-  constructor({ esContext, savedObjectsClient }: EventLogServiceCtorParams) {
+  constructor({
+    esContext,
+    savedObjectsClient,
+    spacesService,
+    request,
+  }: EventLogServiceCtorParams) {
     this.esContext = esContext;
     this.savedObjectsClient = savedObjectsClient;
+    this.spacesService = spacesService;
+    this.request = request;
   }
 
   async findEventsBySavedObject(
@@ -75,13 +87,20 @@ export class EventLogClient implements IEventLogClient {
     id: string,
     options?: Partial<FindOptionsType>
   ): Promise<QueryEventsBySavedObjectResult> {
+    const findOptions = findOptionsSchema.validate(options ?? {});
+
+    const space = await this.spacesService?.getActiveSpace(this.request);
+    const namespace = space && this.spacesService?.spaceIdToNamespace(space.id);
+
     // verify the user has the required permissions to view this saved object
     await this.savedObjectsClient.get(type, id);
+
     return await this.esContext.esAdapter.queryEventsBySavedObject(
       this.esContext.esNames.alias,
+      namespace,
       type,
       id,
-      findOptionsSchema.validate(options ?? {})
+      findOptions
     );
   }
 }
diff --git a/x-pack/plugins/event_log/server/event_log_start_service.test.ts b/x-pack/plugins/event_log/server/event_log_start_service.test.ts
index 58dd3ae6eb514..3bd5ef7c0b3ba 100644
--- a/x-pack/plugins/event_log/server/event_log_start_service.test.ts
+++ b/x-pack/plugins/event_log/server/event_log_start_service.test.ts
@@ -4,10 +4,11 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { KibanaRequest } from 'src/core/server';
+import { savedObjectsClientMock, savedObjectsServiceMock } from 'src/core/server/mocks';
+
 import { EventLogClientService } from './event_log_start_service';
 import { contextMock } from './es/context.mock';
-import { KibanaRequest } from 'kibana/server';
-import { savedObjectsClientMock, savedObjectsServiceMock } from 'src/core/server/mocks';
 
 jest.mock('./event_log_client');
 
@@ -26,13 +27,8 @@ describe('EventLogClientService', () => {
 
       eventLogStartService.getClient(request);
 
-      expect(savedObjectsService.getScopedClient).toHaveBeenCalledWith(request);
-
-      const [{ value: savedObjectsClient }] = savedObjectsService.getScopedClient.mock.results;
-
-      expect(jest.requireMock('./event_log_client').EventLogClient).toHaveBeenCalledWith({
-        esContext,
-        savedObjectsClient,
+      expect(savedObjectsService.getScopedClient).toHaveBeenCalledWith(request, {
+        includedHiddenTypes: ['action', 'alert'],
       });
     });
   });
diff --git a/x-pack/plugins/event_log/server/event_log_start_service.ts b/x-pack/plugins/event_log/server/event_log_start_service.ts
index 0339d0883dc46..8b752684c1cc3 100644
--- a/x-pack/plugins/event_log/server/event_log_start_service.ts
+++ b/x-pack/plugins/event_log/server/event_log_start_service.ts
@@ -11,6 +11,7 @@ import {
   SavedObjectsServiceStart,
   SavedObjectsClientContract,
 } from 'src/core/server';
+import { SpacesServiceSetup } from '../../spaces/server';
 
 import { EsContext } from './es';
 import { IEventLogClientService } from './types';
@@ -18,30 +19,37 @@ import { EventLogClient } from './event_log_client';
 export type PluginClusterClient = Pick<LegacyClusterClient, 'callAsInternalUser' | 'asScoped'>;
 export type AdminClusterClient$ = Observable<PluginClusterClient>;
 
+const includedHiddenTypes = ['action', 'alert'];
+
 interface EventLogServiceCtorParams {
   esContext: EsContext;
   savedObjectsService: SavedObjectsServiceStart;
+  spacesService?: SpacesServiceSetup;
 }
 
 // note that clusterClient may be null, indicating we can't write to ES
 export class EventLogClientService implements IEventLogClientService {
   private esContext: EsContext;
   private savedObjectsService: SavedObjectsServiceStart;
+  private spacesService?: SpacesServiceSetup;
 
-  constructor({ esContext, savedObjectsService }: EventLogServiceCtorParams) {
+  constructor({ esContext, savedObjectsService, spacesService }: EventLogServiceCtorParams) {
     this.esContext = esContext;
     this.savedObjectsService = savedObjectsService;
+    this.spacesService = spacesService;
   }
 
-  getClient(
-    request: KibanaRequest,
-    savedObjectsClient: SavedObjectsClientContract = this.savedObjectsService.getScopedClient(
-      request
-    )
-  ) {
+  getClient(request: KibanaRequest) {
+    const savedObjectsClient: SavedObjectsClientContract = this.savedObjectsService.getScopedClient(
+      request,
+      { includedHiddenTypes }
+    );
+
     return new EventLogClient({
       esContext: this.esContext,
       savedObjectsClient,
+      spacesService: this.spacesService,
+      request,
     });
   }
 }
diff --git a/x-pack/plugins/event_log/server/index.ts b/x-pack/plugins/event_log/server/index.ts
index 0612b5319c15b..25b1b95831b8a 100644
--- a/x-pack/plugins/event_log/server/index.ts
+++ b/x-pack/plugins/event_log/server/index.ts
@@ -13,6 +13,7 @@ export {
   IEventLogger,
   IEventLogClientService,
   IEvent,
+  IValidatedEvent,
   SAVED_OBJECT_REL_PRIMARY,
 } from './types';
 export const config = { schema: ConfigSchema };
diff --git a/x-pack/plugins/event_log/server/plugin.ts b/x-pack/plugins/event_log/server/plugin.ts
index ed530607aabba..9e36ca10b71f2 100644
--- a/x-pack/plugins/event_log/server/plugin.ts
+++ b/x-pack/plugins/event_log/server/plugin.ts
@@ -17,6 +17,7 @@ import {
   IContextProvider,
   RequestHandler,
 } from 'src/core/server';
+import { SpacesPluginSetup, SpacesServiceSetup } from '../../spaces/server';
 
 import {
   IEventLogConfig,
@@ -39,14 +40,19 @@ const ACTIONS = {
   stopping: 'stopping',
 };
 
+interface PluginSetupDeps {
+  spaces?: SpacesPluginSetup;
+}
+
 export class Plugin implements CorePlugin<IEventLogService, IEventLogClientService> {
   private readonly config$: IEventLogConfig$;
   private systemLogger: Logger;
-  private eventLogService?: IEventLogService;
+  private eventLogService?: EventLogService;
   private esContext?: EsContext;
   private eventLogger?: IEventLogger;
   private globalConfig$: Observable<SharedGlobalConfig>;
   private eventLogClientService?: EventLogClientService;
+  private spacesService?: SpacesServiceSetup;
 
   constructor(private readonly context: PluginInitializerContext) {
     this.systemLogger = this.context.logger.get();
@@ -54,13 +60,14 @@ export class Plugin implements CorePlugin<IEventLogService, IEventLogClientServi
     this.globalConfig$ = this.context.config.legacy.globalConfig$;
   }
 
-  async setup(core: CoreSetup): Promise<IEventLogService> {
+  async setup(core: CoreSetup, { spaces }: PluginSetupDeps): Promise<IEventLogService> {
     const globalConfig = await this.globalConfig$.pipe(first()).toPromise();
     const kibanaIndex = globalConfig.kibana.index;
 
     this.systemLogger.debug('setting up plugin');
 
     const config = await this.config$.pipe(first()).toPromise();
+    this.spacesService = spaces?.spacesService;
 
     this.esContext = createEsContext({
       logger: this.systemLogger,
@@ -89,7 +96,7 @@ export class Plugin implements CorePlugin<IEventLogService, IEventLogClientServi
     // Routes
     const router = core.http.createRouter();
     // Register routes
-    findRoute(router);
+    findRoute(router, this.systemLogger);
 
     return this.eventLogService;
   }
@@ -115,6 +122,7 @@ export class Plugin implements CorePlugin<IEventLogService, IEventLogClientServi
     this.eventLogClientService = new EventLogClientService({
       esContext: this.esContext,
       savedObjectsService: core.savedObjects,
+      spacesService: this.spacesService,
     });
     return this.eventLogClientService;
   }
@@ -125,8 +133,7 @@ export class Plugin implements CorePlugin<IEventLogService, IEventLogClientServi
   > => {
     return async (context, request) => {
       return {
-        getEventLogClient: () =>
-          this.eventLogClientService!.getClient(request, context.core.savedObjects.client),
+        getEventLogClient: () => this.eventLogClientService!.getClient(request),
       };
     };
   };
diff --git a/x-pack/plugins/event_log/server/routes/_mock_handler_arguments.ts b/x-pack/plugins/event_log/server/routes/_mock_handler_arguments.ts
index 2d5e37e870b28..b0ce5605d0e51 100644
--- a/x-pack/plugins/event_log/server/routes/_mock_handler_arguments.ts
+++ b/x-pack/plugins/event_log/server/routes/_mock_handler_arguments.ts
@@ -4,9 +4,10 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { RequestHandlerContext, KibanaRequest, KibanaResponseFactory } from 'kibana/server';
 import { identity, merge } from 'lodash';
-import { httpServerMock } from '../../../../../src/core/server/mocks';
+import { RequestHandlerContext, KibanaRequest, KibanaResponseFactory } from 'src/core/server';
+
+import { httpServerMock } from 'src/core/server/mocks';
 import { IEventLogClient } from '../types';
 
 export function mockHandlerArguments(
diff --git a/x-pack/plugins/event_log/server/routes/find.test.ts b/x-pack/plugins/event_log/server/routes/find.test.ts
index f47df499d742f..07bb8329f78ec 100644
--- a/x-pack/plugins/event_log/server/routes/find.test.ts
+++ b/x-pack/plugins/event_log/server/routes/find.test.ts
@@ -8,8 +8,10 @@ import { findRoute } from './find';
 import { httpServiceMock } from 'src/core/server/mocks';
 import { mockHandlerArguments, fakeEvent } from './_mock_handler_arguments';
 import { eventLogClientMock } from '../event_log_client.mock';
+import { loggingSystemMock } from 'src/core/server/mocks';
 
 const eventLogClient = eventLogClientMock.create();
+const systemLogger = loggingSystemMock.createLogger();
 
 beforeEach(() => {
   jest.resetAllMocks();
@@ -19,7 +21,7 @@ describe('find', () => {
   it('finds events with proper parameters', async () => {
     const router = httpServiceMock.createRouter();
 
-    findRoute(router);
+    findRoute(router, systemLogger);
 
     const [config, handler] = router.get.mock.calls[0];
 
@@ -58,7 +60,7 @@ describe('find', () => {
   it('supports optional pagination parameters', async () => {
     const router = httpServiceMock.createRouter();
 
-    findRoute(router);
+    findRoute(router, systemLogger);
 
     const [, handler] = router.get.mock.calls[0];
     eventLogClient.findEventsBySavedObject.mockResolvedValueOnce({
@@ -95,4 +97,29 @@ describe('find', () => {
       },
     });
   });
+
+  it('logs a warning when the query throws an error', async () => {
+    const router = httpServiceMock.createRouter();
+
+    findRoute(router, systemLogger);
+
+    const [, handler] = router.get.mock.calls[0];
+    eventLogClient.findEventsBySavedObject.mockRejectedValueOnce(new Error('oof!'));
+
+    const [context, req, res] = mockHandlerArguments(
+      eventLogClient,
+      {
+        params: { id: '1', type: 'action' },
+        query: { page: 3, per_page: 10 },
+      },
+      ['ok']
+    );
+
+    await handler(context, req, res);
+
+    expect(systemLogger.debug).toHaveBeenCalledTimes(1);
+    expect(systemLogger.debug).toHaveBeenCalledWith(
+      'error calling eventLog findEventsBySavedObject(action, 1, {"page":3,"per_page":10}): oof!'
+    );
+  });
 });
diff --git a/x-pack/plugins/event_log/server/routes/find.ts b/x-pack/plugins/event_log/server/routes/find.ts
index e03aef7c757f6..3880ac2c10129 100644
--- a/x-pack/plugins/event_log/server/routes/find.ts
+++ b/x-pack/plugins/event_log/server/routes/find.ts
@@ -11,7 +11,9 @@ import {
   KibanaRequest,
   IKibanaResponse,
   KibanaResponseFactory,
-} from 'kibana/server';
+  Logger,
+} from 'src/core/server';
+
 import { BASE_EVENT_LOG_API_PATH } from '../../common';
 import { findOptionsSchema, FindOptionsType } from '../event_log_client';
 
@@ -20,7 +22,7 @@ const paramSchema = schema.object({
   id: schema.string(),
 });
 
-export const findRoute = (router: IRouter) => {
+export const findRoute = (router: IRouter, systemLogger: Logger) => {
   router.get(
     {
       path: `${BASE_EVENT_LOG_API_PATH}/{type}/{id}/_find`,
@@ -42,9 +44,16 @@ export const findRoute = (router: IRouter) => {
         params: { id, type },
         query,
       } = req;
-      return res.ok({
-        body: await eventLogClient.findEventsBySavedObject(type, id, query),
-      });
+
+      try {
+        return res.ok({
+          body: await eventLogClient.findEventsBySavedObject(type, id, query),
+        });
+      } catch (err) {
+        const call = `findEventsBySavedObject(${type}, ${id}, ${JSON.stringify(query)})`;
+        systemLogger.debug(`error calling eventLog ${call}: ${err.message}`);
+        return res.notFound();
+      }
     })
   );
 };
diff --git a/x-pack/plugins/event_log/server/types.ts b/x-pack/plugins/event_log/server/types.ts
index 58be6707b0373..1a37c4e58d079 100644
--- a/x-pack/plugins/event_log/server/types.ts
+++ b/x-pack/plugins/event_log/server/types.ts
@@ -6,9 +6,9 @@
 
 import { Observable } from 'rxjs';
 import { schema, TypeOf } from '@kbn/config-schema';
+import { KibanaRequest } from 'src/core/server';
 
 export { IEvent, IValidatedEvent, EventSchema, ECS_VERSION } from '../generated/schemas';
-import { KibanaRequest } from 'kibana/server';
 import { IEvent } from '../generated/schemas';
 import { FindOptionsType } from './event_log_client';
 import { QueryEventsBySavedObjectResult } from './es/cluster_client_adapter';
diff --git a/x-pack/plugins/graph/server/lib/license_state.ts b/x-pack/plugins/graph/server/lib/license_state.ts
index d86cb5380a2e1..8d64c826d8fa1 100644
--- a/x-pack/plugins/graph/server/lib/license_state.ts
+++ b/x-pack/plugins/graph/server/lib/license_state.ts
@@ -7,6 +7,7 @@
 import Boom from 'boom';
 import { map } from 'rxjs/operators';
 import { Observable, Subscription } from 'rxjs';
+import { LicensingPluginStart } from '../../../licensing/server';
 import { ILicense } from '../../../licensing/common/types';
 import { checkLicense, GraphLicenseInformation } from '../../common/check_license';
 
@@ -14,6 +15,7 @@ export class LicenseState {
   private licenseInformation: GraphLicenseInformation = checkLicense(undefined);
   private subscription: Subscription | null = null;
   private observable: Observable<GraphLicenseInformation> | null = null;
+  private _notifyUsage: LicensingPluginStart['featureUsage']['notifyUsage'] | null = null;
 
   private updateInformation(licenseInformation: GraphLicenseInformation) {
     this.licenseInformation = licenseInformation;
@@ -24,6 +26,17 @@ export class LicenseState {
     this.subscription = this.observable.subscribe(this.updateInformation.bind(this));
   }
 
+  public setNotifyUsage(notifyUsage: LicensingPluginStart['featureUsage']['notifyUsage']) {
+    this._notifyUsage = notifyUsage;
+  }
+
+  // 'Graph' is the only allowed feature here at the moment, if this gets extended in the future, add to the union type
+  public notifyUsage(featureName: 'Graph') {
+    if (this._notifyUsage) {
+      this._notifyUsage(featureName);
+    }
+  }
+
   public stop() {
     if (this.subscription) {
       this.subscription.unsubscribe();
diff --git a/x-pack/plugins/graph/server/plugin.ts b/x-pack/plugins/graph/server/plugin.ts
index 141d5d0ea8db4..b2b825fa4683b 100644
--- a/x-pack/plugins/graph/server/plugin.ts
+++ b/x-pack/plugins/graph/server/plugin.ts
@@ -5,8 +5,8 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { Plugin, CoreSetup } from 'src/core/server';
-import { LicensingPluginSetup } from '../../licensing/server';
+import { Plugin, CoreSetup, CoreStart } from 'src/core/server';
+import { LicensingPluginSetup, LicensingPluginStart } from '../../licensing/server';
 import { LicenseState } from './lib/license_state';
 import { registerSearchRoute } from './routes/search';
 import { registerExploreRoute } from './routes/explore';
@@ -34,6 +34,7 @@ export class GraphPlugin implements Plugin {
     licenseState.start(licensing.license$);
     this.licenseState = licenseState;
     core.savedObjects.registerType(graphWorkspace);
+    licensing.featureUsage.register('Graph', 'platinum');
 
     if (home) {
       registerSampleData(home.sampleData, licenseState);
@@ -79,7 +80,10 @@ export class GraphPlugin implements Plugin {
     registerExploreRoute({ licenseState, router });
   }
 
-  public start() {}
+  public start(core: CoreStart, { licensing }: { licensing: LicensingPluginStart }) {
+    this.licenseState!.setNotifyUsage(licensing.featureUsage.notifyUsage);
+  }
+
   public stop() {
     if (this.licenseState) {
       this.licenseState.stop();
diff --git a/x-pack/plugins/graph/server/routes/explore.ts b/x-pack/plugins/graph/server/routes/explore.ts
index b0b8cf14ff699..c436fbd1c79af 100644
--- a/x-pack/plugins/graph/server/routes/explore.ts
+++ b/x-pack/plugins/graph/server/routes/explore.ts
@@ -42,6 +42,7 @@ export function registerExploreRoute({
         response
       ) => {
         verifyApiAccess(licenseState);
+        licenseState.notifyUsage('Graph');
         try {
           return response.ok({
             body: {
diff --git a/x-pack/plugins/graph/server/routes/search.ts b/x-pack/plugins/graph/server/routes/search.ts
index 645e6b520013f..e1d430eeb311a 100644
--- a/x-pack/plugins/graph/server/routes/search.ts
+++ b/x-pack/plugins/graph/server/routes/search.ts
@@ -42,6 +42,7 @@ export function registerSearchRoute({
         response
       ) => {
         verifyApiAccess(licenseState);
+        licenseState.notifyUsage('Graph');
         const includeFrozen = await uiSettings.get<boolean>(UI_SETTINGS.SEARCH_INCLUDE_FROZEN);
         try {
           return response.ok({
diff --git a/x-pack/plugins/index_management/public/application/components/component_templates/component_template_wizard/component_template_form/steps/step_logistics.tsx b/x-pack/plugins/index_management/public/application/components/component_templates/component_template_wizard/component_template_form/steps/step_logistics.tsx
index c48a23226a371..032eb93f7f9f9 100644
--- a/x-pack/plugins/index_management/public/application/components/component_templates/component_template_wizard/component_template_form/steps/step_logistics.tsx
+++ b/x-pack/plugins/index_management/public/application/components/component_templates/component_template_wizard/component_template_form/steps/step_logistics.tsx
@@ -3,7 +3,7 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import React, { useEffect, useState } from 'react';
+import React, { useEffect, useState, useCallback } from 'react';
 import {
   EuiFlexGroup,
   EuiFlexItem,
@@ -44,26 +44,28 @@ export const StepLogistics: React.FunctionComponent<Props> = React.memo(
       options: { stripEmptyFields: false },
     });
 
+    const { isValid: isFormValid, submit, getFormData, subscribe } = form;
+
     const { documentation } = useComponentTemplatesContext();
 
     const [isMetaVisible, setIsMetaVisible] = useState<boolean>(
       Boolean(defaultValue._meta && Object.keys(defaultValue._meta).length)
     );
 
-    const validate = async () => {
-      return (await form.submit()).isValid;
-    };
+    const validate = useCallback(async () => {
+      return (await submit()).isValid;
+    }, [submit]);
 
     useEffect(() => {
       onChange({
-        isValid: form.isValid,
+        isValid: isFormValid,
         validate,
-        getData: form.getFormData,
+        getData: getFormData,
       });
-    }, [form.isValid, onChange]); // eslint-disable-line react-hooks/exhaustive-deps
+    }, [isFormValid, getFormData, validate, onChange]);
 
     useEffect(() => {
-      const subscription = form.subscribe(({ data, isValid }) => {
+      const subscription = subscribe(({ data, isValid }) => {
         onChange({
           isValid,
           validate,
@@ -71,7 +73,7 @@ export const StepLogistics: React.FunctionComponent<Props> = React.memo(
         });
       });
       return subscription.unsubscribe;
-    }, [onChange]); // eslint-disable-line react-hooks/exhaustive-deps
+    }, [subscribe, validate, onChange]);
 
     return (
       <Form form={form} data-test-subj="stepLogistics">
diff --git a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/configuration_form/configuration_form.tsx b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/configuration_form/configuration_form.tsx
index 098e530bddb3c..86bcc796a88eb 100644
--- a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/configuration_form/configuration_form.tsx
+++ b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/configuration_form/configuration_form.tsx
@@ -94,22 +94,23 @@ export const ConfigurationForm = React.memo(({ value }: Props) => {
     id: 'configurationForm',
   });
   const dispatch = useDispatch();
+  const { subscribe, submit, reset, getFormData } = form;
 
   useEffect(() => {
-    const subscription = form.subscribe(({ data, isValid, validate }) => {
+    const subscription = subscribe(({ data, isValid, validate }) => {
       dispatch({
         type: 'configuration.update',
         value: {
           data,
           isValid,
           validate,
-          submitForm: form.submit,
+          submitForm: submit,
         },
       });
     });
 
     return subscription.unsubscribe;
-  }, [dispatch]); // eslint-disable-line react-hooks/exhaustive-deps
+  }, [dispatch, subscribe, submit]);
 
   useEffect(() => {
     if (isMounted.current === undefined) {
@@ -125,18 +126,18 @@ export const ConfigurationForm = React.memo(({ value }: Props) => {
 
     // If the value has changed (it probably means that we have loaded a new JSON)
     // we need to reset the form to update the fields values.
-    form.reset({ resetValues: true });
-  }, [value]); // eslint-disable-line react-hooks/exhaustive-deps
+    reset({ resetValues: true });
+  }, [value, reset]);
 
   useEffect(() => {
     return () => {
       isMounted.current = false;
 
       // Save a snapshot of the form state so we can get back to it when navigating back to the tab
-      const configurationData = form.getFormData();
+      const configurationData = getFormData();
       dispatch({ type: 'configuration.save', value: configurationData });
     };
-  }, [dispatch]); // eslint-disable-line react-hooks/exhaustive-deps
+  }, [getFormData, dispatch]);
 
   return (
     <Form
diff --git a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/create_field/create_field.tsx b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/create_field/create_field.tsx
index 62eb920f8865d..57a765c38dd26 100644
--- a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/create_field/create_field.tsx
+++ b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/create_field/create_field.tsx
@@ -50,13 +50,15 @@ export const CreateField = React.memo(function CreateFieldComponent({
     options: { stripEmptyFields: false },
   });
 
+  const { subscribe } = form;
+
   useEffect(() => {
-    const subscription = form.subscribe((updatedFieldForm) => {
+    const subscription = subscribe((updatedFieldForm) => {
       dispatch({ type: 'fieldForm.update', value: updatedFieldForm });
     });
 
     return subscription.unsubscribe;
-  }, [dispatch]); // eslint-disable-line react-hooks/exhaustive-deps
+  }, [dispatch, subscribe]);
 
   const cancel = () => {
     dispatch({ type: 'documentField.changeStatus', value: 'idle' });
diff --git a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/edit_field/edit_field_container.tsx b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/edit_field/edit_field_container.tsx
index d543e49d23be9..5105a2a157a6d 100644
--- a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/edit_field/edit_field_container.tsx
+++ b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/edit_field/edit_field_container.tsx
@@ -26,13 +26,15 @@ export const EditFieldContainer = React.memo(({ field, allFields }: Props) => {
     options: { stripEmptyFields: false },
   });
 
+  const { subscribe } = form;
+
   useEffect(() => {
-    const subscription = form.subscribe((updatedFieldForm) => {
+    const subscription = subscribe((updatedFieldForm) => {
       dispatch({ type: 'fieldForm.update', value: updatedFieldForm });
     });
 
     return subscription.unsubscribe;
-  }, [dispatch]); // eslint-disable-line react-hooks/exhaustive-deps
+  }, [subscribe, dispatch]);
 
   const exitEdit = useCallback(() => {
     dispatch({ type: 'documentField.changeStatus', value: 'idle' });
diff --git a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/templates_form/templates_form.tsx b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/templates_form/templates_form.tsx
index 79685d46b6bdd..a95579a8a141e 100644
--- a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/templates_form/templates_form.tsx
+++ b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/templates_form/templates_form.tsx
@@ -61,17 +61,18 @@ export const TemplatesForm = React.memo(({ value }: Props) => {
     deserializer: formDeserializer,
     defaultValue: value,
   });
+  const { subscribe, getFormData, submit: submitForm, reset } = form;
   const dispatch = useDispatch();
 
   useEffect(() => {
-    const subscription = form.subscribe(({ data, isValid, validate }) => {
+    const subscription = subscribe(({ data, isValid, validate }) => {
       dispatch({
         type: 'templates.update',
-        value: { data, isValid, validate, submitForm: form.submit },
+        value: { data, isValid, validate, submitForm },
       });
     });
     return subscription.unsubscribe;
-  }, [dispatch]); // eslint-disable-line react-hooks/exhaustive-deps
+  }, [subscribe, dispatch, submitForm]);
 
   useEffect(() => {
     if (isMounted.current === undefined) {
@@ -87,18 +88,18 @@ export const TemplatesForm = React.memo(({ value }: Props) => {
 
     // If the value has changed (it probably means that we have loaded a new JSON)
     // we need to reset the form to update the fields values.
-    form.reset({ resetValues: true });
-  }, [value]); // eslint-disable-line react-hooks/exhaustive-deps
+    reset({ resetValues: true });
+  }, [value, reset]);
 
   useEffect(() => {
     return () => {
       isMounted.current = false;
 
       // On unmount => save in the state a snapshot of the current form data.
-      const dynamicTemplatesData = form.getFormData();
+      const dynamicTemplatesData = getFormData();
       dispatch({ type: 'templates.save', value: dynamicTemplatesData });
     };
-  }, [dispatch]); // eslint-disable-line react-hooks/exhaustive-deps
+  }, [getFormData, dispatch]);
 
   return (
     <div data-test-subj="dynamicTemplates">
diff --git a/x-pack/plugins/index_management/public/application/components/shared/components/wizard_steps/step_mappings_container.tsx b/x-pack/plugins/index_management/public/application/components/shared/components/wizard_steps/step_mappings_container.tsx
index 38c4a85bbe0ff..b0675c1412259 100644
--- a/x-pack/plugins/index_management/public/application/components/shared/components/wizard_steps/step_mappings_container.tsx
+++ b/x-pack/plugins/index_management/public/application/components/shared/components/wizard_steps/step_mappings_container.tsx
@@ -14,15 +14,16 @@ interface Props {
 }
 
 export const StepMappingsContainer: React.FunctionComponent<Props> = ({ esDocsBase }) => {
-  const { defaultValue, updateContent, getData } = Forms.useContent<CommonWizardSteps, 'mappings'>(
+  const { defaultValue, updateContent, getSingleContentData } = Forms.useContent<
+    CommonWizardSteps,
     'mappings'
-  );
+  >('mappings');
 
   return (
     <StepMappings
       defaultValue={defaultValue}
       onChange={updateContent}
-      indexSettings={getData().settings}
+      indexSettings={getSingleContentData('settings')}
       esDocsBase={esDocsBase}
     />
   );
diff --git a/x-pack/plugins/infra/public/pages/logs/log_entry_categories/sections/top_categories/category_example_message.tsx b/x-pack/plugins/infra/public/pages/logs/log_entry_categories/sections/top_categories/category_example_message.tsx
index 21c7f48eb80f8..908e52f01cbcc 100644
--- a/x-pack/plugins/infra/public/pages/logs/log_entry_categories/sections/top_categories/category_example_message.tsx
+++ b/x-pack/plugins/infra/public/pages/logs/log_entry_categories/sections/top_categories/category_example_message.tsx
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React, { useMemo, useState, useCallback, useContext } from 'react';
+import React, { useState, useCallback, useContext } from 'react';
 import { i18n } from '@kbn/i18n';
 import { encode } from 'rison-node';
 import moment from 'moment';
@@ -40,12 +40,8 @@ export const CategoryExampleMessage: React.FunctionComponent<{
   context: LogEntryContext;
 }> = ({ id, dataset, message, timestamp, timeRange, tiebreaker, context }) => {
   const [, { setContextEntry }] = useContext(ViewLogInContext.Context);
-  // the dataset must be encoded for the field column and the empty value must
-  // be turned into a user-friendly value
-  const encodedDatasetFieldValue = useMemo(
-    () => JSON.stringify(getFriendlyNameForPartitionId(dataset)),
-    [dataset]
-  );
+  // handle special cases for the dataset value
+  const humanFriendlyDataset = getFriendlyNameForPartitionId(dataset);
 
   const [isHovered, setIsHovered] = useState<boolean>(false);
   const setHovered = useCallback(() => setIsHovered(true), []);
@@ -100,7 +96,7 @@ export const CategoryExampleMessage: React.FunctionComponent<{
           columnValue={{
             columnId: datasetColumnId,
             field: 'event.dataset',
-            value: encodedDatasetFieldValue,
+            value: humanFriendlyDataset,
             highlights: [],
           }}
           highlights={noHighlights}
diff --git a/x-pack/plugins/infra/public/pages/logs/log_entry_rate/sections/anomalies/log_entry_example.tsx b/x-pack/plugins/infra/public/pages/logs/log_entry_rate/sections/anomalies/log_entry_example.tsx
index 2965e1fede822..fece2522de574 100644
--- a/x-pack/plugins/infra/public/pages/logs/log_entry_rate/sections/anomalies/log_entry_example.tsx
+++ b/x-pack/plugins/infra/public/pages/logs/log_entry_rate/sections/anomalies/log_entry_example.tsx
@@ -80,12 +80,8 @@ export const LogEntryExampleMessage: React.FunctionComponent<Props> = ({
   const setItemIsHovered = useCallback(() => setIsHovered(true), []);
   const setItemIsNotHovered = useCallback(() => setIsHovered(false), []);
 
-  // the dataset must be encoded for the field column and the empty value must
-  // be turned into a user-friendly value
-  const encodedDatasetFieldValue = useMemo(
-    () => JSON.stringify(getFriendlyNameForPartitionId(dataset)),
-    [dataset]
-  );
+  // handle special cases for the dataset value
+  const humanFriendlyDataset = getFriendlyNameForPartitionId(dataset);
 
   const viewInStreamLinkProps = useLinkProps({
     app: 'logs',
@@ -158,7 +154,7 @@ export const LogEntryExampleMessage: React.FunctionComponent<Props> = ({
           columnValue={{
             columnId: datasetColumnId,
             field: 'event.dataset',
-            value: encodedDatasetFieldValue,
+            value: humanFriendlyDataset,
             highlights: [],
           }}
           highlights={noHighlights}
diff --git a/x-pack/plugins/ingest_manager/common/services/agent_status.ts b/x-pack/plugins/ingest_manager/common/services/agent_status.ts
index 6489c30308771..536003b0f743d 100644
--- a/x-pack/plugins/ingest_manager/common/services/agent_status.ts
+++ b/x-pack/plugins/ingest_manager/common/services/agent_status.ts
@@ -4,11 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import {
-  AGENT_POLLING_THRESHOLD_MS,
-  AGENT_TYPE_PERMANENT,
-  AGENT_SAVED_OBJECT_TYPE,
-} from '../constants';
+import { AGENT_POLLING_THRESHOLD_MS, AGENT_SAVED_OBJECT_TYPE } from '../constants';
 import { Agent, AgentStatus } from '../types';
 
 export function getAgentStatus(agent: Agent, now: number = Date.now()): AgentStatus {
@@ -41,8 +37,16 @@ export function getAgentStatus(agent: Agent, now: number = Date.now()): AgentSta
   return 'online';
 }
 
+export function buildKueryForEnrollingAgents() {
+  return `not ${AGENT_SAVED_OBJECT_TYPE}.last_checkin:*`;
+}
+
+export function buildKueryForUnenrollingAgents() {
+  return `${AGENT_SAVED_OBJECT_TYPE}.unenrollment_started_at:*`;
+}
+
 export function buildKueryForOnlineAgents() {
-  return `not (${buildKueryForOfflineAgents()}) AND not (${buildKueryForErrorAgents()})`;
+  return `not (${buildKueryForOfflineAgents()}) AND not (${buildKueryForErrorAgents()}) AND not (${buildKueryForEnrollingAgents()}) AND not (${buildKueryForUnenrollingAgents()})`;
 }
 
 export function buildKueryForErrorAgents() {
@@ -50,7 +54,7 @@ export function buildKueryForErrorAgents() {
 }
 
 export function buildKueryForOfflineAgents() {
-  return `((${AGENT_SAVED_OBJECT_TYPE}.type:${AGENT_TYPE_PERMANENT} AND ${AGENT_SAVED_OBJECT_TYPE}.last_checkin < now-${
+  return `${AGENT_SAVED_OBJECT_TYPE}.last_checkin < now-${
     (4 * AGENT_POLLING_THRESHOLD_MS) / 1000
-  }s) AND not ( ${buildKueryForErrorAgents()} ))`;
+  }s AND not (${buildKueryForErrorAgents()})`;
 }
diff --git a/x-pack/plugins/ingest_manager/common/types/models/epm.ts b/x-pack/plugins/ingest_manager/common/types/models/epm.ts
index ab6a6c73843c5..6ec5b73eaa43e 100644
--- a/x-pack/plugins/ingest_manager/common/types/models/epm.ts
+++ b/x-pack/plugins/ingest_manager/common/types/models/epm.ts
@@ -276,9 +276,7 @@ export interface IndexTemplate {
     mappings: any;
     aliases: object;
   };
-  data_stream: {
-    timestamp_field: string;
-  };
+  data_stream: object;
   composed_of: string[];
   _meta: object;
 }
diff --git a/x-pack/plugins/ingest_manager/common/types/rest_spec/agent.ts b/x-pack/plugins/ingest_manager/common/types/rest_spec/agent.ts
index ed7d73ab0b719..7ec5a8d68311f 100644
--- a/x-pack/plugins/ingest_manager/common/types/rest_spec/agent.ts
+++ b/x-pack/plugins/ingest_manager/common/types/rest_spec/agent.ts
@@ -173,5 +173,6 @@ export interface GetAgentStatusResponse {
     online: number;
     error: number;
     offline: number;
+    other: number;
   };
 }
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/agent_list_page/index.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/agent_list_page/index.tsx
index 97616ed490bc9..034482c4cf9b5 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/agent_list_page/index.tsx
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/agent_list_page/index.tsx
@@ -3,7 +3,7 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import React, { useState, useMemo } from 'react';
+import React, { useState, useMemo, useCallback } from 'react';
 import {
   EuiBasicTable,
   EuiButton,
@@ -144,13 +144,20 @@ export const AgentListPage: React.FunctionComponent<{}> = () => {
   const [search, setSearch] = useState(defaultKuery);
   const { pagination, pageSizeOptions, setPagination } = usePagination();
 
-  // Configs state (for filtering)
+  // Configs state for filtering
   const [isConfigsFilterOpen, setIsConfigsFilterOpen] = useState<boolean>(false);
   const [selectedConfigs, setSelectedConfigs] = useState<string[]>([]);
+
   // Status for filtering
   const [isStatusFilterOpen, setIsStatutsFilterOpen] = useState<boolean>(false);
   const [selectedStatus, setSelectedStatus] = useState<string[]>([]);
 
+  const clearFilters = useCallback(() => {
+    setSearch('');
+    setSelectedConfigs([]);
+    setSelectedStatus([]);
+  }, [setSearch, setSelectedConfigs, setSelectedStatus]);
+
   // Add a config id to current search
   const addConfigFilter = (configId: string) => {
     setSelectedConfigs([...selectedConfigs, configId]);
@@ -500,7 +507,7 @@ export const AgentListPage: React.FunctionComponent<{}> = () => {
       <EuiBasicTable<Agent>
         className="fleet__agentList__table"
         data-test-subj="fleetAgentListTable"
-        loading={isLoading && agentsRequest.isInitialRequest}
+        loading={isLoading}
         hasActions={true}
         noItemsMessage={
           isLoading && agentsRequest.isInitialRequest ? (
@@ -508,15 +515,13 @@ export const AgentListPage: React.FunctionComponent<{}> = () => {
               id="xpack.ingestManager.agentList.loadingAgentsMessage"
               defaultMessage="Loading agents…"
             />
-          ) : !search.trim() && selectedConfigs.length === 0 && totalAgents === 0 ? (
-            emptyPrompt
-          ) : (
+          ) : search.trim() || selectedConfigs.length || selectedStatus.length ? (
             <FormattedMessage
               id="xpack.ingestManager.agentList.noFilteredAgentsPrompt"
               defaultMessage="No agents found. {clearFiltersLink}"
               values={{
                 clearFiltersLink: (
-                  <EuiLink onClick={() => setSearch('')}>
+                  <EuiLink onClick={() => clearFilters()}>
                     <FormattedMessage
                       id="xpack.ingestManager.agentList.clearFiltersLinkText"
                       defaultMessage="Clear filters"
@@ -525,7 +530,9 @@ export const AgentListPage: React.FunctionComponent<{}> = () => {
                 ),
               }}
             />
-          )
+          ) : !isLoading && totalAgents === 0 ? (
+            emptyPrompt
+          ) : undefined
         }
         items={totalAgents ? agents : []}
         itemId="id"
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/components/donut_chart.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/components/donut_chart.tsx
index bfa9c80f12851..99a4f27b428fe 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/components/donut_chart.tsx
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/components/donut_chart.tsx
@@ -31,7 +31,7 @@ export const DonutChart = ({ height, width, data }: DonutChartProps) => {
         .ordinal()
         // @ts-ignore
         .domain(data)
-        .range(['#017D73', '#98A2B3', '#BD271E']);
+        .range(['#017D73', '#98A2B3', '#BD271E', '#F5A700']);
       const pieGenerator = d3.layout
         .pie()
         .value(({ value }: any) => value)
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/components/list_layout.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/components/list_layout.tsx
index 46190033d4d6b..16acda9dc4afd 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/components/list_layout.tsx
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/components/list_layout.tsx
@@ -66,6 +66,7 @@ export const ListLayout: React.FunctionComponent<{}> = ({ children }) => {
             online: agentStatus?.online || 0,
             offline: agentStatus?.offline || 0,
             error: agentStatus?.error || 0,
+            other: agentStatus?.other || 0,
           }}
         />
       </EuiFlexItem>
diff --git a/x-pack/plugins/ingest_manager/public/plugin.ts b/x-pack/plugins/ingest_manager/public/plugin.ts
index 670e75f7a241b..fde4e93f8e39f 100644
--- a/x-pack/plugins/ingest_manager/public/plugin.ts
+++ b/x-pack/plugins/ingest_manager/public/plugin.ts
@@ -72,6 +72,7 @@ export class IngestManagerPlugin
       id: PLUGIN_ID,
       category: DEFAULT_APP_CATEGORIES.management,
       title: i18n.translate('xpack.ingestManager.appTitle', { defaultMessage: 'Ingest Manager' }),
+      order: 9020,
       euiIconType: 'savedObjectsApp',
       async mount(params: AppMountParameters) {
         const [coreStart, startDeps] = (await core.getStartServices()) as [
diff --git a/x-pack/plugins/ingest_manager/server/services/agents/status.ts b/x-pack/plugins/ingest_manager/server/services/agents/status.ts
index 016a2344cf532..86336714a511e 100644
--- a/x-pack/plugins/ingest_manager/server/services/agents/status.ts
+++ b/x-pack/plugins/ingest_manager/server/services/agents/status.ts
@@ -25,9 +25,10 @@ export async function getAgentStatusForConfig(
   soClient: SavedObjectsClientContract,
   configId?: string
 ) {
-  const [all, error, offline] = await Promise.all(
+  const [all, online, error, offline] = await Promise.all(
     [
       undefined,
+      AgentStatusKueryHelper.buildKueryForOnlineAgents(),
       AgentStatusKueryHelper.buildKueryForErrorAgents(),
       AgentStatusKueryHelper.buildKueryForOfflineAgents(),
     ].map((kuery) =>
@@ -47,9 +48,10 @@ export async function getAgentStatusForConfig(
   return {
     events: await getEventsCount(soClient, configId),
     total: all.total,
-    online: all.total - error.total - offline.total,
+    online: online.total,
     error: error.total,
     offline: offline.total,
+    other: all.total - online.total - error.total - offline.total,
   };
 }
 
diff --git a/x-pack/plugins/ingest_manager/server/services/epm/elasticsearch/template/__snapshots__/template.test.ts.snap b/x-pack/plugins/ingest_manager/server/services/epm/elasticsearch/template/__snapshots__/template.test.ts.snap
index 7437321163749..219c2de675359 100644
--- a/x-pack/plugins/ingest_manager/server/services/epm/elasticsearch/template/__snapshots__/template.test.ts.snap
+++ b/x-pack/plugins/ingest_manager/server/services/epm/elasticsearch/template/__snapshots__/template.test.ts.snap
@@ -10,7 +10,7 @@ exports[`tests loading base.yml: base.yml 1`] = `
     "settings": {
       "index": {
         "lifecycle": {
-          "name": "logs-default"
+          "name": "logs"
         },
         "codec": "best_compression",
         "mapping": {
@@ -91,9 +91,7 @@ exports[`tests loading base.yml: base.yml 1`] = `
     },
     "aliases": {}
   },
-  "data_stream": {
-    "timestamp_field": "@timestamp"
-  },
+  "data_stream": {},
   "composed_of": [],
   "_meta": {
     "package": {
@@ -115,7 +113,7 @@ exports[`tests loading coredns.logs.yml: coredns.logs.yml 1`] = `
     "settings": {
       "index": {
         "lifecycle": {
-          "name": "logs-default"
+          "name": "logs"
         },
         "codec": "best_compression",
         "mapping": {
@@ -196,9 +194,7 @@ exports[`tests loading coredns.logs.yml: coredns.logs.yml 1`] = `
     },
     "aliases": {}
   },
-  "data_stream": {
-    "timestamp_field": "@timestamp"
-  },
+  "data_stream": {},
   "composed_of": [],
   "_meta": {
     "package": {
@@ -220,7 +216,7 @@ exports[`tests loading system.yml: system.yml 1`] = `
     "settings": {
       "index": {
         "lifecycle": {
-          "name": "metrics-default"
+          "name": "metrics"
         },
         "codec": "best_compression",
         "mapping": {
@@ -1685,9 +1681,7 @@ exports[`tests loading system.yml: system.yml 1`] = `
     },
     "aliases": {}
   },
-  "data_stream": {
-    "timestamp_field": "@timestamp"
-  },
+  "data_stream": {},
   "composed_of": [],
   "_meta": {
     "package": {
diff --git a/x-pack/plugins/ingest_manager/server/services/epm/elasticsearch/template/template.ts b/x-pack/plugins/ingest_manager/server/services/epm/elasticsearch/template/template.ts
index b907c735d2630..876573f2270ea 100644
--- a/x-pack/plugins/ingest_manager/server/services/epm/elasticsearch/template/template.ts
+++ b/x-pack/plugins/ingest_manager/server/services/epm/elasticsearch/template/template.ts
@@ -262,7 +262,7 @@ function getBaseTemplate(
         index: {
           // ILM Policy must be added here, for now point to the default global ILM policy name
           lifecycle: {
-            name: `${type}-default`,
+            name: type,
           },
           // What should be our default for the compression?
           codec: 'best_compression',
@@ -308,9 +308,7 @@ function getBaseTemplate(
       // To be filled with the aliases that we need
       aliases: {},
     },
-    data_stream: {
-      timestamp_field: '@timestamp',
-    },
+    data_stream: {},
     composed_of: composedOfTemplates,
     _meta: {
       package: {
diff --git a/x-pack/plugins/ingest_manager/server/services/epm/kibana/assets/install.ts b/x-pack/plugins/ingest_manager/server/services/epm/kibana/assets/install.ts
index 2a743f244e64d..a3fe444b19b1a 100644
--- a/x-pack/plugins/ingest_manager/server/services/epm/kibana/assets/install.ts
+++ b/x-pack/plugins/ingest_manager/server/services/epm/kibana/assets/install.ts
@@ -11,10 +11,14 @@ import {
 } from 'src/core/server';
 import { PACKAGES_SAVED_OBJECT_TYPE } from '../../../../../common';
 import * as Registry from '../../registry';
-import { AssetType, KibanaAssetType, AssetReference } from '../../../../types';
+import {
+  AssetType,
+  KibanaAssetType,
+  AssetReference,
+  KibanaAssetReference,
+} from '../../../../types';
 import { deleteKibanaSavedObjectsAssets } from '../../packages/remove';
 import { getInstallationObject, savedObjectTypes } from '../../packages';
-import { saveInstalledKibanaRefs } from '../../packages/install';
 
 type SavedObjectToBe = Required<SavedObjectsBulkCreateObject> & { type: AssetType };
 export type ArchiveAsset = Pick<
@@ -49,7 +53,7 @@ export async function installKibanaAssets(options: {
   pkgName: string;
   paths: string[];
   isUpdate: boolean;
-}): Promise<AssetReference[]> {
+}): Promise<KibanaAssetReference[]> {
   const { savedObjectsClient, paths, pkgName, isUpdate } = options;
 
   if (isUpdate) {
@@ -65,16 +69,14 @@ export async function installKibanaAssets(options: {
 
   // install the new assets and save installation references
   const kibanaAssetTypes = Object.values(KibanaAssetType);
-  const installationPromises = kibanaAssetTypes.map((assetType) =>
-    installKibanaSavedObjects({ savedObjectsClient, assetType, paths })
+  const installedAssets = await Promise.all(
+    kibanaAssetTypes.map((assetType) =>
+      installKibanaSavedObjects({ savedObjectsClient, assetType, paths })
+    )
   );
   // installKibanaSavedObjects returns AssetReference[], so .map creates AssetReference[][]
   // call .flat to flatten into one dimensional array
-  const newInstalledKibanaAssets = await Promise.all(installationPromises).then((results) =>
-    results.flat()
-  );
-  await saveInstalledKibanaRefs(savedObjectsClient, pkgName, newInstalledKibanaAssets);
-  return newInstalledKibanaAssets;
+  return installedAssets.flat();
 }
 export const deleteKibanaInstalledRefs = async (
   savedObjectsClient: SavedObjectsClientContract,
diff --git a/x-pack/plugins/ingest_manager/server/services/epm/packages/install.ts b/x-pack/plugins/ingest_manager/server/services/epm/packages/install.ts
index 35c5b58a93710..a69daae6e0410 100644
--- a/x-pack/plugins/ingest_manager/server/services/epm/packages/install.ts
+++ b/x-pack/plugins/ingest_manager/server/services/epm/packages/install.ts
@@ -6,6 +6,7 @@
 
 import { SavedObjectsClientContract } from 'src/core/server';
 import Boom from 'boom';
+import semver from 'semver';
 import { PACKAGES_SAVED_OBJECT_TYPE } from '../../../constants';
 import {
   AssetReference,
@@ -95,8 +96,7 @@ export async function installPackage(options: {
   // TODO: calls to getInstallationObject, Registry.fetchInfo, and Registry.fetchFindLatestPackge
   // and be replaced by getPackageInfo after adjusting for it to not group/use archive assets
   const latestPackage = await Registry.fetchFindLatestPackage(pkgName);
-
-  if (pkgVersion < latestPackage.version)
+  if (semver.lt(pkgVersion, latestPackage.version))
     throw Boom.badRequest('Cannot install or update to an out-of-date package');
 
   const paths = await Registry.getArchiveInfo(pkgName, pkgVersion);
@@ -169,17 +169,20 @@ export async function installPackage(options: {
     );
   }
 
-  // update to newly installed version when all assets are successfully installed
-  if (isUpdate) await updateVersion(savedObjectsClient, pkgName, pkgVersion);
   // get template refs to save
   const installedTemplateRefs = installedTemplates.map((template) => ({
     id: template.templateName,
     type: ElasticsearchAssetType.indexTemplate,
   }));
+
   const [installedKibanaAssets] = await Promise.all([
     installKibanaAssetsPromise,
     installIndexPatternPromise,
   ]);
+
+  await saveInstalledKibanaRefs(savedObjectsClient, pkgName, installedKibanaAssets);
+  // update to newly installed version when all assets are successfully installed
+  if (isUpdate) await updateVersion(savedObjectsClient, pkgName, pkgVersion);
   return [...installedKibanaAssets, ...installedPipelines, ...installedTemplateRefs];
 }
 const updateVersion = async (
@@ -230,7 +233,7 @@ export async function createInstallation(options: {
 export const saveInstalledKibanaRefs = async (
   savedObjectsClient: SavedObjectsClientContract,
   pkgName: string,
-  installedAssets: AssetReference[]
+  installedAssets: KibanaAssetReference[]
 ) => {
   await savedObjectsClient.update(PACKAGES_SAVED_OBJECT_TYPE, pkgName, {
     installed_kibana: installedAssets,
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/datapanel.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/datapanel.tsx
index 6854452fd02a4..bb564214e4fab 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/datapanel.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/datapanel.tsx
@@ -125,6 +125,7 @@ export function IndexPatternDataPanel({
       id,
       title: indexPatterns[id].title,
       timeFieldName: indexPatterns[id].timeFieldName,
+      fields: indexPatterns[id].fields,
     }));
 
   const dslQuery = buildSafeEsQuery(
@@ -197,6 +198,7 @@ export function IndexPatternDataPanel({
           charts={charts}
           onChangeIndexPattern={onChangeIndexPattern}
           existingFields={state.existingFields}
+          existenceFetchFailed={state.existenceFetchFailed}
         />
       )}
     </>
@@ -231,6 +233,7 @@ export const InnerIndexPatternDataPanel = function InnerIndexPatternDataPanel({
   currentIndexPatternId,
   indexPatternRefs,
   indexPatterns,
+  existenceFetchFailed,
   query,
   dateRange,
   filters,
@@ -249,6 +252,7 @@ export const InnerIndexPatternDataPanel = function InnerIndexPatternDataPanel({
   onChangeIndexPattern: (newId: string) => void;
   existingFields: IndexPatternPrivateState['existingFields'];
   charts: ChartsPluginSetup;
+  existenceFetchFailed?: boolean;
 }) {
   const [localState, setLocalState] = useState<DataPanelState>({
     nameFilter: '',
@@ -553,9 +557,15 @@ export const InnerIndexPatternDataPanel = function InnerIndexPatternDataPanel({
               <FieldsAccordion
                 initialIsOpen={localState.isAvailableAccordionOpen}
                 id="lnsIndexPatternAvailableFields"
-                label={i18n.translate('xpack.lens.indexPattern.availableFieldsLabel', {
-                  defaultMessage: 'Available fields',
-                })}
+                label={
+                  existenceFetchFailed
+                    ? i18n.translate('xpack.lens.indexPattern.allFieldsLabel', {
+                        defaultMessage: 'All fields',
+                      })
+                    : i18n.translate('xpack.lens.indexPattern.availableFieldsLabel', {
+                        defaultMessage: 'Available fields',
+                      })
+                }
                 exists={true}
                 hasLoaded={!!hasSyncedExistingFields}
                 fieldsCount={filteredFieldGroups.availableFields.length}
@@ -576,6 +586,7 @@ export const InnerIndexPatternDataPanel = function InnerIndexPatternDataPanel({
                     Math.max(PAGINATION_SIZE, Math.min(pageSize * 1.5, displayedFieldLength))
                   );
                 }}
+                showExistenceFetchError={existenceFetchFailed}
                 renderCallout={
                   <NoFieldsCallout
                     isAffectedByGlobalFilter={!!filters.length}
@@ -588,42 +599,44 @@ export const InnerIndexPatternDataPanel = function InnerIndexPatternDataPanel({
                 }
               />
               <EuiSpacer size="m" />
-              <FieldsAccordion
-                initialIsOpen={localState.isEmptyAccordionOpen}
-                isFiltered={
-                  filteredFieldGroups.emptyFields.length !== fieldGroups.emptyFields.length
-                }
-                fieldsCount={filteredFieldGroups.emptyFields.length}
-                paginatedFields={paginatedEmptyFields}
-                hasLoaded={!!hasSyncedExistingFields}
-                exists={false}
-                fieldProps={fieldProps}
-                id="lnsIndexPatternEmptyFields"
-                label={i18n.translate('xpack.lens.indexPattern.emptyFieldsLabel', {
-                  defaultMessage: 'Empty fields',
-                })}
-                onToggle={(open) => {
-                  setLocalState((s) => ({
-                    ...s,
-                    isEmptyAccordionOpen: open,
-                  }));
-                  const displayedFieldLength =
-                    (localState.isAvailableAccordionOpen
-                      ? filteredFieldGroups.availableFields.length
-                      : 0) + (open ? filteredFieldGroups.emptyFields.length : 0);
-                  setPageSize(
-                    Math.max(PAGINATION_SIZE, Math.min(pageSize * 1.5, displayedFieldLength))
-                  );
-                }}
-                renderCallout={
-                  <NoFieldsCallout
-                    isAffectedByFieldFilter={
-                      !!(localState.typeFilter.length || localState.nameFilter.length)
-                    }
-                    existFieldsInIndex={!!fieldGroups.emptyFields.length}
-                  />
-                }
-              />
+              {!existenceFetchFailed && (
+                <FieldsAccordion
+                  initialIsOpen={localState.isEmptyAccordionOpen}
+                  isFiltered={
+                    filteredFieldGroups.emptyFields.length !== fieldGroups.emptyFields.length
+                  }
+                  fieldsCount={filteredFieldGroups.emptyFields.length}
+                  paginatedFields={paginatedEmptyFields}
+                  hasLoaded={!!hasSyncedExistingFields}
+                  exists={false}
+                  fieldProps={fieldProps}
+                  id="lnsIndexPatternEmptyFields"
+                  label={i18n.translate('xpack.lens.indexPattern.emptyFieldsLabel', {
+                    defaultMessage: 'Empty fields',
+                  })}
+                  onToggle={(open) => {
+                    setLocalState((s) => ({
+                      ...s,
+                      isEmptyAccordionOpen: open,
+                    }));
+                    const displayedFieldLength =
+                      (localState.isAvailableAccordionOpen
+                        ? filteredFieldGroups.availableFields.length
+                        : 0) + (open ? filteredFieldGroups.emptyFields.length : 0);
+                    setPageSize(
+                      Math.max(PAGINATION_SIZE, Math.min(pageSize * 1.5, displayedFieldLength))
+                    );
+                  }}
+                  renderCallout={
+                    <NoFieldsCallout
+                      isAffectedByFieldFilter={
+                        !!(localState.typeFilter.length || localState.nameFilter.length)
+                      }
+                      existFieldsInIndex={!!fieldGroups.emptyFields.length}
+                    />
+                  }
+                />
+              )}
               <EuiSpacer size="m" />
             </div>
           </div>
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/dimension_panel.test.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/dimension_panel.test.tsx
index e4dbc64184528..1f48f95ee45e0 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/dimension_panel.test.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/dimension_panel.test.tsx
@@ -314,11 +314,11 @@ describe('IndexPatternDimensionEditorPanel', () => {
       const items: EuiListGroupItemProps[] = wrapper.find(EuiListGroup).prop('listItems') || [];
 
       expect(items.find(({ label }) => label === 'Minimum')!['data-test-subj']).not.toContain(
-        'Incompatible'
+        'incompatible'
       );
 
       expect(items.find(({ label }) => label === 'Date histogram')!['data-test-subj']).toContain(
-        'Incompatible'
+        'incompatible'
       );
     });
 
@@ -601,7 +601,7 @@ describe('IndexPatternDimensionEditorPanel', () => {
 
         act(() => {
           wrapper
-            .find('button[data-test-subj="lns-indexPatternDimensionIncompatible-terms"]')
+            .find('button[data-test-subj="lns-indexPatternDimension-terms incompatible"]')
             .simulate('click');
         });
 
@@ -612,7 +612,7 @@ describe('IndexPatternDimensionEditorPanel', () => {
         wrapper = mount(<IndexPatternDimensionEditorComponent {...defaultProps} />);
 
         wrapper
-          .find('button[data-test-subj="lns-indexPatternDimensionIncompatible-terms"]')
+          .find('button[data-test-subj="lns-indexPatternDimension-terms incompatible"]')
           .simulate('click');
 
         expect(wrapper.find('[data-test-subj="indexPattern-invalid-operation"]')).not.toHaveLength(
@@ -626,7 +626,7 @@ describe('IndexPatternDimensionEditorPanel', () => {
         wrapper = mount(<IndexPatternDimensionEditorComponent {...defaultProps} />);
 
         wrapper
-          .find('button[data-test-subj="lns-indexPatternDimensionIncompatible-terms"]')
+          .find('button[data-test-subj="lns-indexPatternDimension-terms incompatible"]')
           .simulate('click');
 
         wrapper
@@ -640,7 +640,7 @@ describe('IndexPatternDimensionEditorPanel', () => {
         wrapper = mount(<IndexPatternDimensionEditorComponent {...defaultProps} />);
 
         wrapper
-          .find('button[data-test-subj="lns-indexPatternDimensionIncompatible-terms"]')
+          .find('button[data-test-subj="lns-indexPatternDimension-terms incompatible"]')
           .simulate('click');
 
         const options = wrapper
@@ -722,7 +722,7 @@ describe('IndexPatternDimensionEditorPanel', () => {
         );
 
         wrapper
-          .find('button[data-test-subj="lns-indexPatternDimensionIncompatible-count"]')
+          .find('button[data-test-subj="lns-indexPatternDimension-count incompatible"]')
           .simulate('click');
 
         const newColumnState = setState.mock.calls[0][0].layers.first.columns.col2;
@@ -758,7 +758,7 @@ describe('IndexPatternDimensionEditorPanel', () => {
         );
 
         wrapper
-          .find('button[data-test-subj="lns-indexPatternDimensionIncompatible-terms"]')
+          .find('button[data-test-subj="lns-indexPatternDimension-terms incompatible"]')
           .simulate('click');
 
         const options = wrapper
@@ -781,7 +781,7 @@ describe('IndexPatternDimensionEditorPanel', () => {
 
         act(() => {
           wrapper
-            .find('button[data-test-subj="lns-indexPatternDimensionIncompatible-terms"]')
+            .find('button[data-test-subj="lns-indexPatternDimension-terms incompatible"]')
             .simulate('click');
         });
 
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/popover_editor.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/popover_editor.tsx
index 2fb7382f992e7..a5108b30cea1d 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/popover_editor.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/popover_editor.tsx
@@ -156,9 +156,9 @@ export function PopoverEditor(props: PopoverEditorProps) {
         isActive,
         size: 's',
         className: 'lnsIndexPatternDimensionEditor__operation',
-        'data-test-subj': `lns-indexPatternDimension${
-          compatibleWithCurrentField ? '' : 'Incompatible'
-        }-${operationType}`,
+        'data-test-subj': `lns-indexPatternDimension-${operationType}${
+          compatibleWithCurrentField ? '' : ' incompatible'
+        }`,
         onClick() {
           if (!selectedColumn || !compatibleWithCurrentField) {
             const possibleFields = fieldByOperation[operationType] || [];
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/fields_accordion.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/fields_accordion.tsx
index 7cc049c107b87..1d60b0b5cbbee 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/fields_accordion.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/fields_accordion.tsx
@@ -6,12 +6,14 @@
 
 import './datapanel.scss';
 import React, { memo, useCallback } from 'react';
+import { i18n } from '@kbn/i18n';
 import {
   EuiText,
   EuiNotificationBadge,
   EuiSpacer,
   EuiAccordion,
   EuiLoadingSpinner,
+  EuiIconTip,
 } from '@elastic/eui';
 import { DataPublicPluginStart } from 'src/plugins/data/public';
 import { IndexPatternField } from './types';
@@ -44,6 +46,7 @@ export interface FieldsAccordionProps {
   fieldProps: FieldItemSharedProps;
   renderCallout: JSX.Element;
   exists: boolean;
+  showExistenceFetchError?: boolean;
 }
 
 export const InnerFieldsAccordion = function InnerFieldsAccordion({
@@ -58,6 +61,7 @@ export const InnerFieldsAccordion = function InnerFieldsAccordion({
   fieldProps,
   renderCallout,
   exists,
+  showExistenceFetchError,
 }: FieldsAccordionProps) {
   const renderField = useCallback(
     (field: IndexPatternField) => {
@@ -78,7 +82,18 @@ export const InnerFieldsAccordion = function InnerFieldsAccordion({
         </EuiText>
       }
       extraAction={
-        hasLoaded ? (
+        showExistenceFetchError ? (
+          <EuiIconTip
+            aria-label={i18n.translate('xpack.lens.indexPattern.existenceErrorAriaLabel', {
+              defaultMessage: 'Existence fetch failed',
+            })}
+            type="alert"
+            color="warning"
+            content={i18n.translate('xpack.lens.indexPattern.existenceErrorLabel', {
+              defaultMessage: "Field information can't be loaded",
+            })}
+          />
+        ) : hasLoaded ? (
           <EuiNotificationBadge size="m" color={isFiltered ? 'accent' : 'subdued'}>
             {fieldsCount}
           </EuiNotificationBadge>
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/loader.test.ts b/x-pack/plugins/lens/public/indexpattern_datasource/loader.test.ts
index 5776691fbcc7f..27904a0f23f16 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/loader.test.ts
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/loader.test.ts
@@ -13,7 +13,7 @@ import {
   changeLayerIndexPattern,
   syncExistingFields,
 } from './loader';
-import { IndexPatternPersistedState, IndexPatternPrivateState } from './types';
+import { IndexPatternPersistedState, IndexPatternPrivateState, IndexPatternField } from './types';
 import { documentField } from './document_field';
 
 jest.mock('./operations');
@@ -642,7 +642,11 @@ describe('loader', () => {
       await syncExistingFields({
         dateRange: { fromDate: '1900-01-01', toDate: '2000-01-01' },
         fetchJson,
-        indexPatterns: [{ id: 'a' }, { id: 'b' }, { id: 'c' }],
+        indexPatterns: [
+          { id: 'a', title: 'a', fields: [] },
+          { id: 'b', title: 'a', fields: [] },
+          { id: 'c', title: 'a', fields: [] },
+        ],
         setState,
         dslQuery,
         showNoDataPopover: jest.fn(),
@@ -662,6 +666,7 @@ describe('loader', () => {
       expect(newState).toEqual({
         foo: 'bar',
         isFirstExistenceFetch: false,
+        existenceFetchFailed: false,
         existingFields: {
           a: { a_field_1: true, a_field_2: true },
           b: { b_field_1: true, b_field_2: true },
@@ -687,7 +692,11 @@ describe('loader', () => {
       const args = {
         dateRange: { fromDate: '1900-01-01', toDate: '2000-01-01' },
         fetchJson,
-        indexPatterns: [{ id: 'a' }, { id: 'b' }, { id: 'c' }],
+        indexPatterns: [
+          { id: 'a', title: 'a', fields: [] },
+          { id: 'b', title: 'a', fields: [] },
+          { id: 'c', title: 'a', fields: [] },
+        ],
         setState,
         dslQuery,
         showNoDataPopover: jest.fn(),
@@ -702,5 +711,45 @@ describe('loader', () => {
       await syncExistingFields({ ...args, isFirstExistenceFetch: true });
       expect(showNoDataPopover).not.toHaveBeenCalled();
     });
+
+    it('should set all fields to available and existence error flag if the request fails', async () => {
+      const setState = jest.fn();
+      const fetchJson = (jest.fn((path: string) => {
+        return new Promise((resolve, reject) => {
+          reject(new Error());
+        });
+      }) as unknown) as HttpHandler;
+
+      const args = {
+        dateRange: { fromDate: '1900-01-01', toDate: '2000-01-01' },
+        fetchJson,
+        indexPatterns: [
+          {
+            id: 'a',
+            title: 'a',
+            fields: [{ name: 'field1' }, { name: 'field2' }] as IndexPatternField[],
+          },
+        ],
+        setState,
+        dslQuery,
+        showNoDataPopover: jest.fn(),
+        currentIndexPatternTitle: 'abc',
+        isFirstExistenceFetch: false,
+      };
+
+      await syncExistingFields(args);
+
+      const [fn] = setState.mock.calls[0];
+      const newState = fn({
+        foo: 'bar',
+        existingFields: {},
+      }) as IndexPatternPrivateState;
+
+      expect(newState.existenceFetchFailed).toEqual(true);
+      expect(newState.existingFields.a).toEqual({
+        field1: true,
+        field2: true,
+      });
+    });
   });
 });
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/loader.ts b/x-pack/plugins/lens/public/indexpattern_datasource/loader.ts
index e995c7317b5d8..20e7bec6db131 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/loader.ts
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/loader.ts
@@ -246,7 +246,12 @@ export async function syncExistingFields({
   showNoDataPopover,
 }: {
   dateRange: DateRange;
-  indexPatterns: Array<{ id: string; timeFieldName?: string | null }>;
+  indexPatterns: Array<{
+    id: string;
+    title: string;
+    fields: IndexPatternField[];
+    timeFieldName?: string | null;
+  }>;
   fetchJson: HttpSetup['post'];
   setState: SetState;
   isFirstExistenceFetch: boolean;
@@ -254,41 +259,53 @@ export async function syncExistingFields({
   dslQuery: object;
   showNoDataPopover: () => void;
 }) {
-  const emptinessInfo = await Promise.all(
-    indexPatterns.map((pattern) => {
-      const body: Record<string, string | object> = {
-        dslQuery,
-        fromDate: dateRange.fromDate,
-        toDate: dateRange.toDate,
-      };
-
-      if (pattern.timeFieldName) {
-        body.timeFieldName = pattern.timeFieldName;
-      }
+  const existenceRequests = indexPatterns.map((pattern) => {
+    const body: Record<string, string | object> = {
+      dslQuery,
+      fromDate: dateRange.fromDate,
+      toDate: dateRange.toDate,
+    };
 
-      return fetchJson(`${BASE_API_URL}/existing_fields/${pattern.id}`, {
-        body: JSON.stringify(body),
-      }) as Promise<ExistingFields>;
-    })
-  );
+    if (pattern.timeFieldName) {
+      body.timeFieldName = pattern.timeFieldName;
+    }
 
-  if (isFirstExistenceFetch) {
-    const fieldsCurrentIndexPattern = emptinessInfo.find(
-      (info) => info.indexPatternTitle === currentIndexPatternTitle
-    );
-    if (fieldsCurrentIndexPattern && fieldsCurrentIndexPattern.existingFieldNames.length === 0) {
-      showNoDataPopover();
+    return fetchJson(`${BASE_API_URL}/existing_fields/${pattern.id}`, {
+      body: JSON.stringify(body),
+    }) as Promise<ExistingFields>;
+  });
+
+  try {
+    const emptinessInfo = await Promise.all(existenceRequests);
+    if (isFirstExistenceFetch) {
+      const fieldsCurrentIndexPattern = emptinessInfo.find(
+        (info) => info.indexPatternTitle === currentIndexPatternTitle
+      );
+      if (fieldsCurrentIndexPattern && fieldsCurrentIndexPattern.existingFieldNames.length === 0) {
+        showNoDataPopover();
+      }
     }
-  }
 
-  setState((state) => ({
-    ...state,
-    isFirstExistenceFetch: false,
-    existingFields: emptinessInfo.reduce((acc, info) => {
-      acc[info.indexPatternTitle] = booleanMap(info.existingFieldNames);
-      return acc;
-    }, state.existingFields),
-  }));
+    setState((state) => ({
+      ...state,
+      isFirstExistenceFetch: false,
+      existenceFetchFailed: false,
+      existingFields: emptinessInfo.reduce((acc, info) => {
+        acc[info.indexPatternTitle] = booleanMap(info.existingFieldNames);
+        return acc;
+      }, state.existingFields),
+    }));
+  } catch (e) {
+    // show all fields as available if fetch failed
+    setState((state) => ({
+      ...state,
+      existenceFetchFailed: true,
+      existingFields: indexPatterns.reduce((acc, pattern) => {
+        acc[pattern.title] = booleanMap(pattern.fields.map((field) => field.name));
+        return acc;
+      }, state.existingFields),
+    }));
+  }
 }
 
 function booleanMap(keys: string[]) {
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/types.ts b/x-pack/plugins/lens/public/indexpattern_datasource/types.ts
index b7beb67196add..2a9b3f452d991 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/types.ts
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/types.ts
@@ -52,6 +52,7 @@ export type IndexPatternPrivateState = IndexPatternPersistedState & {
    */
   existingFields: Record<string, Record<string, boolean>>;
   isFirstExistenceFetch: boolean;
+  existenceFetchFailed?: boolean;
 };
 
 export interface IndexPatternRef {
diff --git a/x-pack/plugins/lists/common/constants.mock.ts b/x-pack/plugins/lists/common/constants.mock.ts
index 7f7a90eeba5a2..4924ba24426af 100644
--- a/x-pack/plugins/lists/common/constants.mock.ts
+++ b/x-pack/plugins/lists/common/constants.mock.ts
@@ -58,3 +58,5 @@ export const ITEM_TYPE = 'simple';
 export const _TAGS = [];
 export const TAGS = [];
 export const COMMENTS = [];
+export const FILTER = 'name:Nicolas Bourbaki';
+export const CURSOR = 'c29tZXN0cmluZ2ZvcnlvdQ==';
diff --git a/x-pack/plugins/lists/common/schemas/elastic_query/update_es_list_schema.ts b/x-pack/plugins/lists/common/schemas/elastic_query/update_es_list_schema.ts
index d008a82308153..8f23f3744e563 100644
--- a/x-pack/plugins/lists/common/schemas/elastic_query/update_es_list_schema.ts
+++ b/x-pack/plugins/lists/common/schemas/elastic_query/update_es_list_schema.ts
@@ -16,7 +16,6 @@ import {
   updated_by,
 } from '../common/schemas';
 
-// TODO: Should we use partial here and everywhere these are instead of this OrUndefined?
 export const updateEsListSchema = t.exact(
   t.type({
     description: descriptionOrUndefined,
diff --git a/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.mock.ts b/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.mock.ts
new file mode 100644
index 0000000000000..5c4aff1fedcd3
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.mock.ts
@@ -0,0 +1,30 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import {
+  COMMENTS,
+  DESCRIPTION,
+  ENTRIES,
+  ITEM_TYPE,
+  META,
+  NAME,
+  TAGS,
+  _TAGS,
+} from '../../constants.mock';
+
+import { CreateEndpointListItemSchema } from './create_endpoint_list_item_schema';
+
+export const getCreateEndpointListItemSchemaMock = (): CreateEndpointListItemSchema => ({
+  _tags: _TAGS,
+  comments: COMMENTS,
+  description: DESCRIPTION,
+  entries: ENTRIES,
+  item_id: undefined,
+  meta: META,
+  name: NAME,
+  tags: TAGS,
+  type: ITEM_TYPE,
+});
diff --git a/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts b/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts
new file mode 100644
index 0000000000000..916e8db483454
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts
@@ -0,0 +1,216 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { left } from 'fp-ts/lib/Either';
+import { pipe } from 'fp-ts/lib/pipeable';
+
+import { exactCheck, foldLeftRight, getPaths } from '../../siem_common_deps';
+import { getCreateCommentsArrayMock } from '../types/create_comments.mock';
+import { getCommentsMock } from '../types/comments.mock';
+import { CommentsArray } from '../types';
+
+import {
+  CreateEndpointListItemSchema,
+  createEndpointListItemSchema,
+} from './create_endpoint_list_item_schema';
+import { getCreateEndpointListItemSchemaMock } from './create_endpoint_list_item_schema.mock';
+
+describe('create_endpoint_list_item_schema', () => {
+  test('it should validate a typical list item request not counting the auto generated uuid', () => {
+    const payload = getCreateEndpointListItemSchemaMock();
+    const decoded = createEndpointListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    delete (message.schema as CreateEndpointListItemSchema).item_id;
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should not validate an undefined for "description"', () => {
+    const payload = getCreateEndpointListItemSchemaMock();
+    delete payload.description;
+    const decoded = createEndpointListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "undefined" supplied to "description"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should not validate an undefined for "name"', () => {
+    const payload = getCreateEndpointListItemSchemaMock();
+    delete payload.name;
+    const decoded = createEndpointListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "undefined" supplied to "name"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should not validate an undefined for "type"', () => {
+    const payload = getCreateEndpointListItemSchemaMock();
+    delete payload.type;
+    const decoded = createEndpointListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "undefined" supplied to "type"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should not validate a "list_id" since it does not required one', () => {
+    const inputPayload: CreateEndpointListItemSchema & { list_id: string } = {
+      ...getCreateEndpointListItemSchemaMock(),
+      list_id: 'list-123',
+    };
+    const decoded = createEndpointListItemSchema.decode(inputPayload);
+    const checked = exactCheck(inputPayload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual(['invalid keys "list_id"']);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should not validate a "namespace_type" since it does not required one', () => {
+    const inputPayload: CreateEndpointListItemSchema & { namespace_type: string } = {
+      ...getCreateEndpointListItemSchemaMock(),
+      namespace_type: 'single',
+    };
+    const decoded = createEndpointListItemSchema.decode(inputPayload);
+    const checked = exactCheck(inputPayload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual(['invalid keys "namespace_type"']);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should validate an undefined for "meta" but strip it out and generate a correct body not counting the auto generated uuid', () => {
+    const payload = getCreateEndpointListItemSchemaMock();
+    const outputPayload = getCreateEndpointListItemSchemaMock();
+    delete payload.meta;
+    delete outputPayload.meta;
+    const decoded = createEndpointListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    delete (message.schema as CreateEndpointListItemSchema).item_id;
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(outputPayload);
+  });
+
+  test('it should validate an undefined for "comments" but return an array and generate a correct body not counting the auto generated uuid', () => {
+    const inputPayload = getCreateEndpointListItemSchemaMock();
+    const outputPayload = getCreateEndpointListItemSchemaMock();
+    delete inputPayload.comments;
+    outputPayload.comments = [];
+    const decoded = createEndpointListItemSchema.decode(inputPayload);
+    const checked = exactCheck(inputPayload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    delete (message.schema as CreateEndpointListItemSchema).item_id;
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(outputPayload);
+  });
+
+  test('it should validate "comments" array', () => {
+    const inputPayload = {
+      ...getCreateEndpointListItemSchemaMock(),
+      comments: getCreateCommentsArrayMock(),
+    };
+    const decoded = createEndpointListItemSchema.decode(inputPayload);
+    const checked = exactCheck(inputPayload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    delete (message.schema as CreateEndpointListItemSchema).item_id;
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(inputPayload);
+  });
+
+  test('it should NOT validate "comments" with "created_at" or "created_by" values', () => {
+    const inputPayload: Omit<CreateEndpointListItemSchema, 'comments'> & {
+      comments?: CommentsArray;
+    } = {
+      ...getCreateEndpointListItemSchemaMock(),
+      comments: [getCommentsMock()],
+    };
+    const decoded = createEndpointListItemSchema.decode(inputPayload);
+    const checked = exactCheck(inputPayload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual(['invalid keys "created_at,created_by"']);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should validate an undefined for "entries" but return an array', () => {
+    const inputPayload = getCreateEndpointListItemSchemaMock();
+    const outputPayload = getCreateEndpointListItemSchemaMock();
+    delete inputPayload.entries;
+    outputPayload.entries = [];
+    const decoded = createEndpointListItemSchema.decode(inputPayload);
+    const checked = exactCheck(inputPayload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    delete (message.schema as CreateEndpointListItemSchema).item_id;
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(outputPayload);
+  });
+
+  test('it should validate an undefined for "tags" but return an array and generate a correct body not counting the auto generated uuid', () => {
+    const inputPayload = getCreateEndpointListItemSchemaMock();
+    const outputPayload = getCreateEndpointListItemSchemaMock();
+    delete inputPayload.tags;
+    outputPayload.tags = [];
+    const decoded = createEndpointListItemSchema.decode(inputPayload);
+    const checked = exactCheck(inputPayload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    delete (message.schema as CreateEndpointListItemSchema).item_id;
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(outputPayload);
+  });
+
+  test('it should validate an undefined for "_tags" but return an array and generate a correct body not counting the auto generated uuid', () => {
+    const inputPayload = getCreateEndpointListItemSchemaMock();
+    const outputPayload = getCreateEndpointListItemSchemaMock();
+    delete inputPayload._tags;
+    outputPayload._tags = [];
+    const decoded = createEndpointListItemSchema.decode(inputPayload);
+    const checked = exactCheck(inputPayload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    delete (message.schema as CreateEndpointListItemSchema).item_id;
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(outputPayload);
+  });
+
+  test('it should validate an undefined for "item_id" and auto generate a uuid', () => {
+    const inputPayload = getCreateEndpointListItemSchemaMock();
+    delete inputPayload.item_id;
+    const decoded = createEndpointListItemSchema.decode(inputPayload);
+    const checked = exactCheck(inputPayload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect((message.schema as CreateEndpointListItemSchema).item_id).toMatch(
+      /^[0-9a-f]{8}-[0-9a-f]{4}-[0-5][0-9a-f]{3}-[089ab][0-9a-f]{3}-[0-9a-f]{12}$/i
+    );
+  });
+
+  test('it should validate an undefined for "item_id" and generate a correct body not counting the uuid', () => {
+    const inputPayload = getCreateEndpointListItemSchemaMock();
+    delete inputPayload.item_id;
+    const decoded = createEndpointListItemSchema.decode(inputPayload);
+    const checked = exactCheck(inputPayload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    delete (message.schema as CreateEndpointListItemSchema).item_id;
+    expect(message.schema).toEqual(inputPayload);
+  });
+
+  test('it should not allow an extra key to be sent in', () => {
+    const payload: CreateEndpointListItemSchema & {
+      extraKey: string;
+    } = { ...getCreateEndpointListItemSchemaMock(), extraKey: 'some new value' };
+    const decoded = createEndpointListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual(['invalid keys "extraKey"']);
+    expect(message.schema).toEqual({});
+  });
+});
diff --git a/x-pack/plugins/lists/common/schemas/request/delete_endpoint_list_item_schema.mock.ts b/x-pack/plugins/lists/common/schemas/request/delete_endpoint_list_item_schema.mock.ts
new file mode 100644
index 0000000000000..7fc775047e6a1
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/request/delete_endpoint_list_item_schema.mock.ts
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { ID } from '../../constants.mock';
+
+import { DeleteEndpointListItemSchema } from './delete_endpoint_list_item_schema';
+
+export const getDeleteEndpointListItemSchemaMock = (): DeleteEndpointListItemSchema => ({
+  id: ID,
+});
diff --git a/x-pack/plugins/lists/common/schemas/request/delete_endpoint_list_item_schema.test.ts b/x-pack/plugins/lists/common/schemas/request/delete_endpoint_list_item_schema.test.ts
new file mode 100644
index 0000000000000..fa75be8bc541e
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/request/delete_endpoint_list_item_schema.test.ts
@@ -0,0 +1,51 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { left } from 'fp-ts/lib/Either';
+import { pipe } from 'fp-ts/lib/pipeable';
+
+import { exactCheck, foldLeftRight, getPaths } from '../../siem_common_deps';
+
+import {
+  DeleteEndpointListItemSchema,
+  deleteEndpointListItemSchema,
+} from './delete_endpoint_list_item_schema';
+import { getDeleteEndpointListItemSchemaMock } from './delete_endpoint_list_item_schema.mock';
+
+describe('delete_endpoint_list_item_schema', () => {
+  test('it should validate a typical endpoint list item request', () => {
+    const payload = getDeleteEndpointListItemSchemaMock();
+    const decoded = deleteEndpointListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should NOT accept a value for "namespace_type" since it does not require one', () => {
+    const payload: DeleteEndpointListItemSchema & {
+      namespace_type: string;
+    } = { ...getDeleteEndpointListItemSchemaMock(), namespace_type: 'single' };
+    delete payload.namespace_type;
+    const decoded = deleteEndpointListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(getDeleteEndpointListItemSchemaMock());
+  });
+
+  test('it should not allow an extra key to be sent in', () => {
+    const payload: DeleteEndpointListItemSchema & {
+      extraKey?: string;
+    } = { ...getDeleteEndpointListItemSchemaMock(), extraKey: 'some new value' };
+    const decoded = deleteEndpointListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual(['invalid keys "extraKey"']);
+    expect(message.schema).toEqual({});
+  });
+});
diff --git a/x-pack/plugins/lists/common/schemas/request/delete_exception_list_item_schema.test.ts b/x-pack/plugins/lists/common/schemas/request/delete_exception_list_item_schema.test.ts
index 4b42f79a89329..042f62a8d129b 100644
--- a/x-pack/plugins/lists/common/schemas/request/delete_exception_list_item_schema.test.ts
+++ b/x-pack/plugins/lists/common/schemas/request/delete_exception_list_item_schema.test.ts
@@ -26,17 +26,6 @@ describe('delete_exception_list_item_schema', () => {
     expect(message.schema).toEqual(payload);
   });
 
-  // TODO It does allow an id of undefined, is this wanted behavior?
-  test.skip('it should NOT accept an undefined for an "id"', () => {
-    const payload = getDeleteExceptionListItemSchemaMock();
-    delete payload.id;
-    const decoded = deleteExceptionListItemSchema.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual(['Invalid value "undefined" supplied to "id"']);
-    expect(message.schema).toEqual({});
-  });
-
   test('it should accept an undefined for "namespace_type" but default to "single"', () => {
     const payload = getDeleteExceptionListItemSchemaMock();
     delete payload.namespace_type;
diff --git a/x-pack/plugins/lists/common/schemas/request/delete_exception_list_schema.test.ts b/x-pack/plugins/lists/common/schemas/request/delete_exception_list_schema.test.ts
index d925de8013c13..2bb0a23173bd6 100644
--- a/x-pack/plugins/lists/common/schemas/request/delete_exception_list_schema.test.ts
+++ b/x-pack/plugins/lists/common/schemas/request/delete_exception_list_schema.test.ts
@@ -26,17 +26,6 @@ describe('delete_exception_list_schema', () => {
     expect(message.schema).toEqual(payload);
   });
 
-  // TODO It does allow an id of undefined, is this wanted behavior?
-  test.skip('it should NOT accept an undefined for an id', () => {
-    const payload = getDeleteExceptionListSchemaMock();
-    delete payload.id;
-    const decoded = deleteExceptionListSchema.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual(['Invalid value "undefined" supplied to "id"']);
-    expect(message.schema).toEqual({});
-  });
-
   test('it should accept an undefined for "namespace_type" but default to "single"', () => {
     const payload = getDeleteExceptionListSchemaMock();
     delete payload.namespace_type;
diff --git a/x-pack/plugins/lists/common/schemas/request/delete_list_item_schema.mock.ts b/x-pack/plugins/lists/common/schemas/request/delete_list_item_schema.mock.ts
new file mode 100644
index 0000000000000..ea5529c39fa84
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/request/delete_list_item_schema.mock.ts
@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { ID, LIST_ID, VALUE } from '../../constants.mock';
+
+import { DeleteListItemSchema } from './delete_list_item_schema';
+
+export const getDeleteListItemSchemaMock = (): DeleteListItemSchema => ({
+  id: ID,
+  list_id: LIST_ID,
+  value: VALUE,
+});
diff --git a/x-pack/plugins/lists/common/schemas/request/delete_list_item_schema.test.ts b/x-pack/plugins/lists/common/schemas/request/delete_list_item_schema.test.ts
new file mode 100644
index 0000000000000..9bc2825d774ed
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/request/delete_list_item_schema.test.ts
@@ -0,0 +1,36 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { left } from 'fp-ts/lib/Either';
+import { pipe } from 'fp-ts/lib/pipeable';
+
+import { exactCheck, foldLeftRight, getPaths } from '../../siem_common_deps';
+
+import { DeleteListItemSchema, deleteListItemSchema } from './delete_list_item_schema';
+import { getDeleteListItemSchemaMock } from './delete_list_item_schema.mock';
+
+describe('delete_list_item_schema', () => {
+  test('it should validate a typical list item request', () => {
+    const payload = getDeleteListItemSchemaMock();
+    const decoded = deleteListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should not allow an extra key to be sent in', () => {
+    const payload: DeleteListItemSchema & {
+      extraKey?: string;
+    } = { ...getDeleteListItemSchemaMock(), extraKey: 'some new value' };
+    const decoded = deleteListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual(['invalid keys "extraKey"']);
+    expect(message.schema).toEqual({});
+  });
+});
diff --git a/x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.mock.ts b/x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.mock.ts
new file mode 100644
index 0000000000000..bff55dedf3064
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.mock.ts
@@ -0,0 +1,28 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { FILTER } from '../../constants.mock';
+
+import {
+  FindEndpointListItemSchemaPartial,
+  FindEndpointListItemSchemaPartialDecoded,
+} from './find_endpoint_list_item_schema';
+
+export const getFindEndpointListItemSchemaMock = (): FindEndpointListItemSchemaPartial => ({
+  filter: FILTER,
+  page: '1',
+  per_page: '25',
+  sort_field: undefined,
+  sort_order: undefined,
+});
+
+export const getFindEndpointListItemSchemaDecodedMock = (): FindEndpointListItemSchemaPartialDecoded => ({
+  filter: FILTER,
+  page: 1,
+  per_page: 25,
+  sort_field: undefined,
+  sort_order: undefined,
+});
diff --git a/x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts b/x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts
new file mode 100644
index 0000000000000..f9eeaa33230f9
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts
@@ -0,0 +1,110 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { left } from 'fp-ts/lib/Either';
+import { pipe } from 'fp-ts/lib/pipeable';
+
+import { exactCheck, foldLeftRight, getPaths } from '../../siem_common_deps';
+
+import {
+  getFindEndpointListItemSchemaDecodedMock,
+  getFindEndpointListItemSchemaMock,
+} from './find_endpoint_list_item_schema.mock';
+import {
+  FindEndpointListItemSchemaPartial,
+  findEndpointListItemSchema,
+} from './find_endpoint_list_item_schema';
+
+describe('find_endpoint_list_item_schema', () => {
+  test('it should validate a typical find item request', () => {
+    const payload = getFindEndpointListItemSchemaMock();
+    const decoded = findEndpointListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(getFindEndpointListItemSchemaDecodedMock());
+  });
+
+  test('it should validate and empty object since everything is optional and has defaults', () => {
+    const payload: FindEndpointListItemSchemaPartial = {};
+    const decoded = findEndpointListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should validate with page missing', () => {
+    const payload = getFindEndpointListItemSchemaMock();
+    delete payload.page;
+    const decoded = findEndpointListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    const expected = getFindEndpointListItemSchemaDecodedMock();
+    delete expected.page;
+    expect(message.schema).toEqual(expected);
+  });
+
+  test('it should validate with pre_page missing', () => {
+    const payload = getFindEndpointListItemSchemaMock();
+    delete payload.per_page;
+    const decoded = findEndpointListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    const expected = getFindEndpointListItemSchemaDecodedMock();
+    delete expected.per_page;
+    expect(message.schema).toEqual(expected);
+  });
+
+  test('it should validate with filter missing', () => {
+    const payload = getFindEndpointListItemSchemaMock();
+    delete payload.filter;
+    const decoded = findEndpointListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    const expected = getFindEndpointListItemSchemaDecodedMock();
+    delete expected.filter;
+    expect(message.schema).toEqual(expected);
+  });
+
+  test('it should validate with sort_field missing', () => {
+    const payload = getFindEndpointListItemSchemaMock();
+    delete payload.sort_field;
+    const decoded = findEndpointListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    const expected = getFindEndpointListItemSchemaDecodedMock();
+    delete expected.sort_field;
+    expect(message.schema).toEqual(expected);
+  });
+
+  test('it should validate with sort_order missing', () => {
+    const payload = getFindEndpointListItemSchemaMock();
+    delete payload.sort_order;
+    const decoded = findEndpointListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    const expected = getFindEndpointListItemSchemaDecodedMock();
+    delete expected.sort_order;
+    expect(message.schema).toEqual(expected);
+  });
+
+  test('it should not allow an extra key to be sent in', () => {
+    const payload: FindEndpointListItemSchemaPartial & {
+      extraKey: string;
+    } = { ...getFindEndpointListItemSchemaMock(), extraKey: 'some new value' };
+    const decoded = findEndpointListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual(['invalid keys "extraKey"']);
+    expect(message.schema).toEqual({});
+  });
+});
diff --git a/x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.mock.ts b/x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.mock.ts
new file mode 100644
index 0000000000000..f22e6685fe0ac
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.mock.ts
@@ -0,0 +1,52 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { FILTER, LIST_ID, NAMESPACE_TYPE } from '../../constants.mock';
+
+import {
+  FindExceptionListItemSchemaPartial,
+  FindExceptionListItemSchemaPartialDecoded,
+} from './find_exception_list_item_schema';
+
+export const getFindExceptionListItemSchemaMock = (): FindExceptionListItemSchemaPartial => ({
+  filter: FILTER,
+  list_id: LIST_ID,
+  namespace_type: NAMESPACE_TYPE,
+  page: '1',
+  per_page: '25',
+  sort_field: undefined,
+  sort_order: undefined,
+});
+
+export const getFindExceptionListItemSchemaMultipleMock = (): FindExceptionListItemSchemaPartial => ({
+  filter: 'name:Sofia Kovalevskaya,name:Hypatia,name:Sophie Germain',
+  list_id: 'list-1,list-2,list-3',
+  namespace_type: 'single,single,agnostic',
+  page: '1',
+  per_page: '25',
+  sort_field: undefined,
+  sort_order: undefined,
+});
+
+export const getFindExceptionListItemSchemaDecodedMock = (): FindExceptionListItemSchemaPartialDecoded => ({
+  filter: [FILTER],
+  list_id: [LIST_ID],
+  namespace_type: [NAMESPACE_TYPE],
+  page: 1,
+  per_page: 25,
+  sort_field: undefined,
+  sort_order: undefined,
+});
+
+export const getFindExceptionListItemSchemaDecodedMultipleMock = (): FindExceptionListItemSchemaPartialDecoded => ({
+  filter: ['name:Sofia Kovalevskaya', 'name:Hypatia', 'name:Sophie Germain'],
+  list_id: ['list-1', 'list-2', 'list-3'],
+  namespace_type: ['single', 'single', 'agnostic'],
+  page: 1,
+  per_page: 25,
+  sort_field: undefined,
+  sort_order: undefined,
+});
diff --git a/x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts b/x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts
new file mode 100644
index 0000000000000..ba64bb434d50b
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts
@@ -0,0 +1,130 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { left } from 'fp-ts/lib/Either';
+import { pipe } from 'fp-ts/lib/pipeable';
+
+import { exactCheck, foldLeftRight, getPaths } from '../../siem_common_deps';
+import { LIST_ID } from '../../constants.mock';
+
+import {
+  getFindExceptionListItemSchemaDecodedMock,
+  getFindExceptionListItemSchemaDecodedMultipleMock,
+  getFindExceptionListItemSchemaMock,
+  getFindExceptionListItemSchemaMultipleMock,
+} from './find_exception_list_item_schema.mock';
+import {
+  FindExceptionListItemSchemaPartial,
+  FindExceptionListItemSchemaPartialDecoded,
+  findExceptionListItemSchema,
+} from './find_exception_list_item_schema';
+
+describe('find_list_item_schema', () => {
+  test('it should validate a typical find item request', () => {
+    const payload = getFindExceptionListItemSchemaMock();
+    const decoded = findExceptionListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(getFindExceptionListItemSchemaDecodedMock());
+  });
+
+  test('it should validate a typical find item request with multiple input strings turned into array elements', () => {
+    const payload = getFindExceptionListItemSchemaMultipleMock();
+    const decoded = findExceptionListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(getFindExceptionListItemSchemaDecodedMultipleMock());
+  });
+
+  test('it should validate just a list_id where it decodes into an array for list_id and adds a namespace_type of "single" as an array', () => {
+    const payload: FindExceptionListItemSchemaPartial = { list_id: LIST_ID };
+    const decoded = findExceptionListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    const expected: FindExceptionListItemSchemaPartialDecoded = {
+      filter: [],
+      list_id: [LIST_ID],
+      namespace_type: ['single'],
+    };
+    expect(message.schema).toEqual(expected);
+  });
+
+  test('it should validate with page missing', () => {
+    const payload = getFindExceptionListItemSchemaMock();
+    delete payload.page;
+    const decoded = findExceptionListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    const expected = getFindExceptionListItemSchemaDecodedMock();
+    delete expected.page;
+    expect(message.schema).toEqual(expected);
+  });
+
+  test('it should validate with pre_page missing', () => {
+    const payload = getFindExceptionListItemSchemaMock();
+    delete payload.per_page;
+    const decoded = findExceptionListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    const expected = getFindExceptionListItemSchemaDecodedMock();
+    delete expected.per_page;
+    expect(message.schema).toEqual(expected);
+  });
+
+  test('it should validate with filter missing and add filter as an empty array', () => {
+    const payload = getFindExceptionListItemSchemaMock();
+    delete payload.filter;
+    const decoded = findExceptionListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    const expected: FindExceptionListItemSchemaPartialDecoded = {
+      ...getFindExceptionListItemSchemaDecodedMock(),
+      filter: [],
+    };
+    expect(message.schema).toEqual(expected);
+  });
+
+  test('it should validate with sort_field missing', () => {
+    const payload = getFindExceptionListItemSchemaMock();
+    delete payload.sort_field;
+    const decoded = findExceptionListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    const expected = getFindExceptionListItemSchemaDecodedMock();
+    delete expected.sort_field;
+    expect(message.schema).toEqual(expected);
+  });
+
+  test('it should validate with sort_order missing', () => {
+    const payload = getFindExceptionListItemSchemaMock();
+    delete payload.sort_order;
+    const decoded = findExceptionListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    const expected = getFindExceptionListItemSchemaDecodedMock();
+    delete expected.sort_order;
+    expect(message.schema).toEqual(expected);
+  });
+
+  test('it should not allow an extra key to be sent in', () => {
+    const payload: FindExceptionListItemSchemaPartial & {
+      extraKey: string;
+    } = { ...getFindExceptionListItemSchemaMock(), extraKey: 'some new value' };
+    const decoded = findExceptionListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual(['invalid keys "extraKey"']);
+    expect(message.schema).toEqual({});
+  });
+});
diff --git a/x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.mock.ts b/x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.mock.ts
new file mode 100644
index 0000000000000..8080d10ca451c
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.mock.ts
@@ -0,0 +1,30 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { FILTER, NAMESPACE_TYPE } from '../../constants.mock';
+
+import {
+  FindExceptionListSchemaPartial,
+  FindExceptionListSchemaPartialDecoded,
+} from './find_exception_list_schema';
+
+export const getFindExceptionListSchemaMock = (): FindExceptionListSchemaPartial => ({
+  filter: FILTER,
+  namespace_type: NAMESPACE_TYPE,
+  page: '1',
+  per_page: '25',
+  sort_field: undefined,
+  sort_order: undefined,
+});
+
+export const getFindExceptionListSchemaDecodedMock = (): FindExceptionListSchemaPartialDecoded => ({
+  filter: FILTER,
+  namespace_type: NAMESPACE_TYPE,
+  page: 1,
+  per_page: 25,
+  sort_field: undefined,
+  sort_order: undefined,
+});
diff --git a/x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts b/x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts
new file mode 100644
index 0000000000000..42356066176d5
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts
@@ -0,0 +1,114 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { left } from 'fp-ts/lib/Either';
+import { pipe } from 'fp-ts/lib/pipeable';
+
+import { exactCheck, foldLeftRight, getPaths } from '../../siem_common_deps';
+
+import {
+  getFindExceptionListSchemaDecodedMock,
+  getFindExceptionListSchemaMock,
+} from './find_exception_list_schema.mock';
+import {
+  FindExceptionListSchemaPartial,
+  FindExceptionListSchemaPartialDecoded,
+  findExceptionListSchema,
+} from './find_exception_list_schema';
+
+describe('find_exception_list_schema', () => {
+  test('it should validate a typical find item request', () => {
+    const payload = getFindExceptionListSchemaMock();
+    const decoded = findExceptionListSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(getFindExceptionListSchemaDecodedMock());
+  });
+
+  test('it should validate and empty object since everything is optional and will respond only with namespace_type filled out to be "single"', () => {
+    const payload: FindExceptionListSchemaPartial = {};
+    const decoded = findExceptionListSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    const expected: FindExceptionListSchemaPartialDecoded = {
+      namespace_type: 'single',
+    };
+    expect(message.schema).toEqual(expected);
+  });
+
+  test('it should validate with page missing', () => {
+    const payload = getFindExceptionListSchemaMock();
+    delete payload.page;
+    const decoded = findExceptionListSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    const expected = getFindExceptionListSchemaDecodedMock();
+    delete expected.page;
+    expect(message.schema).toEqual(expected);
+  });
+
+  test('it should validate with pre_page missing', () => {
+    const payload = getFindExceptionListSchemaMock();
+    delete payload.per_page;
+    const decoded = findExceptionListSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    const expected = getFindExceptionListSchemaDecodedMock();
+    delete expected.per_page;
+    expect(message.schema).toEqual(expected);
+  });
+
+  test('it should validate with filter missing', () => {
+    const payload = getFindExceptionListSchemaMock();
+    delete payload.filter;
+    const decoded = findExceptionListSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    const expected = getFindExceptionListSchemaDecodedMock();
+    delete expected.filter;
+    expect(message.schema).toEqual(expected);
+  });
+
+  test('it should validate with sort_field missing', () => {
+    const payload = getFindExceptionListSchemaMock();
+    delete payload.sort_field;
+    const decoded = findExceptionListSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    const expected = getFindExceptionListSchemaDecodedMock();
+    delete expected.sort_field;
+    expect(message.schema).toEqual(expected);
+  });
+
+  test('it should validate with sort_order missing', () => {
+    const payload = getFindExceptionListSchemaMock();
+    delete payload.sort_order;
+    const decoded = findExceptionListSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    const expected = getFindExceptionListSchemaDecodedMock();
+    delete expected.sort_order;
+    expect(message.schema).toEqual(expected);
+  });
+
+  test('it should not allow an extra key to be sent in', () => {
+    const payload: FindExceptionListSchemaPartial & {
+      extraKey: string;
+    } = { ...getFindExceptionListSchemaMock(), extraKey: 'some new value' };
+    const decoded = findExceptionListSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual(['invalid keys "extraKey"']);
+    expect(message.schema).toEqual({});
+  });
+});
diff --git a/x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.ts b/x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.ts
index 8b9b08ed387b1..4fa9d2e42c5d1 100644
--- a/x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.ts
+++ b/x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.ts
@@ -24,11 +24,11 @@ export const findExceptionListSchema = t.exact(
   })
 );
 
-export type FindExceptionListSchemaPartial = t.TypeOf<typeof findExceptionListSchema>;
+export type FindExceptionListSchemaPartial = t.OutputOf<typeof findExceptionListSchema>;
 
 // This type is used after a decode since some things are defaults after a decode.
 export type FindExceptionListSchemaPartialDecoded = Omit<
-  FindExceptionListSchemaPartial,
+  t.TypeOf<typeof findExceptionListSchema>,
   'namespace_type'
 > & {
   namespace_type: NamespaceType;
diff --git a/x-pack/plugins/lists/common/schemas/request/find_list_item_schema.mock.ts b/x-pack/plugins/lists/common/schemas/request/find_list_item_schema.mock.ts
new file mode 100644
index 0000000000000..a1e91f6acd264
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/request/find_list_item_schema.mock.ts
@@ -0,0 +1,32 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { CURSOR, FILTER, LIST_ID } from '../../constants.mock';
+
+import {
+  FindListItemSchemaPartial,
+  FindListItemSchemaPartialDecoded,
+} from './find_list_item_schema';
+
+export const getFindListItemSchemaMock = (): FindListItemSchemaPartial => ({
+  cursor: CURSOR,
+  filter: FILTER,
+  list_id: LIST_ID,
+  page: '1',
+  per_page: '25',
+  sort_field: undefined,
+  sort_order: undefined,
+});
+
+export const getFindListItemSchemaDecodedMock = (): FindListItemSchemaPartialDecoded => ({
+  cursor: CURSOR,
+  filter: FILTER,
+  list_id: LIST_ID,
+  page: 1,
+  per_page: 25,
+  sort_field: undefined,
+  sort_order: undefined,
+});
diff --git a/x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts b/x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts
new file mode 100644
index 0000000000000..42803fffc53c2
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts
@@ -0,0 +1,109 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { left } from 'fp-ts/lib/Either';
+import { pipe } from 'fp-ts/lib/pipeable';
+
+import { exactCheck, foldLeftRight, getPaths } from '../../siem_common_deps';
+import { LIST_ID } from '../../constants.mock';
+
+import {
+  getFindListItemSchemaDecodedMock,
+  getFindListItemSchemaMock,
+} from './find_list_item_schema.mock';
+import {
+  FindListItemSchemaPartial,
+  FindListItemSchemaPartialDecoded,
+  findListItemSchema,
+} from './find_list_item_schema';
+
+describe('find_list_item_schema', () => {
+  test('it should validate a typical find item request', () => {
+    const payload = getFindListItemSchemaMock();
+    const decoded = findListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(getFindListItemSchemaDecodedMock());
+  });
+
+  test('it should validate just a list_id where it decodes into an array for list_id and adds a namespace_type of "single"', () => {
+    const payload: FindListItemSchemaPartial = { list_id: LIST_ID };
+    const decoded = findListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    const expected: FindListItemSchemaPartialDecoded = {
+      cursor: undefined,
+      filter: undefined,
+      list_id: LIST_ID,
+      page: undefined,
+      per_page: undefined,
+      sort_field: undefined,
+      sort_order: undefined,
+    };
+    expect(message.schema).toEqual(expected);
+  });
+
+  test('it should validate with page missing', () => {
+    const payload = getFindListItemSchemaMock();
+    delete payload.page;
+    const decoded = findListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    const expected = getFindListItemSchemaDecodedMock();
+    delete expected.page;
+    expect(message.schema).toEqual(expected);
+  });
+
+  test('it should validate with pre_page missing', () => {
+    const payload = getFindListItemSchemaMock();
+    delete payload.per_page;
+    const decoded = findListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    const expected = getFindListItemSchemaDecodedMock();
+    delete expected.per_page;
+    expect(message.schema).toEqual(expected);
+  });
+
+  test('it should validate with sort_field missing', () => {
+    const payload = getFindListItemSchemaMock();
+    delete payload.sort_field;
+    const decoded = findListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    const expected = getFindListItemSchemaDecodedMock();
+    delete expected.sort_field;
+    expect(message.schema).toEqual(expected);
+  });
+
+  test('it should validate with sort_order missing', () => {
+    const payload = getFindListItemSchemaMock();
+    delete payload.sort_order;
+    const decoded = findListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    const expected = getFindListItemSchemaDecodedMock();
+    delete expected.sort_order;
+    expect(message.schema).toEqual(expected);
+  });
+
+  test('it should not allow an extra key to be sent in', () => {
+    const payload: FindListItemSchemaPartial & {
+      extraKey: string;
+    } = { ...getFindListItemSchemaMock(), extraKey: 'some new value' };
+    const decoded = findListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual(['invalid keys "extraKey"']);
+    expect(message.schema).toEqual({});
+  });
+});
diff --git a/x-pack/plugins/lists/common/schemas/request/find_list_item_schema.ts b/x-pack/plugins/lists/common/schemas/request/find_list_item_schema.ts
index c9ece4224c4ce..bbd3c7b5ec642 100644
--- a/x-pack/plugins/lists/common/schemas/request/find_list_item_schema.ts
+++ b/x-pack/plugins/lists/common/schemas/request/find_list_item_schema.ts
@@ -26,6 +26,9 @@ export const findListItemSchema = t.intersection([
   ),
 ]);
 
-export type FindListItemSchemaPartial = Identity<t.TypeOf<typeof findListItemSchema>>;
+export type FindListItemSchemaPartial = Identity<t.OutputOf<typeof findListItemSchema>>;
 
-export type FindListItemSchema = RequiredKeepUndefined<t.TypeOf<typeof findListItemSchema>>;
+// This type is used after a decode since some things are defaults after a decode.
+export type FindListItemSchemaPartialDecoded = RequiredKeepUndefined<
+  t.TypeOf<typeof findListItemSchema>
+>;
diff --git a/x-pack/plugins/lists/common/schemas/request/find_list_schema.mock.ts b/x-pack/plugins/lists/common/schemas/request/find_list_schema.mock.ts
new file mode 100644
index 0000000000000..dcb18dac8cfb6
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/request/find_list_schema.mock.ts
@@ -0,0 +1,25 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { FILTER } from '../../constants.mock';
+
+import { FindListSchema, FindListSchemaEncoded } from './find_list_schema';
+
+export const getFindListSchemaMock = (): FindListSchemaEncoded => ({
+  filter: FILTER,
+  page: '1',
+  per_page: '25',
+  sort_field: undefined,
+  sort_order: undefined,
+});
+
+export const getFindListSchemaDecodedMock = (): FindListSchema => ({
+  filter: FILTER,
+  page: 1,
+  per_page: 25,
+  sort_field: undefined,
+  sort_order: undefined,
+});
diff --git a/x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts b/x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts
new file mode 100644
index 0000000000000..a343fb4b08bfc
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts
@@ -0,0 +1,105 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { left } from 'fp-ts/lib/Either';
+import { pipe } from 'fp-ts/lib/pipeable';
+
+import { exactCheck, foldLeftRight, getPaths } from '../../siem_common_deps';
+
+import { getFindListSchemaDecodedMock, getFindListSchemaMock } from './find_list_schema.mock';
+import { FindListSchema, FindListSchemaEncoded, findListSchema } from './find_list_schema';
+
+describe('find_list_schema', () => {
+  test('it should validate a typical find item request', () => {
+    const payload = getFindListSchemaMock();
+    const decoded = findListSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(getFindListSchemaDecodedMock());
+  });
+
+  test('it should validate and empty object since everything is optional and will respond with an empty object', () => {
+    const payload: FindListSchemaEncoded = {};
+    const decoded = findListSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    const expected: FindListSchema = {};
+    expect(message.schema).toEqual(expected);
+  });
+
+  test('it should validate with page missing', () => {
+    const payload = getFindListSchemaMock();
+    delete payload.page;
+    const decoded = findListSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    const expected = getFindListSchemaDecodedMock();
+    delete expected.page;
+    expect(message.schema).toEqual(expected);
+  });
+
+  test('it should validate with pre_page missing', () => {
+    const payload = getFindListSchemaMock();
+    delete payload.per_page;
+    const decoded = findListSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    const expected = getFindListSchemaDecodedMock();
+    delete expected.per_page;
+    expect(message.schema).toEqual(expected);
+  });
+
+  test('it should validate with filter missing', () => {
+    const payload = getFindListSchemaMock();
+    delete payload.filter;
+    const decoded = findListSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    const expected = getFindListSchemaDecodedMock();
+    delete expected.filter;
+    expect(message.schema).toEqual(expected);
+  });
+
+  test('it should validate with sort_field missing', () => {
+    const payload = getFindListSchemaMock();
+    delete payload.sort_field;
+    const decoded = findListSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    const expected = getFindListSchemaDecodedMock();
+    delete expected.sort_field;
+    expect(message.schema).toEqual(expected);
+  });
+
+  test('it should validate with sort_order missing', () => {
+    const payload = getFindListSchemaMock();
+    delete payload.sort_order;
+    const decoded = findListSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    const expected = getFindListSchemaDecodedMock();
+    delete expected.sort_order;
+    expect(message.schema).toEqual(expected);
+  });
+
+  test('it should not allow an extra key to be sent in', () => {
+    const payload: FindListSchemaEncoded & {
+      extraKey: string;
+    } = { ...getFindListSchemaMock(), extraKey: 'some new value' };
+    const decoded = findListSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual(['invalid keys "extraKey"']);
+    expect(message.schema).toEqual({});
+  });
+});
diff --git a/x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.mock.ts b/x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.mock.ts
new file mode 100644
index 0000000000000..82baee2bf848f
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.mock.ts
@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { ID, ITEM_ID } from '../../constants.mock';
+
+import { ReadEndpointListItemSchema } from './read_endpoint_list_item_schema';
+
+export const getReadEndpointListItemSchemaMock = (): ReadEndpointListItemSchema => ({
+  id: ID,
+  item_id: ITEM_ID,
+});
diff --git a/x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts b/x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts
new file mode 100644
index 0000000000000..70a1d783c87d6
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts
@@ -0,0 +1,87 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { left } from 'fp-ts/lib/Either';
+import { pipe } from 'fp-ts/lib/pipeable';
+
+import { exactCheck, foldLeftRight, getPaths } from '../../siem_common_deps';
+
+import { getReadEndpointListItemSchemaMock } from './read_endpoint_list_item_schema.mock';
+import {
+  ReadEndpointListItemSchema,
+  readEndpointListItemSchema,
+} from './read_endpoint_list_item_schema';
+
+describe('read_endpoint_list_item_schema', () => {
+  test('it should validate a typical list request', () => {
+    const payload = getReadEndpointListItemSchemaMock();
+    const decoded = readEndpointListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should accept an undefined for "id"', () => {
+    const payload = getReadEndpointListItemSchemaMock();
+    delete payload.id;
+    const decoded = readEndpointListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should accept an undefined for "item_id"', () => {
+    const payload = getReadEndpointListItemSchemaMock();
+    delete payload.item_id;
+    const decoded = readEndpointListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should NOT accept "namespace_type" since endpoint list items do not need it', () => {
+    const payload: ReadEndpointListItemSchema & {
+      namespace_type: string;
+    } = { ...getReadEndpointListItemSchemaMock(), namespace_type: 'single' };
+    delete payload.namespace_type;
+    const decoded = readEndpointListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(getReadEndpointListItemSchemaMock());
+  });
+
+  test('it should accept an undefined for "id", "item_id"', () => {
+    const payload = getReadEndpointListItemSchemaMock();
+    delete payload.id;
+    delete payload.item_id;
+    const decoded = readEndpointListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should not allow an extra key to be sent in', () => {
+    const payload: ReadEndpointListItemSchema & {
+      extraKey?: string;
+    } = getReadEndpointListItemSchemaMock();
+    payload.extraKey = 'some new value';
+    const decoded = readEndpointListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual(['invalid keys "extraKey"']);
+    expect(message.schema).toEqual({});
+  });
+});
diff --git a/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.mock.ts b/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.mock.ts
new file mode 100644
index 0000000000000..30bbbe2d22ea4
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.mock.ts
@@ -0,0 +1,33 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import {
+  COMMENTS,
+  DESCRIPTION,
+  ENTRIES,
+  ID,
+  ITEM_TYPE,
+  LIST_ITEM_ID,
+  META,
+  NAME,
+  TAGS,
+  _TAGS,
+} from '../../constants.mock';
+
+import { UpdateEndpointListItemSchema } from './update_endpoint_list_item_schema';
+
+export const getUpdateEndpointListItemSchemaMock = (): UpdateEndpointListItemSchema => ({
+  _tags: _TAGS,
+  comments: COMMENTS,
+  description: DESCRIPTION,
+  entries: ENTRIES,
+  id: ID,
+  item_id: LIST_ITEM_ID,
+  meta: META,
+  name: NAME,
+  tags: TAGS,
+  type: ITEM_TYPE,
+});
diff --git a/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts b/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts
new file mode 100644
index 0000000000000..838cb81d84c1d
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts
@@ -0,0 +1,147 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { left } from 'fp-ts/lib/Either';
+import { pipe } from 'fp-ts/lib/pipeable';
+
+import { exactCheck, foldLeftRight, getPaths } from '../../siem_common_deps';
+
+import {
+  UpdateEndpointListItemSchema,
+  updateEndpointListItemSchema,
+} from './update_endpoint_list_item_schema';
+import { getUpdateEndpointListItemSchemaMock } from './update_endpoint_list_item_schema.mock';
+
+describe('update_endpoint_list_item_schema', () => {
+  test('it should validate a typical list item request', () => {
+    const payload = getUpdateEndpointListItemSchemaMock();
+    const decoded = updateEndpointListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should not accept an undefined for "description"', () => {
+    const payload = getUpdateEndpointListItemSchemaMock();
+    delete payload.description;
+    const decoded = updateEndpointListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "undefined" supplied to "description"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should not accept an undefined for "name"', () => {
+    const payload = getUpdateEndpointListItemSchemaMock();
+    delete payload.name;
+    const decoded = updateEndpointListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "undefined" supplied to "name"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should not accept an undefined for "type"', () => {
+    const payload = getUpdateEndpointListItemSchemaMock();
+    delete payload.type;
+    const decoded = updateEndpointListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "undefined" supplied to "type"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should not accept a value for "list_id"', () => {
+    const payload: UpdateEndpointListItemSchema & {
+      list_id?: string;
+    } = getUpdateEndpointListItemSchemaMock();
+    payload.list_id = 'some new list_id';
+    const decoded = updateEndpointListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual(['invalid keys "list_id"']);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should accept an undefined for "meta" but strip it out', () => {
+    const payload = getUpdateEndpointListItemSchemaMock();
+    const outputPayload = getUpdateEndpointListItemSchemaMock();
+    delete payload.meta;
+    const decoded = updateEndpointListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    delete outputPayload.meta;
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(outputPayload);
+  });
+
+  test('it should accept an undefined for "comments" but return an array', () => {
+    const inputPayload = getUpdateEndpointListItemSchemaMock();
+    const outputPayload = getUpdateEndpointListItemSchemaMock();
+    delete inputPayload.comments;
+    outputPayload.comments = [];
+    const decoded = updateEndpointListItemSchema.decode(inputPayload);
+    const checked = exactCheck(inputPayload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(outputPayload);
+  });
+
+  test('it should accept an undefined for "entries" but return an array', () => {
+    const inputPayload = getUpdateEndpointListItemSchemaMock();
+    const outputPayload = getUpdateEndpointListItemSchemaMock();
+    delete inputPayload.entries;
+    outputPayload.entries = [];
+    const decoded = updateEndpointListItemSchema.decode(inputPayload);
+    const checked = exactCheck(inputPayload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(outputPayload);
+  });
+
+  test('it should accept an undefined for "tags" but return an array', () => {
+    const inputPayload = getUpdateEndpointListItemSchemaMock();
+    const outputPayload = getUpdateEndpointListItemSchemaMock();
+    delete inputPayload.tags;
+    outputPayload.tags = [];
+    const decoded = updateEndpointListItemSchema.decode(inputPayload);
+    const checked = exactCheck(inputPayload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(outputPayload);
+  });
+
+  test('it should accept an undefined for "_tags" but return an array', () => {
+    const inputPayload = getUpdateEndpointListItemSchemaMock();
+    const outputPayload = getUpdateEndpointListItemSchemaMock();
+    delete inputPayload._tags;
+    outputPayload._tags = [];
+    const decoded = updateEndpointListItemSchema.decode(inputPayload);
+    const checked = exactCheck(inputPayload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(outputPayload);
+  });
+
+  test('it should not allow an extra key to be sent in', () => {
+    const payload: UpdateEndpointListItemSchema & {
+      extraKey?: string;
+    } = getUpdateEndpointListItemSchemaMock();
+    payload.extraKey = 'some new value';
+    const decoded = updateEndpointListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual(['invalid keys "extraKey"']);
+    expect(message.schema).toEqual({});
+  });
+});
diff --git a/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts b/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts
index 69702a5e8a4f9..2592e44888ff6 100644
--- a/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts
+++ b/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts
@@ -145,20 +145,6 @@ describe('update_exception_list_item_schema', () => {
     expect(message.schema).toEqual(outputPayload);
   });
 
-  // TODO: Is it expected behavior for it not to auto-generate a uui or throw
-  // error if item_id is not passed in?
-  test.skip('it should accept an undefined for "item_id" and auto generate a uuid', () => {
-    const inputPayload = getUpdateExceptionListItemSchemaMock();
-    delete inputPayload.item_id;
-    const decoded = updateExceptionListItemSchema.decode(inputPayload);
-    const checked = exactCheck(inputPayload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([]);
-    expect((message.schema as UpdateExceptionListItemSchema).item_id).toMatch(
-      /^[0-9a-f]{8}-[0-9a-f]{4}-[0-5][0-9a-f]{3}-[089ab][0-9a-f]{3}-[0-9a-f]{12}$/i
-    );
-  });
-
   test('it should accept an undefined for "item_id" and generate a correct body not counting the uuid', () => {
     const inputPayload = getUpdateExceptionListItemSchemaMock();
     delete inputPayload.item_id;
diff --git a/x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts b/x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts
index 71cb9786b8185..892f277045a69 100644
--- a/x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts
+++ b/x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts
@@ -109,20 +109,6 @@ describe('update_exception_list_schema', () => {
     expect(message.schema).toEqual(outputPayload);
   });
 
-  // TODO: Is it expected behavior for it not to auto-generate a uui or throw
-  // error if list_id is not passed in?
-  test.skip('it should accept an undefined for "list_id" and auto generate a uuid', () => {
-    const inputPayload = getUpdateExceptionListSchemaMock();
-    delete inputPayload.list_id;
-    const decoded = updateExceptionListSchema.decode(inputPayload);
-    const checked = exactCheck(inputPayload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([]);
-    expect((message.schema as UpdateExceptionListSchema).list_id).toMatch(
-      /^[0-9a-f]{8}-[0-9a-f]{4}-[0-5][0-9a-f]{3}-[089ab][0-9a-f]{3}-[0-9a-f]{12}$/i
-    );
-  });
-
   test('it should accept an undefined for "list_id" and generate a correct body not counting the uuid', () => {
     const inputPayload = getUpdateExceptionListSchemaMock();
     delete inputPayload.list_id;
diff --git a/x-pack/plugins/lists/common/schemas/request/update_list_item_schema.mock.ts b/x-pack/plugins/lists/common/schemas/request/update_list_item_schema.mock.ts
new file mode 100644
index 0000000000000..c95de1e99b4f0
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/request/update_list_item_schema.mock.ts
@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { ID, META, VALUE } from '../../constants.mock';
+
+import { UpdateListItemSchema } from './update_list_item_schema';
+
+export const getUpdateListItemSchemaMock = (): UpdateListItemSchema => ({
+  id: ID,
+  meta: META,
+  value: VALUE,
+});
diff --git a/x-pack/plugins/lists/common/schemas/request/update_list_item_schema.test.ts b/x-pack/plugins/lists/common/schemas/request/update_list_item_schema.test.ts
new file mode 100644
index 0000000000000..6127e20343834
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/request/update_list_item_schema.test.ts
@@ -0,0 +1,48 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { left } from 'fp-ts/lib/Either';
+import { pipe } from 'fp-ts/lib/pipeable';
+
+import { exactCheck, foldLeftRight, getPaths } from '../../siem_common_deps';
+
+import { UpdateListItemSchema, updateListItemSchema } from './update_list_item_schema';
+import { getUpdateListItemSchemaMock } from './update_list_item_schema.mock';
+
+describe('update_list_item_schema', () => {
+  test('it should validate a typical list item request', () => {
+    const payload = getUpdateListItemSchemaMock();
+    const decoded = updateListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should accept an undefined for "meta" but strip it out', () => {
+    const payload = getUpdateListItemSchemaMock();
+    const outputPayload = getUpdateListItemSchemaMock();
+    delete payload.meta;
+    const decoded = updateListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    delete outputPayload.meta;
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(outputPayload);
+  });
+
+  test('it should not allow an extra key to be sent in', () => {
+    const payload: UpdateListItemSchema & {
+      extraKey?: string;
+    } = getUpdateListItemSchemaMock();
+    payload.extraKey = 'some new value';
+    const decoded = updateListItemSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    expect(getPaths(left(message.errors))).toEqual(['invalid keys "extraKey"']);
+    expect(message.schema).toEqual({});
+  });
+});
diff --git a/x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts b/x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts
index 1f51140005e59..d346ea72ca310 100644
--- a/x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts
+++ b/x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts
@@ -24,7 +24,7 @@ describe('create_endpoint_list_schema', () => {
   });
 
   test('it should accept an empty object when an endpoint list already exists', () => {
-    const payload = {};
+    const payload: CreateEndpointListSchema = {};
     const decoded = createEndpointListSchema.decode(payload);
     const checked = exactCheck(payload, decoded);
     const message = pipe(checked, foldLeftRight);
@@ -33,6 +33,19 @@ describe('create_endpoint_list_schema', () => {
     expect(message.schema).toEqual(payload);
   });
 
+  test('it should NOT accept an undefined for "list_id"', () => {
+    const payload = getExceptionListSchemaMock();
+    delete payload.list_id;
+    const decoded = createEndpointListSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'invalid keys "_tags,["endpoint","process","malware","os:linux"],created_at,created_by,description,id,meta,{},name,namespace_type,tags,["user added string for a tag","malware"],tie_breaker_id,type,updated_at,updated_by"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
   test('it should NOT allow missing fields', () => {
     const payload = getExceptionListSchemaMock();
     delete payload.list_id;
diff --git a/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.mock.ts b/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.mock.ts
index f7a6af98c8f0e..9e1a88ceb28bd 100644
--- a/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.mock.ts
+++ b/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.mock.ts
@@ -16,7 +16,7 @@ export const getExceptionListItemSchemaMock = (): ExceptionListItemSchema => ({
   entries: ENTRIES,
   id: '1',
   item_id: 'endpoint_list_item',
-  list_id: 'endpoint_list',
+  list_id: 'endpoint_list_id',
   meta: {},
   name: 'Sample Endpoint Exception List',
   namespace_type: 'single',
diff --git a/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts b/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts
index ff900104251b7..c8bf73cf842e1 100644
--- a/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts
+++ b/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts
@@ -99,19 +99,15 @@ describe('exception_list_item_schema', () => {
     expect(message.schema).toEqual({});
   });
 
-  // TODO: Should this throw an error? "namespace_type" gets auto-populated
-  // with default "single", is that desired behavior?
-  test.skip('it should NOT accept an undefined for "namespace_type"', () => {
+  test('it should accept an undefined for "namespace_type" and return "single" as a default value for "namespace_type"', () => {
     const payload = getExceptionListItemSchemaMock();
     delete payload.namespace_type;
     const decoded = exceptionListItemSchema.decode(payload);
     const checked = exactCheck(payload, decoded);
     const message = pipe(checked, foldLeftRight);
 
-    expect(getPaths(left(message.errors))).toEqual([
-      'Invalid value "undefined" supplied to "namespace_type"',
-    ]);
-    expect(message.schema).toEqual({});
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect((message.schema as ExceptionListItemSchema).namespace_type).toEqual('single');
   });
 
   test('it should NOT accept an undefined for "description"', () => {
diff --git a/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.ts b/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.ts
index 0de8fd72900af..c8440e9d3f3d0 100644
--- a/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.ts
+++ b/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.ts
@@ -27,7 +27,6 @@ import {
 } from '../common/schemas';
 import { commentsArray, entriesArray } from '../types';
 
-// TODO: Should we use a partial here to reflect that this can JSON serialize meta, comment as non existent?
 export const exceptionListItemSchema = t.exact(
   t.type({
     _tags,
diff --git a/x-pack/plugins/lists/common/schemas/response/exception_list_schema.mock.ts b/x-pack/plugins/lists/common/schemas/response/exception_list_schema.mock.ts
index 017b959a2baf3..906dcf6560ee5 100644
--- a/x-pack/plugins/lists/common/schemas/response/exception_list_schema.mock.ts
+++ b/x-pack/plugins/lists/common/schemas/response/exception_list_schema.mock.ts
@@ -4,6 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { ENDPOINT_LIST_ID } from '../..';
+
 import { ExceptionListSchema } from './exception_list_schema';
 
 export const getExceptionListSchemaMock = (): ExceptionListSchema => ({
@@ -12,10 +14,10 @@ export const getExceptionListSchemaMock = (): ExceptionListSchema => ({
   created_by: 'user_name',
   description: 'This is a sample endpoint type exception',
   id: '1',
-  list_id: 'endpoint_list',
+  list_id: ENDPOINT_LIST_ID,
   meta: {},
   name: 'Sample Endpoint Exception List',
-  namespace_type: 'single',
+  namespace_type: 'agnostic',
   tags: ['user added string for a tag', 'malware'],
   tie_breaker_id: '77fd1909-6786-428a-a671-30229a719c1f',
   type: 'endpoint',
diff --git a/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts b/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts
index 99b3b778388ea..b773dd498ed01 100644
--- a/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts
+++ b/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts
@@ -60,19 +60,15 @@ describe('exception_list_schema', () => {
     expect(message.schema).toEqual({});
   });
 
-  // TODO: Should this throw an error? "namespace_type" gets auto-populated
-  // with default "single", is that desired behavior?
-  test.skip('it should NOT accept an undefined for "namespace_type"', () => {
+  test('it should accept an undefined for "namespace_type" and make "namespace_type" that of "single"', () => {
     const payload = getExceptionListSchemaMock();
     delete payload.namespace_type;
     const decoded = exceptionListSchema.decode(payload);
     const checked = exactCheck(payload, decoded);
     const message = pipe(checked, foldLeftRight);
 
-    expect(getPaths(left(message.errors))).toEqual([
-      'Invalid value "undefined" supplied to "namespace_type"',
-    ]);
-    expect(message.schema).toEqual({});
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect((message.schema as ExceptionListSchema).namespace_type).toEqual('single');
   });
 
   test('it should NOT accept an undefined for "description"', () => {
diff --git a/x-pack/plugins/lists/common/schemas/response/exception_list_schema.ts b/x-pack/plugins/lists/common/schemas/response/exception_list_schema.ts
index 120ed31f87d0d..0fb2bfca4a48f 100644
--- a/x-pack/plugins/lists/common/schemas/response/exception_list_schema.ts
+++ b/x-pack/plugins/lists/common/schemas/response/exception_list_schema.ts
@@ -25,7 +25,6 @@ import {
   updated_by,
 } from '../common/schemas';
 
-// TODO: Should we use a partial here to reflect that this can JSON serialize meta as non existent?
 export const exceptionListSchema = t.exact(
   t.type({
     _tags,
diff --git a/x-pack/plugins/lists/public/exceptions/api.test.ts b/x-pack/plugins/lists/public/exceptions/api.test.ts
index 1414d828fa6d4..455670098307f 100644
--- a/x-pack/plugins/lists/public/exceptions/api.test.ts
+++ b/x-pack/plugins/lists/public/exceptions/api.test.ts
@@ -508,7 +508,7 @@ describe('Exceptions Lists API', () => {
     test('it returns expected format when call succeeds', async () => {
       const exceptionResponse = await fetchExceptionListItemsByListId({
         http: mockKibanaHttpService(),
-        listId: 'endpoint_list',
+        listId: 'endpoint_list_id',
         namespaceType: 'single',
         pagination: {
           page: 1,
diff --git a/x-pack/plugins/lists/server/routes/create_endpoint_list_route.ts b/x-pack/plugins/lists/server/routes/create_endpoint_list_route.ts
index 5d0f3599729b3..cac69ce65623f 100644
--- a/x-pack/plugins/lists/server/routes/create_endpoint_list_route.ts
+++ b/x-pack/plugins/lists/server/routes/create_endpoint_list_route.ts
@@ -5,12 +5,11 @@
  */
 
 import { IRouter } from 'kibana/server';
-import * as t from 'io-ts';
 
 import { ENDPOINT_LIST_URL } from '../../common/constants';
 import { buildSiemResponse, transformError } from '../siem_server_deps';
 import { validate } from '../../common/siem_common_deps';
-import { exceptionListSchema } from '../../common/schemas';
+import { createEndpointListSchema } from '../../common/schemas';
 
 import { getExceptionListClient } from './utils/get_exception_list_client';
 
@@ -35,21 +34,19 @@ export const createEndpointListRoute = (router: IRouter): void => {
     async (context, _, response) => {
       const siemResponse = buildSiemResponse(response);
       try {
-        // Our goal is be fast as possible and block the least amount of
         const exceptionLists = getExceptionListClient(context);
         const createdList = await exceptionLists.createEndpointList();
-        if (createdList != null) {
-          const [validated, errors] = validate(createdList, t.union([exceptionListSchema, t.null]));
-          if (errors != null) {
-            return siemResponse.error({ body: errors, statusCode: 500 });
-          } else {
-            return response.ok({ body: validated ?? {} });
-          }
+        // We always return ok on a create  endpoint list route but with an empty body as
+        // an additional fetch of the full list would be slower and the UI has everything hard coded
+        // within it to get the list if it needs details about it. Our goal is to be as fast as possible
+        // and block the least amount of time with this route since it could end up in various parts of the
+        // stack at some point such as repeatedly being called by endpoint agents.
+        const body = createdList ?? {};
+        const [validated, errors] = validate(body, createEndpointListSchema);
+        if (errors != null) {
+          return siemResponse.error({ body: errors, statusCode: 500 });
         } else {
-          // We always return ok on a create  endpoint list route but with an empty body as
-          // an additional fetch of the full list would be slower and the UI has everything hard coded
-          // within it to get the  list if it needs details about it.
-          return response.ok({ body: {} });
+          return response.ok({ body: validated ?? {} });
         }
       } catch (err) {
         const error = transformError(err);
diff --git a/x-pack/plugins/lists/server/routes/export_list_item_route.ts b/x-pack/plugins/lists/server/routes/export_list_item_route.ts
index 8b50f4666085a..8148c9b1ed824 100644
--- a/x-pack/plugins/lists/server/routes/export_list_item_route.ts
+++ b/x-pack/plugins/lists/server/routes/export_list_item_route.ts
@@ -23,7 +23,6 @@ export const exportListItemRoute = (router: IRouter): void => {
       path: `${LIST_ITEM_URL}/_export`,
       validate: {
         query: buildRouteValidation(exportListItemQuerySchema),
-        // TODO: Do we want to add a body here like export_rules_route and allow a size limit?
       },
     },
     async (context, request, response) => {
diff --git a/x-pack/plugins/lists/server/routes/find_list_item_route.ts b/x-pack/plugins/lists/server/routes/find_list_item_route.ts
index 1ccb948d0ad21..52d534b08df2b 100644
--- a/x-pack/plugins/lists/server/routes/find_list_item_route.ts
+++ b/x-pack/plugins/lists/server/routes/find_list_item_route.ts
@@ -9,7 +9,11 @@ import { IRouter } from 'kibana/server';
 import { LIST_ITEM_URL } from '../../common/constants';
 import { buildRouteValidation, buildSiemResponse, transformError } from '../siem_server_deps';
 import { validate } from '../../common/siem_common_deps';
-import { findListItemSchema, foundListItemSchema } from '../../common/schemas';
+import {
+  FindListItemSchemaPartialDecoded,
+  findListItemSchema,
+  foundListItemSchema,
+} from '../../common/schemas';
 import { decodeCursor } from '../services/utils';
 
 import { getListClient } from './utils';
@@ -22,7 +26,9 @@ export const findListItemRoute = (router: IRouter): void => {
       },
       path: `${LIST_ITEM_URL}/_find`,
       validate: {
-        query: buildRouteValidation(findListItemSchema),
+        query: buildRouteValidation<typeof findListItemSchema, FindListItemSchemaPartialDecoded>(
+          findListItemSchema
+        ),
       },
     },
     async (context, request, response) => {
diff --git a/x-pack/plugins/lists/server/routes/patch_list_item_route.ts b/x-pack/plugins/lists/server/routes/patch_list_item_route.ts
index e21a54c09a873..f706559dffdbd 100644
--- a/x-pack/plugins/lists/server/routes/patch_list_item_route.ts
+++ b/x-pack/plugins/lists/server/routes/patch_list_item_route.ts
@@ -29,7 +29,6 @@ export const patchListItemRoute = (router: IRouter): void => {
       try {
         const { value, id, meta } = request.body;
         const lists = getListClient(context);
-        // TODO: This looks like just a regular update, implement a patchListItem API and add plumbing for that.
         const listItem = await lists.updateListItem({
           id,
           meta,
diff --git a/x-pack/plugins/lists/server/routes/patch_list_route.ts b/x-pack/plugins/lists/server/routes/patch_list_route.ts
index 9443ac2ed2eea..3a0d8714a14cd 100644
--- a/x-pack/plugins/lists/server/routes/patch_list_route.ts
+++ b/x-pack/plugins/lists/server/routes/patch_list_route.ts
@@ -29,7 +29,6 @@ export const patchListRoute = (router: IRouter): void => {
       try {
         const { name, description, id, meta } = request.body;
         const lists = getListClient(context);
-        // TODO: This looks like just a regular update, implement a patchListItem API and add plumbing for that.
         const list = await lists.updateList({ description, id, meta, name });
         if (list == null) {
           return siemResponse.error({
diff --git a/x-pack/plugins/lists/server/scripts/post_x_exception_list_items.sh b/x-pack/plugins/lists/server/scripts/post_x_exception_list_items.sh
new file mode 100755
index 0000000000000..8e29e96f884a5
--- /dev/null
+++ b/x-pack/plugins/lists/server/scripts/post_x_exception_list_items.sh
@@ -0,0 +1,29 @@
+#!/bin/sh
+
+#
+# Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+# or more contributor license agreements. Licensed under the Elastic License;
+# you may not use this file except in compliance with the Elastic License.
+#
+
+set -e
+./check_env_variables.sh
+
+LIST_ID=${1:-simple_list}
+COUNT=${2:-100}
+LIST_FILE=${3:-exception_lists/new/exception_list_item.json}
+
+# You can get the first exception list_id like so:
+# ./find_exception_lists.sh | jq '.data[0].list_id'
+
+# Example useage
+# ./post_x_exception_list_items.sh
+# ./post_x_exception_list_items.sh 5886f4dd-84e5-441b-a7d7-0712f072f9d1 100
+
+cat ${LIST_FILE} | jq --arg LIST_ID "$LIST_ID" '.list_id = $LIST_ID' > $TMPDIR/file_to_post.json
+
+for i in $(seq 1 $COUNT); do
+  ITEM_ID=`cat /dev/urandom | base64 | tr -dc '0-9a-zA-Z' | head -c100`
+  cat ${LIST_FILE} | jq --arg LIST_ID "$LIST_ID" --arg ITEM_ID "$ITEM_ID" '.list_id = $LIST_ID | .item_id = $ITEM_ID' > $TMPDIR/file_to_post_${ITEM_ID}.json
+  ./post_exception_list_item.sh $TMPDIR/file_to_post_${ITEM_ID}.json &
+done
diff --git a/x-pack/plugins/lists/server/services/items/create_list_items_bulk.ts b/x-pack/plugins/lists/server/services/items/create_list_items_bulk.ts
index 91e9587aa676a..07bdb933bcc2a 100644
--- a/x-pack/plugins/lists/server/services/items/create_list_items_bulk.ts
+++ b/x-pack/plugins/lists/server/services/items/create_list_items_bulk.ts
@@ -74,7 +74,7 @@ export const createListItemsBulk = async ({
         const createBody: CreateEsBulkTypeSchema = { create: { _index: listItemIndex } };
         return [...accum, createBody, elasticBody];
       } else {
-        // TODO: Report errors with return values from the bulk insert
+        // TODO: Report errors with return values from the bulk insert into another index or saved object
         return accum;
       }
     },
diff --git a/x-pack/plugins/maps/README.md b/x-pack/plugins/maps/README.md
new file mode 100644
index 0000000000000..aae5a708b680b
--- /dev/null
+++ b/x-pack/plugins/maps/README.md
@@ -0,0 +1,13 @@
+# Maps
+
+Visualize geo data from Elasticsearch or 3rd party geo-services.
+
+
+## Testing
+
+Run all tests from the `x-pack` root directory
+
+- Unit tests: `node scripts/jest --watch maps`
+- Functional tests:
+  - Run `node scripts/functional_tests_server`
+  - Run `node ../scripts/functional_test_runner.js --config ./test/functional/config.js --grep="maps app"`
\ No newline at end of file
diff --git a/x-pack/plugins/maps/common/descriptor_types/data_request_descriptor_types.ts b/x-pack/plugins/maps/common/descriptor_types/data_request_descriptor_types.ts
index 35b33da12d384..cd7d2d5d0f461 100644
--- a/x-pack/plugins/maps/common/descriptor_types/data_request_descriptor_types.ts
+++ b/x-pack/plugins/maps/common/descriptor_types/data_request_descriptor_types.ts
@@ -18,6 +18,7 @@ export type MapFilters = {
   refreshTimerLastTriggeredAt?: string;
   timeFilters: TimeRange;
   zoom: number;
+  geogridPrecision?: number;
 };
 
 type ESSearchSourceSyncMeta = {
@@ -63,6 +64,22 @@ export type DataMeta = Partial<VectorSourceRequestMeta> &
   Partial<VectorStyleRequestMeta> &
   Partial<ESSearchSourceResponseMeta>;
 
+type NumericalStyleFieldData = {
+  avg: number;
+  max: number;
+  min: number;
+  std_deviation: number;
+};
+
+type CategoricalStyleFieldData = {
+  buckets: Array<{ key: string; doc_count: number }>;
+};
+
+export type StyleMetaData = {
+  // key is field name for field requiring style meta
+  [key: string]: NumericalStyleFieldData | CategoricalStyleFieldData;
+};
+
 export type DataRequestDescriptor = {
   dataId: string;
   dataMetaAtStart?: DataMeta | null;
diff --git a/x-pack/plugins/maps/common/descriptor_types/map_descriptor.ts b/x-pack/plugins/maps/common/descriptor_types/map_descriptor.ts
index 027cc886cd7f7..ed0656a2fc265 100644
--- a/x-pack/plugins/maps/common/descriptor_types/map_descriptor.ts
+++ b/x-pack/plugins/maps/common/descriptor_types/map_descriptor.ts
@@ -10,10 +10,10 @@ import { Query } from '../../../../../src/plugins/data/common';
 import { DRAW_TYPE, ES_GEO_FIELD_TYPE, ES_SPATIAL_RELATIONS } from '../constants';
 
 export type MapExtent = {
-  maxLat: number;
-  maxLon: number;
-  minLat: number;
   minLon: number;
+  minLat: number;
+  maxLon: number;
+  maxLat: number;
 };
 
 export type MapQuery = Query & {
diff --git a/x-pack/plugins/maps/public/classes/joins/inner_join.d.ts b/x-pack/plugins/maps/public/classes/joins/inner_join.d.ts
index 6da72fbbd8227..452a3fdc3a19f 100644
--- a/x-pack/plugins/maps/public/classes/joins/inner_join.d.ts
+++ b/x-pack/plugins/maps/public/classes/joins/inner_join.d.ts
@@ -15,4 +15,6 @@ export class InnerJoin implements IJoin {
   getRightJoinSource(): IESTermSource;
 
   toDescriptor(): JoinDescriptor;
+
+  getSourceMetaDataRequestId(): string;
 }
diff --git a/x-pack/plugins/maps/public/classes/joins/join.ts b/x-pack/plugins/maps/public/classes/joins/join.ts
index 6554f7581d99c..4a551c5bcc485 100644
--- a/x-pack/plugins/maps/public/classes/joins/join.ts
+++ b/x-pack/plugins/maps/public/classes/joins/join.ts
@@ -11,4 +11,6 @@ export interface IJoin {
   getRightJoinSource(): IESTermSource;
 
   toDescriptor(): JoinDescriptor;
+
+  getSourceMetaDataRequestId(): string;
 }
diff --git a/x-pack/plugins/maps/public/classes/layers/blended_vector_layer/blended_vector_layer.ts b/x-pack/plugins/maps/public/classes/layers/blended_vector_layer/blended_vector_layer.ts
index 5388a82e5924d..aefa2beede7d1 100644
--- a/x-pack/plugins/maps/public/classes/layers/blended_vector_layer/blended_vector_layer.ts
+++ b/x-pack/plugins/maps/public/classes/layers/blended_vector_layer/blended_vector_layer.ts
@@ -33,6 +33,7 @@ import {
   VectorStyleDescriptor,
   SizeDynamicOptions,
   DynamicStylePropertyOptions,
+  StylePropertyOptions,
   VectorLayerDescriptor,
 } from '../../../../common/descriptor_types';
 import { IStyle } from '../../styles/style';
@@ -44,7 +45,7 @@ interface CountData {
   isSyncClustered: boolean;
 }
 
-function getAggType(dynamicProperty: IDynamicStyleProperty): AGG_TYPE {
+function getAggType(dynamicProperty: IDynamicStyleProperty<DynamicStylePropertyOptions>): AGG_TYPE {
   return dynamicProperty.isOrdinal() ? AGG_TYPE.AVG : AGG_TYPE.TERMS;
 }
 
@@ -100,52 +101,57 @@ function getClusterStyleDescriptor(
       },
     },
   };
-  documentStyle.getAllStyleProperties().forEach((styleProperty: IStyleProperty) => {
-    const styleName = styleProperty.getStyleName();
-    if (
-      [VECTOR_STYLES.LABEL_TEXT, VECTOR_STYLES.ICON_SIZE].includes(styleName) &&
-      (!styleProperty.isDynamic() || !styleProperty.isComplete())
-    ) {
-      // Do not migrate static label and icon size properties to provide unique cluster styling out of the box
-      return;
-    }
+  documentStyle
+    .getAllStyleProperties()
+    .forEach((styleProperty: IStyleProperty<StylePropertyOptions>) => {
+      const styleName = styleProperty.getStyleName();
+      if (
+        [VECTOR_STYLES.LABEL_TEXT, VECTOR_STYLES.ICON_SIZE].includes(styleName) &&
+        (!styleProperty.isDynamic() || !styleProperty.isComplete())
+      ) {
+        // Do not migrate static label and icon size properties to provide unique cluster styling out of the box
+        return;
+      }
 
-    if (styleName === VECTOR_STYLES.SYMBOLIZE_AS || styleName === VECTOR_STYLES.LABEL_BORDER_SIZE) {
-      // copy none static/dynamic styles to cluster style
-      clusterStyleDescriptor.properties[styleName] = {
+      if (
+        styleName === VECTOR_STYLES.SYMBOLIZE_AS ||
+        styleName === VECTOR_STYLES.LABEL_BORDER_SIZE
+      ) {
+        // copy none static/dynamic styles to cluster style
+        clusterStyleDescriptor.properties[styleName] = {
+          // @ts-expect-error
+          options: { ...styleProperty.getOptions() },
+        };
+      } else if (styleProperty.isDynamic()) {
+        // copy dynamic styles to cluster style
+        const options = styleProperty.getOptions() as DynamicStylePropertyOptions;
+        const field =
+          options && options.field && options.field.name
+            ? {
+                ...options.field,
+                name: clusterSource.getAggKey(
+                  getAggType(styleProperty as IDynamicStyleProperty<DynamicStylePropertyOptions>),
+                  options.field.name
+                ),
+              }
+            : undefined;
         // @ts-expect-error
-        options: { ...styleProperty.getOptions() },
-      };
-    } else if (styleProperty.isDynamic()) {
-      // copy dynamic styles to cluster style
-      const options = styleProperty.getOptions() as DynamicStylePropertyOptions;
-      const field =
-        options && options.field && options.field.name
-          ? {
-              ...options.field,
-              name: clusterSource.getAggKey(
-                getAggType(styleProperty as IDynamicStyleProperty),
-                options.field.name
-              ),
-            }
-          : undefined;
-      // @ts-expect-error
-      clusterStyleDescriptor.properties[styleName] = {
-        type: STYLE_TYPE.DYNAMIC,
-        options: {
-          ...options,
-          field,
-        },
-      };
-    } else {
-      // copy static styles to cluster style
-      // @ts-expect-error
-      clusterStyleDescriptor.properties[styleName] = {
-        type: STYLE_TYPE.STATIC,
-        options: { ...styleProperty.getOptions() },
-      };
-    }
-  });
+        clusterStyleDescriptor.properties[styleName] = {
+          type: STYLE_TYPE.DYNAMIC,
+          options: {
+            ...options,
+            field,
+          },
+        };
+      } else {
+        // copy static styles to cluster style
+        // @ts-expect-error
+        clusterStyleDescriptor.properties[styleName] = {
+          type: STYLE_TYPE.STATIC,
+          options: { ...styleProperty.getOptions() },
+        };
+      }
+    });
 
   return clusterStyleDescriptor;
 }
diff --git a/x-pack/plugins/maps/public/classes/sources/es_agg_source/es_agg_source.d.ts b/x-pack/plugins/maps/public/classes/sources/es_agg_source/es_agg_source.d.ts
index a93f9121d1e62..91ed0ab52b08e 100644
--- a/x-pack/plugins/maps/public/classes/sources/es_agg_source/es_agg_source.d.ts
+++ b/x-pack/plugins/maps/public/classes/sources/es_agg_source/es_agg_source.d.ts
@@ -14,6 +14,7 @@ export interface IESAggSource extends IESSource {
   getAggKey(aggType: AGG_TYPE, fieldName: string): string;
   getAggLabel(aggType: AGG_TYPE, fieldName: string): string;
   getMetricFields(): IESAggField[];
+  hasMatchingMetricField(fieldName: string): boolean;
 }
 
 export class AbstractESAggSource extends AbstractESSource implements IESAggSource {
@@ -22,4 +23,5 @@ export class AbstractESAggSource extends AbstractESSource implements IESAggSourc
   getAggKey(aggType: AGG_TYPE, fieldName: string): string;
   getAggLabel(aggType: AGG_TYPE, fieldName: string): string;
   getMetricFields(): IESAggField[];
+  hasMatchingMetricField(fieldName: string): boolean;
 }
diff --git a/x-pack/plugins/maps/public/classes/sources/es_geo_grid_source/es_geo_grid_source.test.ts b/x-pack/plugins/maps/public/classes/sources/es_geo_grid_source/es_geo_grid_source.test.ts
index e35bb998ce7db..2707b2ac23e58 100644
--- a/x-pack/plugins/maps/public/classes/sources/es_geo_grid_source/es_geo_grid_source.test.ts
+++ b/x-pack/plugins/maps/public/classes/sources/es_geo_grid_source/es_geo_grid_source.test.ts
@@ -3,18 +3,50 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-jest.mock('../../../kibana_services', () => {});
+import { MapExtent, MapFilters } from '../../../../common/descriptor_types';
+
+jest.mock('../../../kibana_services');
 jest.mock('ui/new_platform');
 
+import {
+  getIndexPatternService,
+  getSearchService,
+  fetchSearchSourceAndRecordWithInspector,
+} from '../../../kibana_services';
 import { ESGeoGridSource } from './es_geo_grid_source';
-import { GRID_RESOLUTION, RENDER_AS, SOURCE_TYPES } from '../../../../common/constants';
+import {
+  ES_GEO_FIELD_TYPE,
+  GRID_RESOLUTION,
+  RENDER_AS,
+  SOURCE_TYPES,
+} from '../../../../common/constants';
+import { SearchSource } from '../../../../../../../src/plugins/data/public/search/search_source';
+
+export class MockSearchSource {
+  setField = jest.fn();
+}
 
 describe('ESGeoGridSource', () => {
+  const geoFieldName = 'bar';
+  const mockIndexPatternService = {
+    get() {
+      return {
+        fields: {
+          getByName() {
+            return {
+              name: geoFieldName,
+              type: ES_GEO_FIELD_TYPE.GEO_POINT,
+            };
+          },
+        },
+      };
+    },
+  };
   const geogridSource = new ESGeoGridSource(
     {
       id: 'foobar',
       indexPatternId: 'fooIp',
-      geoField: 'bar',
+      geoField: geoFieldName,
       metrics: [],
       resolution: GRID_RESOLUTION.COARSE,
       type: SOURCE_TYPES.ES_GEO_GRID,
@@ -23,6 +55,144 @@ describe('ESGeoGridSource', () => {
     {}
   );
 
+  describe('getGeoJsonWithMeta', () => {
+    let mockSearchSource: unknown;
+    beforeEach(async () => {
+      mockSearchSource = new MockSearchSource();
+      const mockSearchService = {
+        searchSource: {
+          async create() {
+            return mockSearchSource as SearchSource;
+          },
+        },
+      };
+
+      // @ts-expect-error
+      getIndexPatternService.mockReturnValue(mockIndexPatternService);
+      // @ts-expect-error
+      getSearchService.mockReturnValue(mockSearchService);
+      // @ts-expect-error
+      fetchSearchSourceAndRecordWithInspector.mockReturnValue({
+        took: 71,
+        timed_out: false,
+        _shards: {
+          total: 1,
+          successful: 1,
+          skipped: 0,
+          failed: 0,
+        },
+        hits: {
+          total: 748 + 683,
+          max_score: null,
+          hits: [],
+        },
+        aggregations: {
+          gridSplit: {
+            buckets: [
+              {
+                key: '4/4/6',
+                doc_count: 748,
+                gridCentroid: {
+                  location: {
+                    lat: 35.64189018148127,
+                    lon: -82.84314106196105,
+                  },
+                  count: 748,
+                },
+              },
+              {
+                key: '4/3/6',
+                doc_count: 683,
+                gridCentroid: {
+                  location: {
+                    lat: 35.24134021274211,
+                    lon: -98.45945192042787,
+                  },
+                  count: 683,
+                },
+              },
+            ],
+          },
+        },
+      });
+    });
+
+    const extent: MapExtent = {
+      minLon: -160,
+      minLat: -80,
+      maxLon: 160,
+      maxLat: 80,
+    };
+
+    const mapFilters: MapFilters = {
+      geogridPrecision: 4,
+      filters: [],
+      timeFilters: {
+        from: 'now',
+        to: '15m',
+        mode: 'relative',
+      },
+      // extent,
+      buffer: extent,
+      zoom: 0,
+    };
+
+    it('Should configure the SearchSource correctly', async () => {
+      const { data, meta } = await geogridSource.getGeoJsonWithMeta(
+        'foobarLayer',
+        mapFilters,
+        () => {}
+      );
+
+      expect(meta && meta.areResultsTrimmed).toEqual(false);
+      expect(data).toEqual({
+        type: 'FeatureCollection',
+        features: [
+          {
+            type: 'Feature',
+            geometry: { type: 'Point', coordinates: [-82.84314106196105, 35.64189018148127] },
+            id: '4/4/6',
+            properties: { doc_count: 748 },
+          },
+          {
+            type: 'Feature',
+            geometry: { type: 'Point', coordinates: [-98.45945192042787, 35.24134021274211] },
+            id: '4/3/6',
+            properties: { doc_count: 683 },
+          },
+        ],
+      });
+
+      function getProperty(property: string) {
+        // @ts-expect-error
+        const call = mockSearchSource.setField.mock.calls.find((c) => {
+          return c[0] === property;
+        });
+        return call[1];
+      }
+
+      expect(getProperty('size')).toEqual(0);
+      expect(getProperty('query')).toEqual(undefined);
+      expect(getProperty('filter')).toEqual([
+        {
+          geo_bounding_box: { bar: { bottom_right: [180, -82.67628], top_left: [-180, 82.67628] } },
+        },
+      ]);
+      expect(getProperty('aggs')).toEqual({
+        gridSplit: {
+          aggs: { gridCentroid: { geo_centroid: { field: geoFieldName } } },
+          geotile_grid: {
+            bounds: { bottom_right: [160, -80], top_left: [-160, 80] },
+            field: 'bar',
+            precision: 4,
+            shard_size: 65535,
+            size: 65535,
+          },
+        },
+      });
+    });
+  });
+
   describe('getGridResolution', () => {
     it('should echo gridResoltuion', () => {
       expect(geogridSource.getGridResolution()).toBe(GRID_RESOLUTION.COARSE);
diff --git a/x-pack/plugins/maps/public/classes/sources/es_source/es_source.d.ts b/x-pack/plugins/maps/public/classes/sources/es_source/es_source.d.ts
index d95ec5a64e6c3..1f2985ffcc27c 100644
--- a/x-pack/plugins/maps/public/classes/sources/es_source/es_source.d.ts
+++ b/x-pack/plugins/maps/public/classes/sources/es_source/es_source.d.ts
@@ -7,7 +7,10 @@
 import { AbstractVectorSource } from '../vector_source';
 import { IVectorSource } from '../vector_source';
 import { IndexPattern, ISearchSource } from '../../../../../../../src/plugins/data/public';
-import { VectorSourceRequestMeta } from '../../../../common/descriptor_types';
+import {
+  DynamicStylePropertyOptions,
+  VectorSourceRequestMeta,
+} from '../../../../common/descriptor_types';
 import { VectorStyle } from '../../styles/vector/vector_style';
 import { IDynamicStyleProperty } from '../../styles/vector/properties/dynamic_style_property';
 
@@ -25,7 +28,7 @@ export interface IESSource extends IVectorSource {
   loadStylePropsMeta(
     layerName: string,
     style: VectorStyle,
-    dynamicStyleProps: IDynamicStyleProperty[],
+    dynamicStyleProps: Array<IDynamicStyleProperty<DynamicStylePropertyOptions>>,
     registerCancelCallback: (requestToken: symbol, callback: () => void) => void,
     searchFilters: VectorSourceRequestMeta
   ): Promise<unknown>;
@@ -45,7 +48,7 @@ export class AbstractESSource extends AbstractVectorSource implements IESSource
   loadStylePropsMeta(
     layerName: string,
     style: VectorStyle,
-    dynamicStyleProps: IDynamicStyleProperty[],
+    dynamicStyleProps: Array<IDynamicStyleProperty<DynamicStylePropertyOptions>>,
     registerCancelCallback: (requestToken: symbol, callback: () => void) => void,
     searchFilters: VectorSourceRequestMeta
   ): Promise<unknown>;
diff --git a/x-pack/plugins/maps/public/classes/sources/kibana_tilemap_source/create_source_editor.js b/x-pack/plugins/maps/public/classes/sources/kibana_tilemap_source/create_source_editor.js
index 1cbf4c1a87de3..ee557f6244f49 100644
--- a/x-pack/plugins/maps/public/classes/sources/kibana_tilemap_source/create_source_editor.js
+++ b/x-pack/plugins/maps/public/classes/sources/kibana_tilemap_source/create_source_editor.js
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React from 'react';
+import React, { useEffect } from 'react';
 import PropTypes from 'prop-types';
 import { EuiFieldText, EuiFormRow, EuiPanel } from '@elastic/eui';
 
@@ -13,10 +13,12 @@ import { i18n } from '@kbn/i18n';
 
 export function CreateSourceEditor({ onSourceConfigChange }) {
   const tilemap = getKibanaTileMap();
-
-  if (tilemap.url) {
-    onSourceConfigChange();
-  }
+  useEffect(() => {
+    if (tilemap.url) {
+      onSourceConfigChange();
+    }
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, []);
 
   return (
     <EuiPanel>
@@ -33,7 +35,7 @@ export function CreateSourceEditor({ onSourceConfigChange }) {
               })
         }
       >
-        <EuiFieldText readOnly value={tilemap.url} />
+        <EuiFieldText readOnly value={tilemap.url ? tilemap.url : ''} />
       </EuiFormRow>
     </EuiPanel>
   );
diff --git a/x-pack/plugins/maps/public/classes/sources/mvt_single_layer_vector_source/__snapshots__/mvt_single_layer_source_settings.test.tsx.snap b/x-pack/plugins/maps/public/classes/sources/mvt_single_layer_vector_source/__snapshots__/mvt_single_layer_source_settings.test.tsx.snap
index 699173bd362fa..c82618a500a33 100644
--- a/x-pack/plugins/maps/public/classes/sources/mvt_single_layer_vector_source/__snapshots__/mvt_single_layer_source_settings.test.tsx.snap
+++ b/x-pack/plugins/maps/public/classes/sources/mvt_single_layer_vector_source/__snapshots__/mvt_single_layer_source_settings.test.tsx.snap
@@ -8,7 +8,7 @@ exports[`should not render fields-editor when there is no layername 1`] = `
     fullWidth={false}
     hasChildLabel={true}
     hasEmptyLabelSpace={false}
-    label="Tile layer"
+    label="Source layer"
     labelType="label"
   >
     <EuiFieldText
@@ -64,7 +64,7 @@ exports[`should render with fields 1`] = `
     fullWidth={false}
     hasChildLabel={true}
     hasEmptyLabelSpace={false}
-    label="Tile layer"
+    label="Source layer"
     labelType="label"
   >
     <EuiFieldText
@@ -162,7 +162,7 @@ exports[`should render without fields 1`] = `
     fullWidth={false}
     hasChildLabel={true}
     hasEmptyLabelSpace={false}
-    label="Tile layer"
+    label="Source layer"
     labelType="label"
   >
     <EuiFieldText
diff --git a/x-pack/plugins/maps/public/classes/sources/mvt_single_layer_vector_source/mvt_single_layer_source_settings.tsx b/x-pack/plugins/maps/public/classes/sources/mvt_single_layer_vector_source/mvt_single_layer_source_settings.tsx
index cd3fd97cf66a6..566d7bb09e86b 100644
--- a/x-pack/plugins/maps/public/classes/sources/mvt_single_layer_vector_source/mvt_single_layer_source_settings.tsx
+++ b/x-pack/plugins/maps/public/classes/sources/mvt_single_layer_vector_source/mvt_single_layer_source_settings.tsx
@@ -133,7 +133,7 @@ export class MVTSingleLayerSourceSettings extends Component<Props, State> {
           label={i18n.translate(
             'xpack.maps.source.MVTSingleLayerVectorSourceEditor.layerNameMessage',
             {
-              defaultMessage: 'Tile layer',
+              defaultMessage: 'Source layer',
             }
           )}
         >
diff --git a/x-pack/plugins/maps/public/classes/sources/mvt_single_layer_vector_source/mvt_single_layer_vector_source.test.tsx b/x-pack/plugins/maps/public/classes/sources/mvt_single_layer_vector_source/mvt_single_layer_vector_source.test.tsx
index bc08baad7a842..4e9e1e9cd7680 100644
--- a/x-pack/plugins/maps/public/classes/sources/mvt_single_layer_vector_source/mvt_single_layer_vector_source.test.tsx
+++ b/x-pack/plugins/maps/public/classes/sources/mvt_single_layer_vector_source/mvt_single_layer_vector_source.test.tsx
@@ -84,7 +84,7 @@ describe('getImmutableSourceProperties', () => {
     const source = new MVTSingleLayerVectorSource(descriptor);
     const properties = await source.getImmutableProperties();
     expect(properties).toEqual([
-      { label: 'Data source', value: '.pbf vector tiles' },
+      { label: 'Data source', value: 'Vector tiles' },
       { label: 'Url', value: 'https://example.com/{x}/{y}/{z}.pbf' },
     ]);
   });
diff --git a/x-pack/plugins/maps/public/classes/sources/mvt_single_layer_vector_source/mvt_single_layer_vector_source.tsx b/x-pack/plugins/maps/public/classes/sources/mvt_single_layer_vector_source/mvt_single_layer_vector_source.tsx
index ae28828dec5a8..e64d20138cfb8 100644
--- a/x-pack/plugins/maps/public/classes/sources/mvt_single_layer_vector_source/mvt_single_layer_vector_source.tsx
+++ b/x-pack/plugins/maps/public/classes/sources/mvt_single_layer_vector_source/mvt_single_layer_vector_source.tsx
@@ -32,7 +32,7 @@ import { ITooltipProperty, TooltipProperty } from '../../tooltips/tooltip_proper
 export const sourceTitle = i18n.translate(
   'xpack.maps.source.MVTSingleLayerVectorSource.sourceTitle',
   {
-    defaultMessage: '.pbf vector tiles',
+    defaultMessage: 'Vector tiles',
   }
 );
 
@@ -127,11 +127,7 @@ export class MVTSingleLayerVectorSource extends AbstractSource
     });
   }
 
-  getGeoJsonWithMeta(
-    layerName: 'string',
-    searchFilters: unknown[],
-    registerCancelCallback: (callback: () => void) => void
-  ): Promise<GeoJsonWithMeta> {
+  getGeoJsonWithMeta(): Promise<GeoJsonWithMeta> {
     // Having this method here is a consequence of ITiledSingleLayerVectorSource extending IVectorSource.
     throw new Error('Does not implement getGeoJsonWithMeta');
   }
diff --git a/x-pack/plugins/maps/public/classes/sources/vector_source/vector_source.d.ts b/x-pack/plugins/maps/public/classes/sources/vector_source/vector_source.d.ts
index 42993bf36f618..62fc5a283e5f3 100644
--- a/x-pack/plugins/maps/public/classes/sources/vector_source/vector_source.d.ts
+++ b/x-pack/plugins/maps/public/classes/sources/vector_source/vector_source.d.ts
@@ -12,8 +12,8 @@ import { IField } from '../../fields/field';
 import {
   ESSearchSourceResponseMeta,
   MapExtent,
+  MapFilters,
   MapQuery,
-  VectorSourceRequestMeta,
   VectorSourceSyncMeta,
 } from '../../../../common/descriptor_types';
 import { VECTOR_SHAPE_TYPE } from '../../../../common/constants';
@@ -42,7 +42,7 @@ export interface IVectorSource extends ISource {
   ): MapExtent | null;
   getGeoJsonWithMeta(
     layerName: 'string',
-    searchFilters: unknown[],
+    searchFilters: MapFilters,
     registerCancelCallback: (callback: () => void) => void
   ): Promise<GeoJsonWithMeta>;
 
@@ -62,8 +62,8 @@ export class AbstractVectorSource extends AbstractSource implements IVectorSourc
     registerCancelCallback: (requestToken: symbol, callback: () => void) => void
   ): MapExtent | null;
   getGeoJsonWithMeta(
-    layerName: 'string',
-    searchFilters: unknown[],
+    layerName: string,
+    searchFilters: MapFilters,
     registerCancelCallback: (callback: () => void) => void
   ): Promise<GeoJsonWithMeta>;
 
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/components/field_meta/categorical_field_meta_popover.tsx b/x-pack/plugins/maps/public/classes/styles/vector/components/field_meta/categorical_field_meta_popover.tsx
index fac002d0a877d..e49c15c68b8db 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/components/field_meta/categorical_field_meta_popover.tsx
+++ b/x-pack/plugins/maps/public/classes/styles/vector/components/field_meta/categorical_field_meta_popover.tsx
@@ -9,18 +9,17 @@ import React from 'react';
 import { EuiFormRow, EuiSwitch, EuiSwitchEvent } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FieldMetaPopover } from './field_meta_popover';
-import { IDynamicStyleProperty } from '../../properties/dynamic_style_property';
 import { FieldMetaOptions } from '../../../../../../common/descriptor_types';
 
 type Props = {
-  styleProperty: IDynamicStyleProperty;
+  fieldMetaOptions: FieldMetaOptions;
   onChange: (fieldMetaOptions: FieldMetaOptions) => void;
 };
 
 export function CategoricalFieldMetaPopover(props: Props) {
   const onIsEnabledChange = (event: EuiSwitchEvent) => {
     props.onChange({
-      ...props.styleProperty.getFieldMetaOptions(),
+      ...props.fieldMetaOptions,
       isEnabled: event.target.checked,
     });
   };
@@ -32,7 +31,7 @@ export function CategoricalFieldMetaPopover(props: Props) {
           label={i18n.translate('xpack.maps.styles.fieldMetaOptions.isEnabled.categoricalLabel', {
             defaultMessage: 'Get categories from indices',
           })}
-          checked={props.styleProperty.getFieldMetaOptions().isEnabled}
+          checked={props.fieldMetaOptions.isEnabled}
           onChange={onIsEnabledChange}
           compressed
         />
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/components/field_meta/ordinal_field_meta_popover.tsx b/x-pack/plugins/maps/public/classes/styles/vector/components/field_meta/ordinal_field_meta_popover.tsx
index 32a54a45ed4d7..9086c4df31596 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/components/field_meta/ordinal_field_meta_popover.tsx
+++ b/x-pack/plugins/maps/public/classes/styles/vector/components/field_meta/ordinal_field_meta_popover.tsx
@@ -11,7 +11,6 @@ import { EuiFormRow, EuiRange, EuiSwitch, EuiSwitchEvent } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { DEFAULT_SIGMA } from '../../vector_style_defaults';
 import { FieldMetaPopover } from './field_meta_popover';
-import { IDynamicStyleProperty } from '../../properties/dynamic_style_property';
 import { FieldMetaOptions } from '../../../../../../common/descriptor_types';
 import { VECTOR_STYLES } from '../../../../../../common/constants';
 
@@ -38,21 +37,22 @@ function getIsEnableToggleLabel(styleName: string) {
 }
 
 type Props = {
-  styleProperty: IDynamicStyleProperty;
+  fieldMetaOptions: FieldMetaOptions;
+  styleName: VECTOR_STYLES;
   onChange: (fieldMetaOptions: FieldMetaOptions) => void;
 };
 
 export function OrdinalFieldMetaPopover(props: Props) {
   const onIsEnabledChange = (event: EuiSwitchEvent) => {
     props.onChange({
-      ...props.styleProperty.getFieldMetaOptions(),
+      ...props.fieldMetaOptions,
       isEnabled: event.target.checked,
     });
   };
 
   const onSigmaChange = (event: ChangeEvent<HTMLInputElement> | MouseEvent<HTMLButtonElement>) => {
     props.onChange({
-      ...props.styleProperty.getFieldMetaOptions(),
+      ...props.fieldMetaOptions,
       sigma: parseInt(event.currentTarget.value, 10),
     });
   };
@@ -62,8 +62,8 @@ export function OrdinalFieldMetaPopover(props: Props) {
       <Fragment>
         <EuiFormRow display="columnCompressedSwitch">
           <EuiSwitch
-            label={getIsEnableToggleLabel(props.styleProperty.getStyleName())}
-            checked={props.styleProperty.getFieldMetaOptions().isEnabled}
+            label={getIsEnableToggleLabel(props.styleName)}
+            checked={props.fieldMetaOptions.isEnabled}
             onChange={onIsEnabledChange}
             compressed
           />
@@ -79,9 +79,9 @@ export function OrdinalFieldMetaPopover(props: Props) {
             min={1}
             max={5}
             step={0.25}
-            value={_.get(props.styleProperty.getFieldMetaOptions(), 'sigma', DEFAULT_SIGMA)}
+            value={_.get(props.fieldMetaOptions, 'sigma', DEFAULT_SIGMA)}
             onChange={onSigmaChange}
-            disabled={!props.styleProperty.getFieldMetaOptions().isEnabled}
+            disabled={!props.fieldMetaOptions.isEnabled}
             showTicks
             tickInterval={1}
             compressed
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/components/symbol/icon_map_select.test.tsx b/x-pack/plugins/maps/public/classes/styles/vector/components/symbol/icon_map_select.test.tsx
index 4e68baf0bd7b7..4d9579e9e4c00 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/components/symbol/icon_map_select.test.tsx
+++ b/x-pack/plugins/maps/public/classes/styles/vector/components/symbol/icon_map_select.test.tsx
@@ -29,6 +29,7 @@ import { shallow } from 'enzyme';
 import { FIELD_ORIGIN } from '../../../../../../common/constants';
 import { AbstractField } from '../../../../fields/field';
 import { IDynamicStyleProperty } from '../../properties/dynamic_style_property';
+import { IconDynamicOptions } from '../../../../../../common/descriptor_types';
 import { IconMapSelect } from './icon_map_select';
 
 class MockField extends AbstractField {}
@@ -46,7 +47,9 @@ class MockDynamicStyleProperty {
 const defaultProps = {
   iconPaletteId: 'filledShapes',
   onChange: () => {},
-  styleProperty: (new MockDynamicStyleProperty() as unknown) as IDynamicStyleProperty,
+  styleProperty: (new MockDynamicStyleProperty() as unknown) as IDynamicStyleProperty<
+    IconDynamicOptions
+  >,
   isCustomOnly: false,
 };
 
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/components/symbol/icon_map_select.tsx b/x-pack/plugins/maps/public/classes/styles/vector/components/symbol/icon_map_select.tsx
index 1dd55bbb47f78..1a908f4c014e4 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/components/symbol/icon_map_select.tsx
+++ b/x-pack/plugins/maps/public/classes/styles/vector/components/symbol/icon_map_select.tsx
@@ -12,7 +12,7 @@ import { i18n } from '@kbn/i18n';
 import { IconStops } from './icon_stops';
 // @ts-expect-error
 import { getIconPaletteOptions, PREFERRED_ICONS } from '../../symbol_utils';
-import { IconStop } from '../../../../../../common/descriptor_types';
+import { IconDynamicOptions, IconStop } from '../../../../../../common/descriptor_types';
 import { IDynamicStyleProperty } from '../../properties/dynamic_style_property';
 
 const CUSTOM_MAP_ID = 'CUSTOM_MAP_ID';
@@ -32,7 +32,7 @@ interface Props {
   customIconStops?: IconStop[];
   iconPaletteId: string | null;
   onChange: ({ customIconStops, iconPaletteId, useCustomIconMap }: StyleOptionChanges) => void;
-  styleProperty: IDynamicStyleProperty;
+  styleProperty: IDynamicStyleProperty<IconDynamicOptions>;
   useCustomIconMap?: boolean;
   isCustomOnly: boolean;
 }
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_color_property.test.js b/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_color_property.test.js
index 7992ee5b3aeaf..2183a298a2841 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_color_property.test.js
+++ b/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_color_property.test.js
@@ -187,7 +187,7 @@ test('Should pluck the categorical style-meta from fieldmeta', async () => {
     colorCategory: 'palette_0',
   });
 
-  const meta = colorStyle.pluckCategoricalStyleMetaFromFieldMetaData({
+  const meta = colorStyle._pluckCategoricalStyleMetaFromFieldMetaData({
     foobar: {
       buckets: [
         {
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_style_property.d.ts b/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_style_property.d.ts
deleted file mode 100644
index e153b6e4850f7..0000000000000
--- a/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_style_property.d.ts
+++ /dev/null
@@ -1,37 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-/* eslint-disable @typescript-eslint/consistent-type-definitions */
-
-import { IStyleProperty } from './style_property';
-import { FIELD_ORIGIN } from '../../../../../common/constants';
-import {
-  CategoryFieldMeta,
-  DynamicStylePropertyOptions,
-  FieldMetaOptions,
-  RangeFieldMeta,
-} from '../../../../../common/descriptor_types';
-import { IField } from '../../../fields/field';
-
-export interface IDynamicStyleProperty extends IStyleProperty {
-  getOptions(): DynamicStylePropertyOptions;
-  getFieldMetaOptions(): FieldMetaOptions;
-  getField(): IField | undefined;
-  getFieldName(): string;
-  getFieldOrigin(): FIELD_ORIGIN | undefined;
-  getRangeFieldMeta(): RangeFieldMeta;
-  getCategoryFieldMeta(): CategoryFieldMeta;
-  getNumberOfCategories(): number;
-  isFieldMetaEnabled(): boolean;
-  isOrdinal(): boolean;
-  supportsFieldMeta(): boolean;
-  getFieldMetaRequest(): Promise<unknown>;
-  supportsMbFeatureState(): boolean;
-  pluckOrdinalStyleMetaFromFeatures(features: unknown[]): RangeFieldMeta;
-  pluckCategoricalStyleMetaFromFeatures(features: unknown[]): CategoryFieldMeta;
-  pluckOrdinalStyleMetaFromFieldMetaData(fieldMetaData: unknown): RangeFieldMeta;
-  pluckCategoricalStyleMetaFromFieldMetaData(fieldMetaData: unknown): CategoryFieldMeta;
-  getValueSuggestions(query: string): string[];
-}
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_style_property.js b/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_style_property.tsx
similarity index 54%
rename from x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_style_property.js
rename to x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_style_property.tsx
index 15d0b3c4bf913..216fde595af32 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_style_property.js
+++ b/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_style_property.tsx
@@ -3,42 +3,87 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
+/* eslint-disable @typescript-eslint/consistent-type-definitions */
 
 import _ from 'lodash';
-import { AbstractStyleProperty } from './style_property';
+import React from 'react';
+import { Feature } from 'geojson';
+import { AbstractStyleProperty, IStyleProperty } from './style_property';
 import { DEFAULT_SIGMA } from '../vector_style_defaults';
 import {
   STYLE_TYPE,
   SOURCE_META_DATA_REQUEST_ID,
   FIELD_ORIGIN,
+  VECTOR_STYLES,
 } from '../../../../../common/constants';
-import React from 'react';
 import { OrdinalFieldMetaPopover } from '../components/field_meta/ordinal_field_meta_popover';
 import { CategoricalFieldMetaPopover } from '../components/field_meta/categorical_field_meta_popover';
+import {
+  CategoryFieldMeta,
+  FieldMetaOptions,
+  StyleMetaData,
+  RangeFieldMeta,
+} from '../../../../../common/descriptor_types';
+import { IField } from '../../../fields/field';
+import { IVectorLayer } from '../../../layers/vector_layer/vector_layer';
+import { IJoin } from '../../../joins/join';
+
+export interface IDynamicStyleProperty<T> extends IStyleProperty<T> {
+  getFieldMetaOptions(): FieldMetaOptions;
+  getField(): IField | null;
+  getFieldName(): string;
+  getFieldOrigin(): FIELD_ORIGIN | null;
+  getRangeFieldMeta(): RangeFieldMeta | null;
+  getCategoryFieldMeta(): CategoryFieldMeta | null;
+  getNumberOfCategories(): number;
+  isFieldMetaEnabled(): boolean;
+  isOrdinal(): boolean;
+  supportsFieldMeta(): boolean;
+  getFieldMetaRequest(): Promise<unknown>;
+  supportsMbFeatureState(): boolean;
+  pluckOrdinalStyleMetaFromFeatures(features: Feature[]): RangeFieldMeta | null;
+  pluckCategoricalStyleMetaFromFeatures(features: Feature[]): CategoryFieldMeta | null;
+  getValueSuggestions(query: string): Promise<string[]>;
+}
+
+type fieldFormatter = (value: string | undefined) => string;
 
-export class DynamicStyleProperty extends AbstractStyleProperty {
+export class DynamicStyleProperty<T> extends AbstractStyleProperty<T>
+  implements IDynamicStyleProperty<T> {
   static type = STYLE_TYPE.DYNAMIC;
 
-  constructor(options, styleName, field, vectorLayer, getFieldFormatter) {
+  protected readonly _field: IField | null;
+  protected readonly _layer: IVectorLayer;
+  protected readonly _getFieldFormatter: (fieldName: string) => null | fieldFormatter;
+
+  constructor(
+    options: T,
+    styleName: VECTOR_STYLES,
+    field: IField | null,
+    vectorLayer: IVectorLayer,
+    getFieldFormatter: (fieldName: string) => null | fieldFormatter
+  ) {
     super(options, styleName);
     this._field = field;
     this._layer = vectorLayer;
     this._getFieldFormatter = getFieldFormatter;
   }
 
-  getValueSuggestions = (query) => {
-    const field = this.getField();
-    const fieldSource = this._getFieldSource();
-    return fieldSource && field ? fieldSource.getValueSuggestions(field, query) : [];
+  // ignore TS error about "Type '(query: string) => Promise<string[]> | never[]' is not assignable to type '(query: string) => Promise<string[]>'."
+  // @ts-expect-error
+  getValueSuggestions = (query: string) => {
+    return this._field === null
+      ? []
+      : this._field.getSource().getValueSuggestions(this._field, query);
   };
 
-  _getStyleMetaDataRequestId(fieldName) {
+  _getStyleMetaDataRequestId(fieldName: string) {
     if (this.getFieldOrigin() === FIELD_ORIGIN.SOURCE) {
       return SOURCE_META_DATA_REQUEST_ID;
     }
 
-    const join = this._layer.getValidJoins().find((join) => {
-      return join.getRightJoinSource().hasMatchingMetricField(fieldName);
+    const join = this._layer.getValidJoins().find((validJoin: IJoin) => {
+      return validJoin.getRightJoinSource().hasMatchingMetricField(fieldName);
     });
     return join ? join.getSourceMetaDataRequestId() : null;
   }
@@ -63,8 +108,8 @@ export class DynamicStyleProperty extends AbstractStyleProperty {
       return rangeFieldMetaFromLocalFeatures;
     }
 
-    const data = styleMetaDataRequest.getData();
-    const rangeFieldMeta = this.pluckOrdinalStyleMetaFromFieldMetaData(data);
+    const data = styleMetaDataRequest.getData() as StyleMetaData;
+    const rangeFieldMeta = this._pluckOrdinalStyleMetaFromFieldMetaData(data);
     return rangeFieldMeta ? rangeFieldMeta : rangeFieldMetaFromLocalFeatures;
   }
 
@@ -88,8 +133,8 @@ export class DynamicStyleProperty extends AbstractStyleProperty {
       return categoryFieldMetaFromLocalFeatures;
     }
 
-    const data = styleMetaDataRequest.getData();
-    const rangeFieldMeta = this.pluckCategoricalStyleMetaFromFieldMetaData(data);
+    const data = styleMetaDataRequest.getData() as StyleMetaData;
+    const rangeFieldMeta = this._pluckCategoricalStyleMetaFromFieldMetaData(data);
     return rangeFieldMeta ? rangeFieldMeta : categoryFieldMetaFromLocalFeatures;
   }
 
@@ -97,10 +142,6 @@ export class DynamicStyleProperty extends AbstractStyleProperty {
     return this._field;
   }
 
-  _getFieldSource() {
-    return this._field ? this._field.getSource() : null;
-  }
-
   getFieldName() {
     return this._field ? this._field.getName() : '';
   }
@@ -126,7 +167,7 @@ export class DynamicStyleProperty extends AbstractStyleProperty {
   }
 
   getFieldOrigin() {
-    return this._field.getOrigin();
+    return this._field ? this._field.getOrigin() : null;
   }
 
   isFieldMetaEnabled() {
@@ -135,10 +176,14 @@ export class DynamicStyleProperty extends AbstractStyleProperty {
   }
 
   supportsFieldMeta() {
-    return this.isComplete() && this._field.supportsFieldMeta();
+    return this.isComplete() && !!this._field && this._field.supportsFieldMeta();
   }
 
   async getFieldMetaRequest() {
+    if (!this._field) {
+      return null;
+    }
+
     if (this.isOrdinal()) {
       return this._field.getOrdinalFieldMetaRequest();
     } else if (this.isCategorical()) {
@@ -154,20 +199,20 @@ export class DynamicStyleProperty extends AbstractStyleProperty {
   }
 
   getFieldMetaOptions() {
-    return _.get(this.getOptions(), 'fieldMetaOptions', {});
+    return _.get(this.getOptions(), 'fieldMetaOptions', { isEnabled: true });
   }
 
-  pluckOrdinalStyleMetaFromFeatures(features) {
+  pluckOrdinalStyleMetaFromFeatures(features: Feature[]) {
     if (!this.isOrdinal()) {
       return null;
     }
 
-    const name = this.getField().getName();
+    const name = this.getFieldName();
     let min = Infinity;
     let max = -Infinity;
     for (let i = 0; i < features.length; i++) {
       const feature = features[i];
-      const newValue = parseFloat(feature.properties[name]);
+      const newValue = parseFloat(feature.properties ? feature.properties[name] : null);
       if (!isNaN(newValue)) {
         min = Math.min(min, newValue);
         max = Math.max(max, newValue);
@@ -176,25 +221,24 @@ export class DynamicStyleProperty extends AbstractStyleProperty {
 
     return min === Infinity || max === -Infinity
       ? null
-      : {
-          min: min,
-          max: max,
+      : ({
+          min,
+          max,
           delta: max - min,
-        };
+        } as RangeFieldMeta);
   }
 
-  pluckCategoricalStyleMetaFromFeatures(features) {
+  pluckCategoricalStyleMetaFromFeatures(features: Feature[]) {
     const size = this.getNumberOfCategories();
     if (!this.isCategorical() || size <= 0) {
       return null;
     }
 
-    const fieldName = this.getField().getName();
     const counts = new Map();
     for (let i = 0; i < features.length; i++) {
       const feature = features[i];
-      const term = feature.properties[fieldName];
-      //properties object may be sparse, so need to check if the field is effectively present
+      const term = feature.properties ? feature.properties[this.getFieldName()] : undefined;
+      // properties object may be sparse, so need to check if the field is effectively present
       if (typeof term !== undefined) {
         if (counts.has(term)) {
           counts.set(term, counts.get(term) + 1);
@@ -215,16 +259,16 @@ export class DynamicStyleProperty extends AbstractStyleProperty {
     const truncated = ordered.slice(0, size);
     return {
       categories: truncated,
-    };
+    } as CategoryFieldMeta;
   }
 
-  pluckOrdinalStyleMetaFromFieldMetaData(fieldMetaData) {
-    if (!this.isOrdinal()) {
+  _pluckOrdinalStyleMetaFromFieldMetaData(styleMetaData: StyleMetaData) {
+    if (!this.isOrdinal() || !this._field) {
       return null;
     }
 
-    const stats = fieldMetaData[this._field.getRootName()];
-    if (!stats) {
+    const stats = styleMetaData[this._field.getRootName()];
+    if (!stats || !('avg' in stats)) {
       return null;
     }
 
@@ -242,55 +286,56 @@ export class DynamicStyleProperty extends AbstractStyleProperty {
     };
   }
 
-  pluckCategoricalStyleMetaFromFieldMetaData(fieldMetaData) {
-    if (!this.isCategorical()) {
+  _pluckCategoricalStyleMetaFromFieldMetaData(styleMetaData: StyleMetaData) {
+    if (!this.isCategorical() || !this._field) {
       return null;
     }
 
-    const rootFieldName = this._field.getRootName();
-    if (!fieldMetaData[rootFieldName] || !fieldMetaData[rootFieldName].buckets) {
+    const fieldMeta = styleMetaData[this._field.getRootName()];
+    if (!fieldMeta || !('buckets' in fieldMeta)) {
       return null;
     }
 
-    const ordered = fieldMetaData[rootFieldName].buckets.map((bucket) => {
-      return {
-        key: bucket.key,
-        count: bucket.doc_count,
-      };
-    });
     return {
-      categories: ordered,
+      categories: fieldMeta.buckets.map((bucket) => {
+        return {
+          key: bucket.key,
+          count: bucket.doc_count,
+        };
+      }),
     };
   }
 
-  formatField(value) {
+  formatField(value: string | undefined): string {
     if (this.getField()) {
-      const fieldName = this.getField().getName();
+      const fieldName = this.getFieldName();
       const fieldFormatter = this._getFieldFormatter(fieldName);
-      return fieldFormatter ? fieldFormatter(value) : value;
+      return fieldFormatter ? fieldFormatter(value) : super.formatField(value);
     } else {
-      return value;
+      return super.formatField(value);
     }
   }
 
-  getNumericalMbFeatureStateValue(value) {
-    const valueAsFloat = parseFloat(value);
-    return isNaN(valueAsFloat) ? null : valueAsFloat;
-  }
-
   renderLegendDetailRow() {
     return null;
   }
 
-  renderFieldMetaPopover(onFieldMetaOptionsChange) {
+  renderFieldMetaPopover(onFieldMetaOptionsChange: (fieldMetaOptions: FieldMetaOptions) => void) {
     if (!this.supportsFieldMeta()) {
       return null;
     }
 
     return this.isCategorical() ? (
-      <CategoricalFieldMetaPopover styleProperty={this} onChange={onFieldMetaOptionsChange} />
+      <CategoricalFieldMetaPopover
+        fieldMetaOptions={this.getFieldMetaOptions()}
+        onChange={onFieldMetaOptionsChange}
+      />
     ) : (
-      <OrdinalFieldMetaPopover styleProperty={this} onChange={onFieldMetaOptionsChange} />
+      <OrdinalFieldMetaPopover
+        fieldMetaOptions={this.getFieldMetaOptions()}
+        styleName={this.getStyleName()}
+        onChange={onFieldMetaOptionsChange}
+      />
     );
   }
 }
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/properties/style_property.ts b/x-pack/plugins/maps/public/classes/styles/vector/properties/style_property.ts
index b704e4bd56970..7a0ed4fb3e962 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/properties/style_property.ts
+++ b/x-pack/plugins/maps/public/classes/styles/vector/properties/style_property.ts
@@ -8,7 +8,7 @@
 import { ReactElement } from 'react';
 // @ts-ignore
 import { getVectorStyleLabel } from '../components/get_vector_style_label';
-import { FieldMetaOptions, StylePropertyOptions } from '../../../../../common/descriptor_types';
+import { FieldMetaOptions } from '../../../../../common/descriptor_types';
 import { VECTOR_STYLES } from '../../../../../common/constants';
 
 type LegendProps = {
@@ -17,12 +17,12 @@ type LegendProps = {
   symbolId?: string;
 };
 
-export interface IStyleProperty {
+export interface IStyleProperty<T> {
   isDynamic(): boolean;
   isComplete(): boolean;
   formatField(value: string | undefined): string;
   getStyleName(): VECTOR_STYLES;
-  getOptions(): StylePropertyOptions;
+  getOptions(): T;
   renderLegendDetailRow(legendProps: LegendProps): ReactElement<any> | null;
   renderFieldMetaPopover(
     onFieldMetaOptionsChange: (fieldMetaOptions: FieldMetaOptions) => void
@@ -30,11 +30,11 @@ export interface IStyleProperty {
   getDisplayStyleName(): string;
 }
 
-export class AbstractStyleProperty implements IStyleProperty {
-  private readonly _options: StylePropertyOptions;
-  private readonly _styleName: VECTOR_STYLES;
+export class AbstractStyleProperty<T> implements IStyleProperty<T> {
+  protected readonly _options: T;
+  protected readonly _styleName: VECTOR_STYLES;
 
-  constructor(options: StylePropertyOptions, styleName: VECTOR_STYLES) {
+  constructor(options: T, styleName: VECTOR_STYLES) {
     this._options = options;
     this._styleName = styleName;
   }
@@ -62,15 +62,17 @@ export class AbstractStyleProperty implements IStyleProperty {
     return this._styleName;
   }
 
-  getOptions(): StylePropertyOptions {
-    return this._options || {};
+  getOptions(): T {
+    return this._options;
   }
 
   renderLegendDetailRow() {
     return null;
   }
 
-  renderFieldMetaPopover() {
+  renderFieldMetaPopover(
+    onFieldMetaOptionsChange: (fieldMetaOptions: FieldMetaOptions) => void
+  ): ReactElement<any> | null {
     return null;
   }
 
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/vector_style.d.ts b/x-pack/plugins/maps/public/classes/styles/vector/vector_style.d.ts
index ea0736c4837d8..d48d075288a28 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/vector_style.d.ts
+++ b/x-pack/plugins/maps/public/classes/styles/vector/vector_style.d.ts
@@ -9,14 +9,16 @@ import { IVectorLayer } from '../../layers/vector_layer/vector_layer';
 import { IVectorSource } from '../../sources/vector_source';
 import { AbstractStyle, IStyle } from '../style';
 import {
+  DynamicStylePropertyOptions,
+  StylePropertyOptions,
   VectorStyleDescriptor,
   VectorStylePropertiesDescriptor,
 } from '../../../../common/descriptor_types';
 import { StyleMeta } from './style_meta';
 
 export interface IVectorStyle extends IStyle {
-  getAllStyleProperties(): IStyleProperty[];
-  getDynamicPropertiesArray(): IDynamicStyleProperty[];
+  getAllStyleProperties(): Array<IStyleProperty<StylePropertyOptions>>;
+  getDynamicPropertiesArray(): Array<IDynamicStyleProperty<DynamicStylePropertyOptions>>;
   getSourceFieldNames(): string[];
   getStyleMeta(): StyleMeta;
 }
@@ -26,7 +28,7 @@ export class VectorStyle extends AbstractStyle implements IVectorStyle {
   static createDefaultStyleProperties(mapColors: string[]): VectorStylePropertiesDescriptor;
   constructor(descriptor: VectorStyleDescriptor, source: IVectorSource, layer: IVectorLayer);
   getSourceFieldNames(): string[];
-  getAllStyleProperties(): IStyleProperty[];
-  getDynamicPropertiesArray(): IDynamicStyleProperty[];
+  getAllStyleProperties(): Array<IStyleProperty<StylePropertyOptions>>;
+  getDynamicPropertiesArray(): Array<IDynamicStyleProperty<DynamicStylePropertyOptions>>;
   getStyleMeta(): StyleMeta;
 }
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/vector_style.js b/x-pack/plugins/maps/public/classes/styles/vector/vector_style.js
index 3cff48e4d682e..907e16a6a8427 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/vector_style.js
+++ b/x-pack/plugins/maps/public/classes/styles/vector/vector_style.js
@@ -48,6 +48,11 @@ const POINTS = [GEO_JSON_TYPE.POINT, GEO_JSON_TYPE.MULTI_POINT];
 const LINES = [GEO_JSON_TYPE.LINE_STRING, GEO_JSON_TYPE.MULTI_LINE_STRING];
 const POLYGONS = [GEO_JSON_TYPE.POLYGON, GEO_JSON_TYPE.MULTI_POLYGON];
 
+function getNumericalMbFeatureStateValue(value) {
+  const valueAsFloat = parseFloat(value);
+  return isNaN(valueAsFloat) ? null : valueAsFloat;
+}
+
 export class VectorStyle extends AbstractStyle {
   static type = LAYER_STYLE_TYPE.VECTOR;
 
@@ -518,14 +523,14 @@ export class VectorStyle extends AbstractStyle {
         const computedName = getComputedFieldName(dynamicStyleProp.getStyleName(), name);
         const rawValue = feature.properties[name];
         if (dynamicStyleProp.supportsMbFeatureState()) {
-          tmpFeatureState[name] = dynamicStyleProp.getNumericalMbFeatureStateValue(rawValue); //the same value will be potentially overridden multiple times, if the name remains identical
+          tmpFeatureState[name] = getNumericalMbFeatureStateValue(rawValue); //the same value will be potentially overridden multiple times, if the name remains identical
         } else {
           //in practice, a new system property will only be created for:
           // - label text: this requires the value to be formatted first.
           // - icon orientation: this is a lay-out property which do not support feature-state (but we're still coercing to a number)
 
           const formattedValue = dynamicStyleProp.isOrdinal()
-            ? dynamicStyleProp.getNumericalMbFeatureStateValue(rawValue)
+            ? getNumericalMbFeatureStateValue(rawValue)
             : dynamicStyleProp.formatField(rawValue);
 
           feature.properties[computedName] = formattedValue;
diff --git a/x-pack/plugins/maps/public/kibana_services.d.ts b/x-pack/plugins/maps/public/kibana_services.d.ts
index 974bccf4942f3..2e6911e89fa0a 100644
--- a/x-pack/plugins/maps/public/kibana_services.d.ts
+++ b/x-pack/plugins/maps/public/kibana_services.d.ts
@@ -49,6 +49,7 @@ export function getShowMapsInspectorAdapter(): boolean;
 export function getPreserveDrawingBuffer(): boolean;
 export function getProxyElasticMapsServiceInMaps(): boolean;
 export function getIsGoldPlus(): boolean;
+export function fetchSearchSourceAndRecordWithInspector(args: unknown): any;
 
 export function setLicenseId(args: unknown): void;
 export function setInspector(args: unknown): void;
diff --git a/x-pack/plugins/maps/public/routing/maps_router.js b/x-pack/plugins/maps/public/routing/maps_router.js
index 840d4f2c66922..30b2137399c1e 100644
--- a/x-pack/plugins/maps/public/routing/maps_router.js
+++ b/x-pack/plugins/maps/public/routing/maps_router.js
@@ -17,18 +17,18 @@ import { LoadMapAndRender } from './routes/maps_app/load_map_and_render';
 export let goToSpecifiedPath;
 export let kbnUrlStateStorage;
 
-export async function renderApp(context, { appBasePath, element, history }) {
+export async function renderApp(context, { appBasePath, element, history, onAppLeave }) {
   goToSpecifiedPath = (path) => history.push(path);
   kbnUrlStateStorage = createKbnUrlStateStorage({ useHash: false, history });
 
-  render(<App history={history} appBasePath={appBasePath} />, element);
+  render(<App history={history} appBasePath={appBasePath} onAppLeave={onAppLeave} />, element);
 
   return () => {
     unmountComponentAtNode(element);
   };
 }
 
-const App = ({ history, appBasePath }) => {
+const App = ({ history, appBasePath, onAppLeave }) => {
   const store = getStore();
   const I18nContext = getCoreI18n().Context;
 
@@ -37,8 +37,20 @@ const App = ({ history, appBasePath }) => {
       <Provider store={store}>
         <Router basename={appBasePath} history={history}>
           <Switch>
-            <Route path={`/map/:savedMapId`} component={LoadMapAndRender} />
-            <Route exact path={`/map`} component={LoadMapAndRender} />
+            <Route
+              path={`/map/:savedMapId`}
+              render={(props) => (
+                <LoadMapAndRender
+                  savedMapId={props.match.params.savedMapId}
+                  onAppLeave={onAppLeave}
+                />
+              )}
+            />
+            <Route
+              exact
+              path={`/map`}
+              render={() => <LoadMapAndRender onAppLeave={onAppLeave} />}
+            />
             // Redirect other routes to list, or if hash-containing, their non-hash equivalents
             <Route
               path={``}
diff --git a/x-pack/plugins/maps/public/routing/page_elements/breadcrumbs.js b/x-pack/plugins/maps/public/routing/page_elements/breadcrumbs.js
deleted file mode 100644
index de2ee42b49171..0000000000000
--- a/x-pack/plugins/maps/public/routing/page_elements/breadcrumbs.js
+++ /dev/null
@@ -1,60 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { i18n } from '@kbn/i18n';
-import { getCoreChrome } from '../../kibana_services';
-import { MAP_PATH } from '../../../common/constants';
-import _ from 'lodash';
-import { getLayerListRaw } from '../../selectors/map_selectors';
-import { copyPersistentState } from '../../reducers/util';
-import { getStore } from '../store_operations';
-import { goToSpecifiedPath } from '../maps_router';
-
-function hasUnsavedChanges(savedMap, initialLayerListConfig) {
-  const state = getStore().getState();
-  const layerList = getLayerListRaw(state);
-  const layerListConfigOnly = copyPersistentState(layerList);
-
-  const savedLayerList = savedMap.getLayerList();
-
-  return !savedLayerList
-    ? !_.isEqual(layerListConfigOnly, initialLayerListConfig)
-    : // savedMap stores layerList as a JSON string using JSON.stringify.
-      // JSON.stringify removes undefined properties from objects.
-      // savedMap.getLayerList converts the JSON string back into Javascript array of objects.
-      // Need to perform the same process for layerListConfigOnly to compare apples to apples
-      // and avoid undefined properties in layerListConfigOnly triggering unsaved changes.
-      !_.isEqual(JSON.parse(JSON.stringify(layerListConfigOnly)), savedLayerList);
-}
-
-export const updateBreadcrumbs = (savedMap, initialLayerListConfig, currentPath = '') => {
-  const isOnMapNow = currentPath.startsWith(`/${MAP_PATH}`);
-  const breadCrumbs = isOnMapNow
-    ? [
-        {
-          text: i18n.translate('xpack.maps.mapController.mapsBreadcrumbLabel', {
-            defaultMessage: 'Maps',
-          }),
-          onClick: () => {
-            if (hasUnsavedChanges(savedMap, initialLayerListConfig)) {
-              const navigateAway = window.confirm(
-                i18n.translate('xpack.maps.breadCrumbs.unsavedChangesWarning', {
-                  defaultMessage: `Your unsaved changes might not be saved`,
-                })
-              );
-              if (navigateAway) {
-                goToSpecifiedPath('/');
-              }
-            } else {
-              goToSpecifiedPath('/');
-            }
-          },
-        },
-        { text: savedMap.title },
-      ]
-    : [];
-  getCoreChrome().setBreadcrumbs(breadCrumbs);
-};
diff --git a/x-pack/plugins/maps/public/routing/page_elements/top_nav_menu/top_nav_menu.js b/x-pack/plugins/maps/public/routing/page_elements/top_nav_menu/top_nav_menu.js
index 762d61d6d33f9..ac2dec0db59cc 100644
--- a/x-pack/plugins/maps/public/routing/page_elements/top_nav_menu/top_nav_menu.js
+++ b/x-pack/plugins/maps/public/routing/page_elements/top_nav_menu/top_nav_menu.js
@@ -21,7 +21,6 @@ import {
   showSaveModal,
 } from '../../../../../../../src/plugins/saved_objects/public';
 import { MAP_SAVED_OBJECT_TYPE } from '../../../../common/constants';
-import { updateBreadcrumbs } from '../breadcrumbs';
 import { goToSpecifiedPath } from '../../maps_router';
 
 export function MapsTopNavMenu({
@@ -35,7 +34,6 @@ export function MapsTopNavMenu({
   refreshConfig,
   setRefreshConfig,
   setRefreshStoreConfig,
-  initialLayerListConfig,
   indexPatterns,
   updateFiltersAndDispatch,
   isSaveDisabled,
@@ -44,7 +42,7 @@ export function MapsTopNavMenu({
   openMapSettings,
   inspectorAdapters,
   syncAppAndGlobalState,
-  currentPath,
+  setBreadcrumbs,
   isOpenSettingsDisabled,
 }) {
   const { TopNavMenu } = getNavigation().ui;
@@ -64,14 +62,13 @@ export function MapsTopNavMenu({
   // Nav settings
   const config = getTopNavConfig(
     savedMap,
-    initialLayerListConfig,
     isOpenSettingsDisabled,
     isSaveDisabled,
     closeFlyout,
     enableFullScreen,
     openMapSettings,
     inspectorAdapters,
-    currentPath
+    setBreadcrumbs
   );
 
   const submitQuery = function ({ dateRange, query }) {
@@ -121,14 +118,13 @@ export function MapsTopNavMenu({
 
 function getTopNavConfig(
   savedMap,
-  initialLayerListConfig,
   isOpenSettingsDisabled,
   isSaveDisabled,
   closeFlyout,
   enableFullScreen,
   openMapSettings,
   inspectorAdapters,
-  currentPath
+  setBreadcrumbs
 ) {
   return [
     {
@@ -210,19 +206,15 @@ function getTopNavConfig(
                   isTitleDuplicateConfirmed,
                   onTitleDuplicate,
                 };
-                return doSave(
-                  savedMap,
-                  saveOptions,
-                  initialLayerListConfig,
-                  closeFlyout,
-                  currentPath
-                ).then((response) => {
-                  // If the save wasn't successful, put the original values back.
-                  if (!response.id || response.error) {
-                    savedMap.title = currentTitle;
+                return doSave(savedMap, saveOptions, closeFlyout, setBreadcrumbs).then(
+                  (response) => {
+                    // If the save wasn't successful, put the original values back.
+                    if (!response.id || response.error) {
+                      savedMap.title = currentTitle;
+                    }
+                    return response;
                   }
-                  return response;
-                });
+                );
               };
 
               const saveModal = (
@@ -243,7 +235,7 @@ function getTopNavConfig(
   ];
 }
 
-async function doSave(savedMap, saveOptions, initialLayerListConfig, closeFlyout, currentPath) {
+async function doSave(savedMap, saveOptions, closeFlyout, setBreadcrumbs) {
   closeFlyout();
   savedMap.syncWithStore();
   let id;
@@ -265,7 +257,7 @@ async function doSave(savedMap, saveOptions, initialLayerListConfig, closeFlyout
 
   if (id) {
     goToSpecifiedPath(`/map/${id}${window.location.hash}`);
-    updateBreadcrumbs(savedMap, initialLayerListConfig, currentPath);
+    setBreadcrumbs();
 
     getToasts().addSuccess({
       title: i18n.translate('xpack.maps.mapController.saveSuccessMessage', {
diff --git a/x-pack/plugins/maps/public/routing/routes/list/maps_list_view.js b/x-pack/plugins/maps/public/routing/routes/list/maps_list_view.js
index a32bd00dbae51..e9229883d708d 100644
--- a/x-pack/plugins/maps/public/routing/routes/list/maps_list_view.js
+++ b/x-pack/plugins/maps/public/routing/routes/list/maps_list_view.js
@@ -33,7 +33,6 @@ import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { addHelpMenuToAppChrome } from '../../../help_menu_util';
 import { Link } from 'react-router-dom';
-import { updateBreadcrumbs } from '../../page_elements/breadcrumbs';
 import { goToSpecifiedPath } from '../../maps_router';
 
 export const EMPTY_FILTER = '';
@@ -53,17 +52,13 @@ export class MapsListView extends React.Component {
     listingLimit: getUiSettings().get('savedObjects:listingLimit'),
   };
 
-  UNSAFE_componentWillMount() {
-    this._isMounted = true;
-    updateBreadcrumbs();
-  }
-
   componentWillUnmount() {
     this._isMounted = false;
     this.debouncedFetch.cancel();
   }
 
   componentDidMount() {
+    this._isMounted = true;
     this.initMapList();
   }
 
diff --git a/x-pack/plugins/maps/public/routing/routes/maps_app/index.js b/x-pack/plugins/maps/public/routing/routes/maps_app/index.js
index 6b47ac6e0352a..9b0d52e4fe297 100644
--- a/x-pack/plugins/maps/public/routing/routes/maps_app/index.js
+++ b/x-pack/plugins/maps/public/routing/routes/maps_app/index.js
@@ -11,6 +11,7 @@ import {
   getFilters,
   getQueryableUniqueIndexPatternIds,
   getRefreshConfig,
+  hasUnsavedChanges,
 } from '../../../selectors/map_selectors';
 import {
   replaceLayerList,
@@ -34,6 +35,9 @@ function mapStateToProps(state = {}) {
     flyoutDisplay: getFlyoutDisplay(state),
     refreshConfig: getRefreshConfig(state),
     filters: getFilters(state),
+    hasUnsavedChanges: (savedMap, initialLayerListConfig) => {
+      return hasUnsavedChanges(state, savedMap, initialLayerListConfig);
+    },
   };
 }
 
diff --git a/x-pack/plugins/maps/public/routing/routes/maps_app/load_map_and_render.js b/x-pack/plugins/maps/public/routing/routes/maps_app/load_map_and_render.js
index a17b83502e048..3eea5b00d324e 100644
--- a/x-pack/plugins/maps/public/routing/routes/maps_app/load_map_and_render.js
+++ b/x-pack/plugins/maps/public/routing/routes/maps_app/load_map_and_render.js
@@ -7,7 +7,7 @@
 import React from 'react';
 import { MapsAppView } from '.';
 import { getMapsSavedObjectLoader } from '../../bootstrap/services/gis_map_saved_object_loader';
-import { getToasts } from '../../../kibana_services';
+import { getCoreChrome, getToasts } from '../../../kibana_services';
 import { i18n } from '@kbn/i18n';
 import { Redirect } from 'react-router-dom';
 
@@ -27,10 +27,13 @@ export const LoadMapAndRender = class extends React.Component {
   }
 
   async _loadSavedMap() {
-    const { savedMapId } = this.props.match.params;
     try {
-      const savedMap = await getMapsSavedObjectLoader().get(savedMapId);
+      const savedMap = await getMapsSavedObjectLoader().get(this.props.savedMapId);
       if (this._isMounted) {
+        getCoreChrome().docTitle.change(savedMap.title);
+        if (this.props.savedMapId) {
+          getCoreChrome().recentlyAccessed.add(savedMap.getFullPath(), savedMap.title, savedMap.id);
+        }
         this.setState({ savedMap });
       }
     } catch (err) {
@@ -48,11 +51,11 @@ export const LoadMapAndRender = class extends React.Component {
 
   render() {
     const { savedMap, failedToLoad } = this.state;
+
     if (failedToLoad) {
       return <Redirect to="/" />;
     }
 
-    const currentPath = this.props.match.url;
-    return savedMap ? <MapsAppView savedMap={savedMap} currentPath={currentPath} /> : null;
+    return savedMap ? <MapsAppView savedMap={savedMap} onAppLeave={this.props.onAppLeave} /> : null;
   }
 };
diff --git a/x-pack/plugins/maps/public/routing/routes/maps_app/maps_app_view.js b/x-pack/plugins/maps/public/routing/routes/maps_app/maps_app_view.js
index bf92f5a337121..aa7f24155ab43 100644
--- a/x-pack/plugins/maps/public/routing/routes/maps_app/maps_app_view.js
+++ b/x-pack/plugins/maps/public/routing/routes/maps_app/maps_app_view.js
@@ -30,12 +30,15 @@ import {
 } from '../../state_syncing/global_sync';
 import { AppStateManager } from '../../state_syncing/app_state_manager';
 import { useAppStateSyncing } from '../../state_syncing/app_sync';
-import { updateBreadcrumbs } from '../../page_elements/breadcrumbs';
 import { esFilters } from '../../../../../../../src/plugins/data/public';
 import { GisMap } from '../../../connected_components/gis_map';
+import { goToSpecifiedPath } from '../../maps_router';
+
+const unsavedChangesWarning = i18n.translate('xpack.maps.breadCrumbs.unsavedChangesWarning', {
+  defaultMessage: 'Your map has unsaved changes. Are you sure you want to leave?',
+});
 
 export class MapsAppView extends React.Component {
-  _visibleSubscription = null;
   _globalSyncUnsubscribe = null;
   _globalSyncChangeMonitorSubscription = null;
   _appSyncUnsubscribe = null;
@@ -47,20 +50,12 @@ export class MapsAppView extends React.Component {
       indexPatterns: [],
       prevIndexPatternIds: [],
       initialized: false,
-      isVisible: true,
       savedQuery: '',
-      currentPath: '',
       initialLayerListConfig: null,
     };
   }
 
   componentDidMount() {
-    const { savedMap, currentPath } = this.props;
-    this.setState({ currentPath });
-
-    getCoreChrome().docTitle.change(savedMap.title);
-    getCoreChrome().recentlyAccessed.add(savedMap.getFullPath(), savedMap.title, savedMap.id);
-
     // Init sync utils
     // eslint-disable-next-line react-hooks/rules-of-hooks
     this._globalSyncUnsubscribe = useGlobalStateSyncing();
@@ -77,48 +72,24 @@ export class MapsAppView extends React.Component {
       this._updateStateFromSavedQuery(initAppState.savedQuery);
     }
 
-    // Monitor visibility
-    this._visibleSubscription = getCoreChrome()
-      .getIsVisible$()
-      .subscribe((isVisible) => this.setState({ isVisible }));
     this._initMap();
-  }
 
-  _initBreadcrumbUpdater = () => {
-    const { initialLayerListConfig, currentPath } = this.state;
-    updateBreadcrumbs(this.props.savedMap, initialLayerListConfig, currentPath);
-  };
+    this._setBreadcrumbs();
 
-  componentDidUpdate(prevProps, prevState) {
-    const { currentPath: prevCurrentPath } = prevState;
-    const { currentPath, initialLayerListConfig } = this.state;
-    const { savedMap } = this.props;
-    if (savedMap && initialLayerListConfig && currentPath !== prevCurrentPath) {
-      updateBreadcrumbs(savedMap, initialLayerListConfig, currentPath);
-    }
-    // TODO: Handle null when converting to TS
-    this._handleStoreChanges();
-  }
-
-  _updateFromGlobalState = ({ changes, state: globalState }) => {
-    if (!changes || !globalState) {
-      return;
-    }
-    const newState = {};
-    Object.keys(changes).forEach((key) => {
-      if (changes[key]) {
-        newState[key] = globalState[key];
+    this.props.onAppLeave((actions) => {
+      if (this._hasUnsavedChanges()) {
+        if (!window.confirm(unsavedChangesWarning)) {
+          return;
+        }
       }
+      return actions.default();
     });
+  }
 
-    this.setState(newState, () => {
-      this._appStateManager.setQueryAndFilters({
-        filters: getData().query.filterManager.getAppFilters(),
-      });
-      const { time, filters, refreshInterval } = globalState;
-      this.props.dispatchSetQuery(refreshInterval, filters, this.state.query, time);
-    });
-  };
+  componentDidUpdate() {
+    // TODO: Handle null when converting to TS
+    this._handleStoreChanges();
+  }
 
   componentWillUnmount() {
     if (this._globalSyncUnsubscribe) {
@@ -127,9 +98,6 @@ export class MapsAppView extends React.Component {
     if (this._appSyncUnsubscribe) {
       this._appSyncUnsubscribe();
     }
-    if (this._visibleSubscription) {
-      this._visibleSubscription.unsubscribe();
-    }
     if (this._globalSyncChangeMonitorSubscription) {
       this._globalSyncChangeMonitorSubscription.unsubscribe();
     }
@@ -141,8 +109,55 @@ export class MapsAppView extends React.Component {
         filterManager.removeFilter(filter);
       }
     });
+
+    getCoreChrome().setBreadcrumbs([]);
+  }
+
+  _hasUnsavedChanges() {
+    return this.props.hasUnsavedChanges(this.props.savedMap, this.state.initialLayerListConfig);
   }
 
+  _setBreadcrumbs = () => {
+    getCoreChrome().setBreadcrumbs([
+      {
+        text: i18n.translate('xpack.maps.mapController.mapsBreadcrumbLabel', {
+          defaultMessage: 'Maps',
+        }),
+        onClick: () => {
+          if (this._hasUnsavedChanges()) {
+            const navigateAway = window.confirm(unsavedChangesWarning);
+            if (navigateAway) {
+              goToSpecifiedPath('/');
+            }
+          } else {
+            goToSpecifiedPath('/');
+          }
+        },
+      },
+      { text: this.props.savedMap.title },
+    ]);
+  };
+
+  _updateFromGlobalState = ({ changes, state: globalState }) => {
+    if (!changes || !globalState) {
+      return;
+    }
+    const newState = {};
+    Object.keys(changes).forEach((key) => {
+      if (changes[key]) {
+        newState[key] = globalState[key];
+      }
+    });
+
+    this.setState(newState, () => {
+      this._appStateManager.setQueryAndFilters({
+        filters: getData().query.filterManager.getAppFilters(),
+      });
+      const { time, filters, refreshInterval } = globalState;
+      this.props.dispatchSetQuery(refreshInterval, filters, this.state.query, time);
+    });
+  };
+
   _getInitialLayersFromUrlParam() {
     const locationSplit = window.location.href.split('?');
     if (locationSplit.length <= 1) {
@@ -301,13 +316,9 @@ export class MapsAppView extends React.Component {
       this._getInitialLayersFromUrlParam()
     );
     this.props.replaceLayerList(layerList);
-    this.setState(
-      {
-        initialLayerListConfig: copyPersistentState(layerList),
-        savedMap,
-      },
-      this._initBreadcrumbUpdater
-    );
+    this.setState({
+      initialLayerListConfig: copyPersistentState(layerList),
+    });
   }
 
   _updateFiltersAndDispatch = (filters) => {
@@ -407,18 +418,10 @@ export class MapsAppView extends React.Component {
   }
 
   _renderTopNav() {
-    const {
-      query,
-      time,
-      savedQuery,
-      initialLayerListConfig,
-      isVisible,
-      indexPatterns,
-      currentPath,
-    } = this.state;
-    const { savedMap, refreshConfig } = this.props;
+    const { query, time, savedQuery, indexPatterns } = this.state;
+    const { savedMap, refreshConfig, isFullScreen } = this.props;
 
-    return isVisible ? (
+    return !isFullScreen ? (
       <MapsTopNavMenu
         savedMap={savedMap}
         query={query}
@@ -434,7 +437,6 @@ export class MapsAppView extends React.Component {
             callback
           );
         }}
-        initialLayerListConfig={initialLayerListConfig}
         indexPatterns={indexPatterns}
         updateFiltersAndDispatch={this._updateFiltersAndDispatch}
         onQuerySaved={(query) => {
@@ -448,7 +450,7 @@ export class MapsAppView extends React.Component {
           this._updateStateFromSavedQuery(query);
         }}
         syncAppAndGlobalState={this._syncAppAndGlobalState}
-        currentPath={currentPath}
+        setBreadcrumbs={this._setBreadcrumbs}
       />
     ) : null;
   }
diff --git a/x-pack/plugins/maps/public/selectors/map_selectors.ts b/x-pack/plugins/maps/public/selectors/map_selectors.ts
index f400e242b697f..fe2cfec3c761c 100644
--- a/x-pack/plugins/maps/public/selectors/map_selectors.ts
+++ b/x-pack/plugins/maps/public/selectors/map_selectors.ts
@@ -416,3 +416,23 @@ export const areLayersLoaded = createSelector(
     return true;
   }
 );
+
+export function hasUnsavedChanges(
+  state: MapStoreState,
+  savedMap: unknown,
+  initialLayerListConfig: LayerDescriptor[]
+) {
+  const layerListConfigOnly = copyPersistentState(getLayerListRaw(state));
+
+  // @ts-expect-error
+  const savedLayerList = savedMap.getLayerList();
+
+  return !savedLayerList
+    ? !_.isEqual(layerListConfigOnly, initialLayerListConfig)
+    : // savedMap stores layerList as a JSON string using JSON.stringify.
+      // JSON.stringify removes undefined properties from objects.
+      // savedMap.getLayerList converts the JSON string back into Javascript array of objects.
+      // Need to perform the same process for layerListConfigOnly to compare apples to apples
+      // and avoid undefined properties in layerListConfigOnly triggering unsaved changes.
+      !_.isEqual(JSON.parse(JSON.stringify(layerListConfigOnly)), savedLayerList);
+}
diff --git a/x-pack/plugins/maps/server/maps_telemetry/maps_telemetry.test.js b/x-pack/plugins/maps/server/maps_telemetry/maps_telemetry.test.js
index 6131ff45c4a0f..a447c4ae7ce84 100644
--- a/x-pack/plugins/maps/server/maps_telemetry/maps_telemetry.test.js
+++ b/x-pack/plugins/maps/server/maps_telemetry/maps_telemetry.test.js
@@ -22,6 +22,7 @@ describe('buildMapsTelemetry', () => {
       indexPatternsWithGeoFieldCount: 0,
       indexPatternsWithGeoPointFieldCount: 0,
       indexPatternsWithGeoShapeFieldCount: 0,
+      geoShapeAggLayersCount: 0,
       attributesPerMap: {
         dataSourcesCount: {
           avg: 0,
@@ -50,48 +51,49 @@ describe('buildMapsTelemetry', () => {
       indexPatternsWithGeoFieldCount: 3,
       indexPatternsWithGeoPointFieldCount: 2,
       indexPatternsWithGeoShapeFieldCount: 1,
+      geoShapeAggLayersCount: 2,
       attributesPerMap: {
         dataSourcesCount: {
-          avg: 2.6666666666666665,
+          avg: 2,
           max: 3,
-          min: 2,
+          min: 1,
         },
         emsVectorLayersCount: {
           canada_provinces: {
-            avg: 0.3333333333333333,
+            avg: 0.2,
             max: 1,
             min: 1,
           },
           france_departments: {
-            avg: 0.3333333333333333,
+            avg: 0.2,
             max: 1,
             min: 1,
           },
           italy_provinces: {
-            avg: 0.3333333333333333,
+            avg: 0.2,
             max: 1,
             min: 1,
           },
         },
         layerTypesCount: {
           TILE: {
-            avg: 1,
+            avg: 0.6,
             max: 1,
             min: 1,
           },
           VECTOR: {
-            avg: 1.6666666666666667,
+            avg: 1.2,
             max: 2,
             min: 1,
           },
         },
         layersCount: {
-          avg: 2.6666666666666665,
+          avg: 2,
           max: 3,
-          min: 2,
+          min: 1,
         },
       },
-      mapsTotalCount: 3,
+      mapsTotalCount: 5,
       settings: {
         showMapVisualizationTypes: false,
       },
diff --git a/x-pack/plugins/maps/server/maps_telemetry/maps_telemetry.ts b/x-pack/plugins/maps/server/maps_telemetry/maps_telemetry.ts
index 5f57d666b9f74..f0286d7e5811f 100644
--- a/x-pack/plugins/maps/server/maps_telemetry/maps_telemetry.ts
+++ b/x-pack/plugins/maps/server/maps_telemetry/maps_telemetry.ts
@@ -6,13 +6,25 @@
 
 import _ from 'lodash';
 import {
-  SavedObjectsClientContract,
-  SavedObjectAttributes,
   SavedObjectAttribute,
+  SavedObjectAttributes,
+  SavedObjectsClientContract,
 } from 'kibana/server';
 import { IFieldType, IIndexPattern } from 'src/plugins/data/public';
-import { SOURCE_TYPES, ES_GEO_FIELD_TYPE, MAP_SAVED_OBJECT_TYPE } from '../../common/constants';
-import { LayerDescriptor } from '../../common/descriptor_types';
+import {
+  ES_GEO_FIELD_TYPE,
+  LAYER_TYPE,
+  MAP_SAVED_OBJECT_TYPE,
+  SCALING_TYPES,
+  SOURCE_TYPES,
+} from '../../common/constants';
+import {
+  AbstractSourceDescriptor,
+  ESGeoGridSourceDescriptor,
+  ESSearchSourceDescriptor,
+  LayerDescriptor,
+  SourceDescriptor,
+} from '../../common/descriptor_types';
 import { MapSavedObject } from '../../common/map_saved_object_type';
 // @ts-ignore
 import { getInternalRepository } from '../kibana_server_services';
@@ -82,6 +94,111 @@ function getIndexPatternsWithGeoFieldCount(indexPatterns: IIndexPattern[]) {
   };
 }
 
+function getEMSLayerCount(layerLists: LayerDescriptor[][]): ILayerTypeCount[] {
+  return layerLists.map((layerList: LayerDescriptor[]) => {
+    const emsLayers = layerList.filter((layer: LayerDescriptor) => {
+      return (
+        layer.sourceDescriptor !== null &&
+        layer.sourceDescriptor.type === SOURCE_TYPES.EMS_FILE &&
+        (layer.sourceDescriptor as AbstractSourceDescriptor).id
+      );
+    });
+    const emsCountsById = _(emsLayers).countBy((layer: LayerDescriptor) => {
+      return (layer.sourceDescriptor as AbstractSourceDescriptor).id;
+    });
+
+    const layerTypeCount = emsCountsById.value();
+    return layerTypeCount as ILayerTypeCount;
+  }) as ILayerTypeCount[];
+}
+
+function isFieldGeoShape(
+  indexPatterns: IIndexPattern[],
+  indexPatternId: string,
+  geoField: string | undefined
+): boolean {
+  if (!geoField) {
+    return false;
+  }
+
+  const matchIndexPattern = indexPatterns.find((indexPattern: IIndexPattern) => {
+    return indexPattern.id === indexPatternId;
+  });
+
+  if (!matchIndexPattern) {
+    return false;
+  }
+
+  const fieldList: IFieldType[] =
+    matchIndexPattern.attributes && matchIndexPattern.attributes.fields
+      ? JSON.parse(matchIndexPattern.attributes.fields)
+      : [];
+
+  const matchField = fieldList.find((field: IFieldType) => {
+    return field.name === geoField;
+  });
+
+  return !!matchField && matchField.type === ES_GEO_FIELD_TYPE.GEO_SHAPE;
+}
+
+function isGeoShapeAggLayer(indexPatterns: IIndexPattern[], layer: LayerDescriptor): boolean {
+  if (layer.sourceDescriptor === null) {
+    return false;
+  }
+
+  if (
+    layer.type !== LAYER_TYPE.VECTOR &&
+    layer.type !== LAYER_TYPE.BLENDED_VECTOR &&
+    layer.type !== LAYER_TYPE.HEATMAP
+  ) {
+    return false;
+  }
+
+  const sourceDescriptor: SourceDescriptor = layer.sourceDescriptor;
+  if (sourceDescriptor.type === SOURCE_TYPES.ES_GEO_GRID) {
+    return isFieldGeoShape(
+      indexPatterns,
+      (sourceDescriptor as ESGeoGridSourceDescriptor).indexPatternId,
+      (sourceDescriptor as ESGeoGridSourceDescriptor).geoField
+    );
+  } else if (
+    sourceDescriptor.type === SOURCE_TYPES.ES_SEARCH &&
+    (sourceDescriptor as ESSearchSourceDescriptor).scalingType === SCALING_TYPES.CLUSTERS
+  ) {
+    return isFieldGeoShape(
+      indexPatterns,
+      (sourceDescriptor as ESSearchSourceDescriptor).indexPatternId,
+      (sourceDescriptor as ESSearchSourceDescriptor).geoField
+    );
+  } else {
+    return false;
+  }
+}
+
+function getGeoShapeAggCount(
+  layerLists: LayerDescriptor[][],
+  indexPatterns: IIndexPattern[]
+): number {
+  const countsPerMap: number[] = layerLists.map((layerList: LayerDescriptor[]) => {
+    const geoShapeAggLayers = layerList.filter((layerDescriptor) => {
+      return isGeoShapeAggLayer(indexPatterns, layerDescriptor);
+    });
+    return geoShapeAggLayers.length;
+  });
+
+  return _.sum(countsPerMap);
+}
+
+export function getLayerLists(mapSavedObjects: MapSavedObject[]): LayerDescriptor[][] {
+  return mapSavedObjects.map((savedMapObject) => {
+    const layerList =
+      savedMapObject.attributes && savedMapObject.attributes.layerListJSON
+        ? JSON.parse(savedMapObject.attributes.layerListJSON)
+        : [];
+    return layerList as LayerDescriptor[];
+  });
+}
+
 export function buildMapsTelemetry({
   mapSavedObjects,
   indexPatternSavedObjects,
@@ -91,17 +208,13 @@ export function buildMapsTelemetry({
   indexPatternSavedObjects: IIndexPattern[];
   settings: SavedObjectAttribute;
 }): SavedObjectAttributes {
-  const layerLists = mapSavedObjects.map((savedMapObject) =>
-    savedMapObject.attributes && savedMapObject.attributes.layerListJSON
-      ? JSON.parse(savedMapObject.attributes.layerListJSON)
-      : []
-  );
+  const layerLists: LayerDescriptor[][] = getLayerLists(mapSavedObjects);
   const mapsCount = layerLists.length;
 
-  const dataSourcesCount = layerLists.map((lList) => {
+  const dataSourcesCount = layerLists.map((layerList: LayerDescriptor[]) => {
     // todo: not every source-descriptor has an id
     // @ts-ignore
-    const sourceIdList = lList.map((layer: LayerDescriptor) => layer.sourceDescriptor.id);
+    const sourceIdList = layerList.map((layer: LayerDescriptor) => layer.sourceDescriptor.id);
     return _.uniq(sourceIdList).length;
   });
 
@@ -109,15 +222,7 @@ export function buildMapsTelemetry({
   const layerTypesCount = layerLists.map((lList) => _.countBy(lList, 'type'));
 
   // Count of EMS Vector layers used
-  const emsLayersCount = layerLists.map((lList) =>
-    _(lList)
-      .countBy((layer: LayerDescriptor) => {
-        const isEmsFile = _.get(layer, 'sourceDescriptor.type') === SOURCE_TYPES.EMS_FILE;
-        return isEmsFile && _.get(layer, 'sourceDescriptor.id');
-      })
-      .pickBy((val, key) => key !== 'false')
-      .value()
-  ) as ILayerTypeCount[];
+  const emsLayersCount = getEMSLayerCount(layerLists);
 
   const dataSourcesCountSum = _.sum(dataSourcesCount);
   const layersCountSum = _.sum(layersCount);
@@ -127,11 +232,16 @@ export function buildMapsTelemetry({
     indexPatternsWithGeoPointFieldCount,
     indexPatternsWithGeoShapeFieldCount,
   } = getIndexPatternsWithGeoFieldCount(indexPatternSavedObjects);
+
+  // Tracks whether user users Gold+ only functionality
+  const geoShapeAggLayersCount = getGeoShapeAggCount(layerLists, indexPatternSavedObjects);
+
   return {
     settings,
     indexPatternsWithGeoFieldCount,
     indexPatternsWithGeoPointFieldCount,
     indexPatternsWithGeoShapeFieldCount,
+    geoShapeAggLayersCount,
     // Total count of maps
     mapsTotalCount: mapsCount,
     // Time of capture
diff --git a/x-pack/plugins/maps/server/maps_telemetry/test_resources/sample_map_saved_objects.json b/x-pack/plugins/maps/server/maps_telemetry/test_resources/sample_map_saved_objects.json
index 017f9e69ffe46..82a8035c77dc7 100644
--- a/x-pack/plugins/maps/server/maps_telemetry/test_resources/sample_map_saved_objects.json
+++ b/x-pack/plugins/maps/server/maps_telemetry/test_resources/sample_map_saved_objects.json
@@ -43,5 +43,38 @@
     ],
     "updated_at": "2019-01-31T23:19:55.855Z",
     "version": 1
+  },
+  {
+    "type": "gis-map",
+    "id": "643da1e6-c628-11ea-87d0-0242ac130003",
+    "attributes": {
+      "title": "Single cluster layer with geo_shape field",
+      "description": "",
+      "mapStateJSON": "{\"zoom\":2.12,\"center\":{\"lon\":-88.67592,\"lat\":34.23257},\"timeFilters\":{\"from\":\"now-15m\",\"to\":\"now\",\"mode\":\"quick\"},\"refreshConfig\":{\"isPaused\":false,\"interval\":0},\"query\":{\"query\":\"\",\"language\":\"lucene\"}}",
+      "layerListJSON": "[{\"sourceDescriptor\":{\"type\":\"ES_GEO_GRID\",\"id\":\"51afb7d0-c628-11ea-87d0-0242ac130003\",\"geoField\":\"geometry\",\"metrics\":[{\"type\":\"count\"}],\"requestType\":\"point\",\"resolution\":\"COARSE\",\"indexPatternId\":\"4a7f6010-0aed-11ea-9dd2-95afd7ad44d4\"},\"style\":{\"type\":\"VECTOR\",\"properties\":{\"icon\":{\"type\":\"STATIC\",\"options\":{\"value\":\"marker\"}},\"fillColor\":{\"type\":\"DYNAMIC\",\"options\":{\"color\":\"Blues\",\"colorCategory\":\"palette_0\",\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":true,\"sigma\":3},\"type\":\"ORDINAL\"}},\"lineColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#FFF\"}},\"lineWidth\":{\"type\":\"STATIC\",\"options\":{\"size\":0}},\"iconSize\":{\"type\":\"DYNAMIC\",\"options\":{\"minSize\":7,\"maxSize\":32,\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":true,\"sigma\":3}}},\"iconOrientation\":{\"type\":\"STATIC\",\"options\":{\"orientation\":0}},\"labelText\":{\"type\":\"DYNAMIC\",\"options\":{\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"}}},\"labelColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#000000\"}},\"labelSize\":{\"type\":\"STATIC\",\"options\":{\"size\":14}},\"labelBorderColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#FFFFFF\"}},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}}},\"isTimeAware\":true},\"id\":\"8d384d5d-6353-468f-b8f8-8eaa487358c4\",\"label\":null,\"minZoom\":0,\"maxZoom\":24,\"alpha\":1,\"visible\":true,\"type\":\"VECTOR\",\"joins\":[]}]",
+      "uiStateJSON": "{}"
+    },
+    "references": [
+    ],
+    "updated_at": "2019-01-31T23:19:55.855Z",
+    "version": 1
+  },
+  {
+    "type": "gis-map",
+    "id": "5efd136a-c628-11ea-87d0-0242ac130003",
+    "attributes": {
+      "title": "Single heatmap layer with geo_shape field",
+      "description": "",
+      "mapStateJSON": "{\"zoom\":2.12,\"center\":{\"lon\":-88.67592,\"lat\":34.23257},\"timeFilters\":{\"from\":\"now-15m\",\"to\":\"now\",\"mode\":\"quick\"},\"refreshConfig\":{\"isPaused\":false,\"interval\":0},\"query\":{\"query\":\"\",\"language\":\"lucene\"}}",
+      "layerListJSON": "[{\"sourceDescriptor\":{\"type\":\"ES_GEO_GRID\",\"id\":\"51afb7d0-c628-11ea-87d0-0242ac130003\",\"geoField\":\"geometry\",\"metrics\":[{\"type\":\"count\"}],\"requestType\":\"heatmap\",\"resolution\":\"COARSE\",\"indexPatternId\":\"4a7f6010-0aed-11ea-9dd2-95afd7ad44d4\"},\"id\":\"52eade74-1c78-4e18-8670-2061f38b613b\",\"label\":null,\"minZoom\":0,\"maxZoom\":24,\"alpha\":0.75,\"visible\":true,\"style\":{\"type\":\"HEATMAP\",\"colorRampName\":\"theclassic\"},\"type\":\"HEATMAP\",\"joins\":[]}]",
+      "uiStateJSON": "{}"
+    },
+    "references": [
+    ],
+    "updated_at": "2019-01-31T23:19:55.855Z",
+    "version": 1
   }
+
 ]
+
+
diff --git a/x-pack/plugins/ml/common/types/anomaly_detection_jobs/summary_job.ts b/x-pack/plugins/ml/common/types/anomaly_detection_jobs/summary_job.ts
index 6cf109dc553ae..2102673060273 100644
--- a/x-pack/plugins/ml/common/types/anomaly_detection_jobs/summary_job.ts
+++ b/x-pack/plugins/ml/common/types/anomaly_detection_jobs/summary_job.ts
@@ -30,6 +30,7 @@ export interface MlSummaryJob {
   isSingleMetricViewerJob: boolean;
   deleting?: boolean;
   latestTimestampSortValue?: number;
+  earliestStartTimestampMs?: number;
 }
 
 export interface AuditMessage {
diff --git a/x-pack/plugins/ml/common/util/job_utils.test.ts b/x-pack/plugins/ml/common/util/job_utils.test.ts
index 233e2c2cd19ac..a56ccd5208bab 100644
--- a/x-pack/plugins/ml/common/util/job_utils.test.ts
+++ b/x-pack/plugins/ml/common/util/job_utils.test.ts
@@ -18,8 +18,10 @@ import {
   prefixDatafeedId,
   getSafeAggregationName,
   getLatestDataOrBucketTimestamp,
+  getEarliestDatafeedStartTime,
 } from './job_utils';
 import { CombinedJob, Job } from '../types/anomaly_detection_jobs';
+import moment from 'moment';
 
 describe('ML - job utils', () => {
   describe('calculateDatafeedFrequencyDefaultSeconds', () => {
@@ -581,4 +583,22 @@ describe('ML - job utils', () => {
       expect(getLatestDataOrBucketTimestamp(undefined, undefined)).toBe(undefined);
     });
   });
+
+  describe('getEarliestDatafeedStartTime', () => {
+    test('returns expected value when no gap in data at end of bucket processing', () => {
+      expect(getEarliestDatafeedStartTime(1549929594000, 1549928700000)).toBe(1549929594000);
+    });
+    test('returns expected value when there is a gap in data at end of bucket processing', () => {
+      expect(getEarliestDatafeedStartTime(1549929594000, 1562256600000)).toBe(1562256600000);
+    });
+    test('returns expected value when bucket span is provided', () => {
+      expect(
+        getEarliestDatafeedStartTime(1549929594000, 1562256600000, moment.duration(1, 'h'))
+      ).toBe(1562260200000);
+    });
+
+    test('returns expected value when job has not run', () => {
+      expect(getLatestDataOrBucketTimestamp(undefined, undefined)).toBe(undefined);
+    });
+  });
 });
diff --git a/x-pack/plugins/ml/common/util/job_utils.ts b/x-pack/plugins/ml/common/util/job_utils.ts
index 7ea4ceccf578d..bb0e351ebfec8 100644
--- a/x-pack/plugins/ml/common/util/job_utils.ts
+++ b/x-pack/plugins/ml/common/util/job_utils.ts
@@ -6,7 +6,7 @@
 
 import _ from 'lodash';
 import semver from 'semver';
-import { Duration } from 'moment';
+import moment, { Duration } from 'moment';
 // @ts-ignore
 import numeral from '@elastic/numeral';
 
@@ -621,6 +621,23 @@ function isValidTimeInterval(value: string | undefined): boolean {
   return parseTimeIntervalForJob(value) !== null;
 }
 
+// The earliest start time for the datafeed should be the max(latest_record_timestamp, latest_bucket.timestamp + bucket_span).
+export function getEarliestDatafeedStartTime(
+  latestRecordTimestamp: number | undefined,
+  latestBucketTimestamp: number | undefined,
+  bucketSpan?: Duration | null | undefined
+): number | undefined {
+  if (latestRecordTimestamp !== undefined && latestBucketTimestamp !== undefined) {
+    // if bucket span is available (e.g. 15m) add it to the latest bucket timestamp in ms
+    const adjustedBucketStartTime = bucketSpan
+      ? moment(latestBucketTimestamp).add(bucketSpan).valueOf()
+      : latestBucketTimestamp;
+    return Math.max(latestRecordTimestamp, adjustedBucketStartTime);
+  } else {
+    return latestRecordTimestamp !== undefined ? latestRecordTimestamp : latestBucketTimestamp;
+  }
+}
+
 // Returns the latest of the last source data and last processed bucket timestamp,
 // as used for example in setting the end time of results views for cases where
 // anomalies might have been raised after the point at which data ingest has stopped.
diff --git a/x-pack/plugins/ml/public/application/capabilities/check_capabilities.ts b/x-pack/plugins/ml/public/application/capabilities/check_capabilities.ts
index 56b372ff39919..653eca126006d 100644
--- a/x-pack/plugins/ml/public/application/capabilities/check_capabilities.ts
+++ b/x-pack/plugins/ml/public/application/capabilities/check_capabilities.ts
@@ -10,7 +10,6 @@ import { hasLicenseExpired } from '../license';
 
 import { MlCapabilities, getDefaultCapabilities } from '../../../common/types/capabilities';
 import { getCapabilities, getManageMlCapabilities } from './get_capabilities';
-import { ACCESS_DENIED_PATH } from '../management/management_urls';
 
 let _capabilities: MlCapabilities = getDefaultCapabilities();
 
@@ -25,12 +24,10 @@ export function checkGetManagementMlJobsResolver() {
         if (isManageML === true && isPlatinumOrTrialLicense === true) {
           return resolve({ mlFeatureEnabledInSpace });
         } else {
-          window.location.href = ACCESS_DENIED_PATH;
           return reject();
         }
       })
       .catch((e) => {
-        window.location.href = ACCESS_DENIED_PATH;
         return reject();
       });
   });
diff --git a/x-pack/plugins/ml/public/application/components/ml_in_memory_table/ml_in_memory_table.tsx b/x-pack/plugins/ml/public/application/components/ml_in_memory_table/ml_in_memory_table.tsx
deleted file mode 100644
index 7caaadf65d6da..0000000000000
--- a/x-pack/plugins/ml/public/application/components/ml_in_memory_table/ml_in_memory_table.tsx
+++ /dev/null
@@ -1,108 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-// This component extends EuiInMemoryTable with some
-// fixes and TS specs until the changes become available upstream.
-
-import React, { Fragment } from 'react';
-
-import { EuiProgress } from '@elastic/eui';
-
-// The built in loading progress bar of EuiInMemoryTable causes a full DOM replacement
-// of the table and doesn't play well with auto-refreshing. That's why we're displaying
-// our own progress bar on top of the table. `EuiProgress` after `isLoading` displays
-// the loading indicator. The variation after `!isLoading` displays an empty progress
-// bar fixed to 0%. Without it, the display would vertically jump when showing/hiding
-// the progress bar.
-export const ProgressBar = ({ isLoading = false }) => {
-  return (
-    <Fragment>
-      {isLoading && <EuiProgress className="mlAnalyticsProgressBar" size="xs" color="primary" />}
-      {!isLoading && (
-        <EuiProgress className="mlAnalyticsProgressBar" value={0} max={100} size="xs" />
-      )}
-    </Fragment>
-  );
-};
-
-// copied from EUI to be available to the extended getDerivedStateFromProps()
-function findColumnByProp(columns: any, prop: any, value: any) {
-  for (let i = 0; i < columns.length; i++) {
-    const column = columns[i];
-    if (column[prop] === value) {
-      return column;
-    }
-  }
-}
-
-// copied from EUI to be available to the extended getDerivedStateFromProps()
-const getInitialSorting = (columns: any, sorting: any) => {
-  if (!sorting || !sorting.sort) {
-    return {
-      sortName: undefined,
-      sortDirection: undefined,
-    };
-  }
-
-  const { field: sortable, direction: sortDirection } = sorting.sort;
-
-  // sortable could be a column's `field` or its `name`
-  // for backwards compatibility `field` must be checked first
-  let sortColumn = findColumnByProp(columns, 'field', sortable);
-  if (sortColumn == null) {
-    sortColumn = findColumnByProp(columns, 'name', sortable);
-  }
-
-  if (sortColumn == null) {
-    return {
-      sortName: undefined,
-      sortDirection: undefined,
-    };
-  }
-
-  const sortName = sortColumn.name;
-
-  return {
-    sortName,
-    sortDirection,
-  };
-};
-
-import { mlInMemoryTableBasicFactory } from './types';
-
-export function mlInMemoryTableFactory<T>() {
-  const MlInMemoryTableBasic = mlInMemoryTableBasicFactory<T>();
-
-  return class MlInMemoryTable extends MlInMemoryTableBasic {
-    static getDerivedStateFromProps(nextProps: any, prevState: any) {
-      const derivedState = {
-        ...prevState.prevProps,
-        pageIndex: nextProps.pagination.initialPageIndex,
-        pageSize: nextProps.pagination.initialPageSize,
-      };
-
-      if (nextProps.items !== prevState.prevProps.items) {
-        Object.assign(derivedState, {
-          prevProps: {
-            items: nextProps.items,
-          },
-        });
-      }
-
-      const { sortName, sortDirection } = getInitialSorting(nextProps.columns, nextProps.sorting);
-      if (
-        sortName !== prevState.prevProps.sortName ||
-        sortDirection !== prevState.prevProps.sortDirection
-      ) {
-        Object.assign(derivedState, {
-          sortName,
-          sortDirection,
-        });
-      }
-      return derivedState;
-    }
-  };
-}
diff --git a/x-pack/plugins/ml/public/application/components/ml_in_memory_table/types.ts b/x-pack/plugins/ml/public/application/components/ml_in_memory_table/types.ts
deleted file mode 100644
index 05b941f2544b4..0000000000000
--- a/x-pack/plugins/ml/public/application/components/ml_in_memory_table/types.ts
+++ /dev/null
@@ -1,202 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { Component, HTMLAttributes, ReactElement, ReactNode } from 'react';
-
-import { Direction, CommonProps, EuiInMemoryTable } from '@elastic/eui';
-
-// Not using an enum here because the original HorizontalAlignment is also a union type of string.
-type HorizontalAlignment = 'left' | 'center' | 'right';
-
-type SortableFunc<T> = <T>(item: T) => any;
-type Sortable<T> = boolean | SortableFunc<T>;
-type DATA_TYPES = any;
-type FooterFunc = <T>(payload: { items: T[]; pagination: any }) => ReactNode;
-type RenderFunc = (value: any, record?: any) => ReactNode;
-export interface FieldDataColumnType<T> {
-  field: string;
-  name: ReactNode;
-  description?: string;
-  dataType?: DATA_TYPES;
-  width?: string;
-  sortable?: Sortable<T>;
-  align?: HorizontalAlignment;
-  truncateText?: boolean;
-  render?: RenderFunc;
-  footer?: string | ReactElement | FooterFunc;
-  textOnly?: boolean;
-  scope?: 'col' | 'row' | 'colgroup' | 'rowgroup';
-  'data-test-subj'?: string;
-}
-
-export interface ComputedColumnType<T> {
-  render: RenderFunc;
-  name?: ReactNode;
-  description?: string;
-  sortable?: (item: T) => any;
-  width?: string;
-  truncateText?: boolean;
-  'data-test-subj'?: string;
-}
-
-type ICON_TYPES = any;
-type IconTypesFunc<T> = (item: T) => ICON_TYPES; // (item) => oneOf(ICON_TYPES)
-type BUTTON_ICON_COLORS = any;
-type ButtonIconColorsFunc<T> = (item: T) => BUTTON_ICON_COLORS; // (item) => oneOf(ICON_BUTTON_COLORS)
-interface DefaultItemActionType<T> {
-  type?: 'icon' | 'button';
-  name: ReactNode;
-  description: string;
-  onClick?(item: T): void;
-  href?: string;
-  target?: string;
-  available?(item: T): boolean;
-  enabled?(item: T): boolean;
-  isPrimary?: boolean;
-  icon?: ICON_TYPES | IconTypesFunc<T>; // required when type is 'icon'
-  color?: BUTTON_ICON_COLORS | ButtonIconColorsFunc<T>;
-}
-
-interface CustomItemActionType<T> {
-  render(item: T, enabled: boolean): ReactNode;
-  available?(item: T): boolean;
-  enabled?(item: T): boolean;
-  isPrimary?: boolean;
-}
-
-export interface ExpanderColumnType<T> extends ComputedColumnType<T> {
-  align?: HorizontalAlignment;
-  isExpander: true;
-}
-
-type SupportedItemActionType<T> = DefaultItemActionType<T> | CustomItemActionType<T>;
-
-export interface ActionsColumnType<T> {
-  actions: Array<SupportedItemActionType<T>>;
-  name?: ReactNode;
-  description?: string;
-  width?: string;
-}
-
-export type ColumnType<T> =
-  | ActionsColumnType<T>
-  | ComputedColumnType<T>
-  | ExpanderColumnType<T>
-  | FieldDataColumnType<T>;
-
-type QueryType = any;
-
-interface Schema {
-  strict?: boolean;
-  fields?: Record<string, any>;
-  flags?: string[];
-}
-
-interface SearchBoxConfigPropTypes {
-  placeholder?: string;
-  incremental?: boolean;
-  schema?: Schema;
-}
-
-interface Box {
-  placeholder?: string;
-  incremental?: boolean;
-  // here we enable the user to just assign 'true' to the schema, in which case
-  // we will auto-generate it out of the columns configuration
-  schema?: boolean | SearchBoxConfigPropTypes['schema'];
-}
-
-type SearchFiltersFiltersType = any;
-
-interface ExecuteQueryOptions {
-  defaultFields: string[];
-  isClauseMatcher: () => void;
-  explain: boolean;
-}
-
-type SearchType =
-  | boolean
-  | {
-      toolsLeft?: ReactNode;
-      toolsRight?: ReactNode;
-      defaultQuery?: QueryType;
-      box?: Box;
-      filters?: SearchFiltersFiltersType;
-      onChange?: (arg: any) => void;
-      executeQueryOptions?: ExecuteQueryOptions;
-    };
-
-interface PageSizeOptions {
-  pageSizeOptions: number[];
-}
-interface InitialPageOptions extends PageSizeOptions {
-  initialPageIndex: number;
-  initialPageSize: number;
-}
-type PaginationProp = boolean | PageSizeOptions | InitialPageOptions;
-
-export enum SORT_DIRECTION {
-  ASC = 'asc',
-  DESC = 'desc',
-}
-export type SortDirection = SORT_DIRECTION.ASC | SORT_DIRECTION.DESC | 'asc' | 'desc';
-interface SortFields {
-  field: string;
-  direction: SortDirection | Direction;
-}
-export interface Sorting {
-  sort?: SortFields;
-}
-export type SortingPropType =
-  | boolean
-  | {
-      sort: SortFields;
-    };
-
-type SelectionType = any;
-
-export interface OnTableChangeArg extends Sorting {
-  page?: { index: number; size: number };
-}
-
-type ItemIdTypeFunc = <T>(item: T) => string;
-type ItemIdType =
-  | string // the name of the item id property
-  | ItemIdTypeFunc;
-
-export type EuiInMemoryTableProps<T> = CommonProps & {
-  columns: Array<ColumnType<T>>;
-  hasActions?: boolean;
-  isExpandable?: boolean;
-  isSelectable?: boolean;
-  items?: T[];
-  loading?: boolean;
-  message?: HTMLAttributes<HTMLDivElement>;
-  error?: string;
-  compressed?: boolean;
-  search?: SearchType;
-  pagination?: PaginationProp;
-  sorting?: SortingPropType;
-  // Set `allowNeutralSort` to false to force column sorting. Defaults to true.
-  allowNeutralSort?: boolean;
-  responsive?: boolean;
-  selection?: SelectionType;
-  itemId?: ItemIdType;
-  itemIdToExpandedRowMap?: Record<string, JSX.Element>;
-  rowProps?: (item: T) => void | Record<string, any>;
-  cellProps?: () => void | Record<string, any>;
-  onTableChange?: (arg: OnTableChangeArg) => void;
-};
-
-type EuiInMemoryTableType = typeof EuiInMemoryTable;
-
-interface ComponentWithConstructor<T> extends EuiInMemoryTableType {
-  new (): Component<T>;
-}
-
-export function mlInMemoryTableBasicFactory<T>() {
-  return EuiInMemoryTable as ComponentWithConstructor<EuiInMemoryTableProps<T>>;
-}
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/advanced_step/advanced_step_details.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/advanced_step/advanced_step_details.tsx
index 875590d0f9ee4..e7026508a90bb 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/advanced_step/advanced_step_details.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/advanced_step/advanced_step_details.tsx
@@ -249,7 +249,7 @@ export const AdvancedStepDetails: FC<{ setCurrentStep: any; state: State }> = ({
       <EuiTitle size="xs">
         <h3>
           {i18n.translate('xpack.ml.dataframe.analytics.create.hyperParametersDetailsTitle', {
-            defaultMessage: 'Hyper parameters',
+            defaultMessage: 'Hyperparameters',
           })}
         </h3>
       </EuiTitle>
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/advanced_step/advanced_step_form.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/advanced_step/advanced_step_form.tsx
index 11184afb0e715..7409e414af2b6 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/advanced_step/advanced_step_form.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/advanced_step/advanced_step_form.tsx
@@ -408,7 +408,7 @@ export const AdvancedStepForm: FC<CreateAnalyticsStepProps> = ({
           <EuiTitle size="xs">
             <h3>
               {i18n.translate('xpack.ml.dataframe.analytics.create.hyperParametersSectionTitle', {
-                defaultMessage: 'Hyper parameters',
+                defaultMessage: 'Hyperparameters',
               })}
             </h3>
           </EuiTitle>
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/analysis_fields_table.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/analysis_fields_table.tsx
index ff8797bc523c1..a229a79d316d7 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/analysis_fields_table.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/analysis_fields_table.tsx
@@ -172,6 +172,7 @@ export const AnalysisFieldsTable: FC<{
   return (
     <Fragment>
       <EuiFormRow
+        data-test-subj="mlAnalyticsCreateJobWizardIncludesTable"
         label={i18n.translate('xpack.ml.dataframe.analytics.create.includedFieldsLabel', {
           defaultMessage: 'Included fields',
         })}
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/job_type.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/job_type.tsx
index da547ee6255a1..1e5dbee3499bd 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/job_type.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/job_type.tsx
@@ -21,24 +21,21 @@ export const JobType: FC<Props> = ({ type, setFormState }) => {
   const outlierHelpText = i18n.translate(
     'xpack.ml.dataframe.analytics.create.outlierDetectionHelpText',
     {
-      defaultMessage:
-        'Outlier detection jobs require a source index that is mapped as a table-like data structure and analyze only numeric and boolean fields. Use the advanced editor to add custom options to the configuration.',
+      defaultMessage: 'Outlier detection identifies unusual data points in the data set.',
     }
   );
 
   const regressionHelpText = i18n.translate(
     'xpack.ml.dataframe.analytics.create.outlierRegressionHelpText',
     {
-      defaultMessage:
-        'Regression jobs analyze only numeric fields. Use the advanced editor to apply custom options, such as the prediction field name.',
+      defaultMessage: 'Regression predicts numerical values in the data set.',
     }
   );
 
   const classificationHelpText = i18n.translate(
     'xpack.ml.dataframe.analytics.create.classificationHelpText',
     {
-      defaultMessage:
-        'Classification jobs require a source index that is mapped as a table-like data structure and support fields that are numeric, boolean, text, keyword, or ip. Use the advanced editor to apply custom options, such as the prediction field name.',
+      defaultMessage: 'Classification predicts labels of data points in the data set.',
     }
   );
 
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/details_step/details_step_details.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/details_step/details_step_details.tsx
index 8a41eb4b8a865..fb08ea841d29e 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/details_step/details_step_details.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/details_step/details_step_details.tsx
@@ -75,7 +75,11 @@ export const DetailsStepDetails: FC<{ setCurrentStep: any; state: State }> = ({
           <EuiDescriptionList compressed listItems={detailsFirstCol} />
         </EuiFlexItem>
         <EuiFlexItem grow={false}>
-          <EuiDescriptionList compressed listItems={detailsSecondCol} />
+          <EuiDescriptionList
+            style={{ wordBreak: 'break-word' }}
+            compressed
+            listItems={detailsSecondCol}
+          />
         </EuiFlexItem>
         <EuiFlexItem grow={false}>
           <EuiDescriptionList compressed listItems={detailsThirdCol} />
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/details_step/details_step_form.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/details_step/details_step_form.tsx
index 168d5e31f57c3..8442ca13910d1 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/details_step/details_step_form.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/details_step/details_step_form.tsx
@@ -4,7 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React, { FC, Fragment, useRef } from 'react';
+import React, { FC, Fragment, useRef, useEffect } from 'react';
+import { debounce } from 'lodash';
 import {
   EuiFieldText,
   EuiFormRow,
@@ -21,6 +22,8 @@ import { CreateAnalyticsStepProps } from '../../../analytics_management/hooks/us
 import { JOB_ID_MAX_LENGTH } from '../../../../../../../common/constants/validation';
 import { ContinueButton } from '../continue_button';
 import { ANALYTICS_STEPS } from '../../page';
+import { ml } from '../../../../../services/ml_api_service';
+import { extractErrorMessage } from '../../../../../../../common/util/errors';
 
 export const DetailsStepForm: FC<CreateAnalyticsStepProps> = ({
   actions,
@@ -28,7 +31,7 @@ export const DetailsStepForm: FC<CreateAnalyticsStepProps> = ({
   setCurrentStep,
 }) => {
   const {
-    services: { docLinks },
+    services: { docLinks, notifications },
   } = useMlKibana();
   const { ELASTIC_WEBSITE_URL, DOC_LINK_VERSION } = docLinks;
 
@@ -59,6 +62,32 @@ export const DetailsStepForm: FC<CreateAnalyticsStepProps> = ({
     destinationIndexNameValid === false ||
     (destinationIndexPatternTitleExists === true && createIndexPattern === true);
 
+  const debouncedIndexCheck = debounce(async () => {
+    try {
+      const { exists } = await ml.checkIndexExists({ index: destinationIndex });
+      setFormState({ destinationIndexNameExists: exists });
+    } catch (e) {
+      notifications.toasts.addDanger(
+        i18n.translate('xpack.ml.dataframe.analytics.create.errorCheckingIndexExists', {
+          defaultMessage: 'The following error occurred getting the existing index names: {error}',
+          values: { error: extractErrorMessage(e) },
+        })
+      );
+    }
+  }, 400);
+
+  useEffect(() => {
+    if (destinationIndexNameValid === true) {
+      debouncedIndexCheck();
+    } else if (destinationIndex.trim() === '' && destinationIndexNameExists === true) {
+      setFormState({ destinationIndexNameExists: false });
+    }
+
+    return () => {
+      debouncedIndexCheck.cancel();
+    };
+  }, [destinationIndex]);
+
   return (
     <Fragment>
       <EuiFormRow
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_clone/clone_button.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_clone/clone_button.tsx
index 13f3805cdf613..6b99787a6c9a9 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_clone/clone_button.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_clone/clone_button.tsx
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { EuiButtonEmpty } from '@elastic/eui';
+import { EuiButtonEmpty, EuiToolTip } from '@elastic/eui';
 import React, { FC } from 'react';
 import { isEqual, cloneDeep } from 'lodash';
 import { i18n } from '@kbn/i18n';
@@ -20,7 +20,6 @@ import {
 } from '../../hooks/use_create_analytics_form';
 import { State } from '../../hooks/use_create_analytics_form/state';
 import { DataFrameAnalyticsListRow } from '../analytics_list/common';
-import { checkPermission } from '../../../../../capabilities/check_capabilities';
 import { extractErrorMessage } from '../../../../../../../common/util/errors';
 
 interface PropDefinition {
@@ -328,11 +327,11 @@ export function extractCloningConfig({
   }) as unknown) as CloneDataFrameAnalyticsConfig;
 }
 
-export function getCloneAction(createAnalyticsForm: CreateAnalyticsFormProps) {
-  const buttonText = i18n.translate('xpack.ml.dataframe.analyticsList.cloneJobButtonLabel', {
-    defaultMessage: 'Clone job',
-  });
+const buttonText = i18n.translate('xpack.ml.dataframe.analyticsList.cloneJobButtonLabel', {
+  defaultMessage: 'Clone job',
+});
 
+export function getCloneAction(createAnalyticsForm: CreateAnalyticsFormProps) {
   const { actions } = createAnalyticsForm;
 
   const onClick = async (item: DeepReadonly<DataFrameAnalyticsListRow>) => {
@@ -348,23 +347,7 @@ export function getCloneAction(createAnalyticsForm: CreateAnalyticsFormProps) {
   };
 }
 
-interface CloneButtonProps {
-  item: DataFrameAnalyticsListRow;
-  createAnalyticsForm: CreateAnalyticsFormProps;
-}
-
-/**
- * Temp component to have Clone job button with the same look as the other actions.
- * Replace with {@link getCloneAction} as soon as all the actions are refactored
- * to support EuiContext with a valid DOM structure without nested buttons.
- */
-export const CloneButton: FC<CloneButtonProps> = ({ createAnalyticsForm, item }) => {
-  const canCreateDataFrameAnalytics: boolean = checkPermission('canCreateDataFrameAnalytics');
-
-  const buttonText = i18n.translate('xpack.ml.dataframe.analyticsList.cloneJobButtonLabel', {
-    defaultMessage: 'Clone job',
-  });
-
+export const useNavigateToWizardWithClonedJob = () => {
   const {
     services: {
       application: { navigateToUrl },
@@ -375,7 +358,7 @@ export const CloneButton: FC<CloneButtonProps> = ({ createAnalyticsForm, item })
 
   const savedObjectsClient = savedObjects.client;
 
-  const onClick = async () => {
+  return async (item: DataFrameAnalyticsListRow) => {
     const sourceIndex = Array.isArray(item.config.source.index)
       ? item.config.source.index[0]
       : item.config.source.index;
@@ -419,18 +402,46 @@ export const CloneButton: FC<CloneButtonProps> = ({ createAnalyticsForm, item })
       );
     }
   };
+};
 
-  return (
+interface CloneButtonProps {
+  isDisabled: boolean;
+  onClick: () => void;
+}
+
+/**
+ * Temp component to have Clone job button with the same look as the other actions.
+ * Replace with {@link getCloneAction} as soon as all the actions are refactored
+ * to support EuiContext with a valid DOM structure without nested buttons.
+ */
+export const CloneButton: FC<CloneButtonProps> = ({ isDisabled, onClick }) => {
+  const button = (
     <EuiButtonEmpty
-      data-test-subj="mlAnalyticsJobCloneButton"
-      size="xs"
+      aria-label={buttonText}
       color="text"
+      data-test-subj="mlAnalyticsJobCloneButton"
+      flush="left"
       iconType="copy"
+      isDisabled={isDisabled}
       onClick={onClick}
-      aria-label={buttonText}
-      disabled={canCreateDataFrameAnalytics === false}
+      size="s"
     >
       {buttonText}
     </EuiButtonEmpty>
   );
+
+  if (isDisabled) {
+    return (
+      <EuiToolTip
+        position="top"
+        content={i18n.translate('xpack.ml.dataframe.analyticsList.cloneActionPermissionTooltip', {
+          defaultMessage: 'You do not have permission to clone analytics jobs.',
+        })}
+      >
+        {button}
+      </EuiToolTip>
+    );
+  }
+
+  return button;
 };
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_clone/index.ts b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_clone/index.ts
index b3d7189ff8cda..4e6357c4ea454 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_clone/index.ts
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_clone/index.ts
@@ -7,6 +7,7 @@
 export {
   extractCloningConfig,
   isAdvancedConfig,
+  useNavigateToWizardWithClonedJob,
   CloneButton,
   CloneDataFrameAnalyticsConfig,
 } from './clone_button';
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_delete/action_delete.test.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_delete/action_delete.test.tsx
index 6b745a2c5ff3b..99455a33cf084 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_delete/action_delete.test.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_delete/action_delete.test.tsx
@@ -49,37 +49,20 @@ describe('DeleteAction', () => {
     jest.clearAllMocks();
   });
 
-  test('When canDeleteDataFrameAnalytics permission is false, button should be disabled.', () => {
+  test('When isDisabled prop is true, inner button should be disabled.', () => {
     const { getByTestId } = render(
-      <DeleteButton item={mockAnalyticsListItem} onClick={() => {}} />
+      <DeleteButton isDisabled={true} item={mockAnalyticsListItem} onClick={() => {}} />
     );
+
     expect(getByTestId('mlAnalyticsJobDeleteButton')).toHaveAttribute('disabled');
   });
 
-  test('When canDeleteDataFrameAnalytics permission is true, button should not be disabled.', () => {
-    const mock = jest.spyOn(CheckPrivilige, 'checkPermission');
-    mock.mockImplementation((p) => p === 'canDeleteDataFrameAnalytics');
+  test('When isDisabled prop is true, inner button should not be disabled.', () => {
     const { getByTestId } = render(
-      <DeleteButton item={mockAnalyticsListItem} onClick={() => {}} />
+      <DeleteButton isDisabled={false} item={mockAnalyticsListItem} onClick={() => {}} />
     );
 
     expect(getByTestId('mlAnalyticsJobDeleteButton')).not.toHaveAttribute('disabled');
-
-    mock.mockRestore();
-  });
-
-  test('When job is running, delete button should be disabled.', () => {
-    const { getByTestId } = render(
-      <DeleteButton
-        item={{
-          ...mockAnalyticsListItem,
-          stats: { state: 'started' },
-        }}
-        onClick={() => {}}
-      />
-    );
-
-    expect(getByTestId('mlAnalyticsJobDeleteButton')).toHaveAttribute('disabled');
   });
 
   describe('When delete model is open', () => {
@@ -93,7 +76,11 @@ describe('DeleteAction', () => {
         return (
           <>
             {deleteAction.isModalVisible && <DeleteButtonModal {...deleteAction} />}
-            <DeleteButton item={mockAnalyticsListItem} onClick={deleteAction.openModal} />
+            <DeleteButton
+              isDisabled={false}
+              item={mockAnalyticsListItem}
+              onClick={() => deleteAction.openModal(mockAnalyticsListItem)}
+            />
           </>
         );
       };
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_delete/delete_button.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_delete/delete_button.tsx
index 7da3bced48576..c83fb6cbac387 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_delete/delete_button.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_delete/delete_button.tsx
@@ -6,46 +6,42 @@
 
 import React, { FC } from 'react';
 import { i18n } from '@kbn/i18n';
-import { EuiIcon, EuiLink, EuiToolTip } from '@elastic/eui';
-import {
-  checkPermission,
-  createPermissionFailureMessage,
-} from '../../../../../capabilities/check_capabilities';
+import { EuiButtonEmpty, EuiToolTip } from '@elastic/eui';
+import { createPermissionFailureMessage } from '../../../../../capabilities/check_capabilities';
 import { isDataFrameAnalyticsRunning, DataFrameAnalyticsListRow } from '../analytics_list/common';
 
+const buttonText = i18n.translate('xpack.ml.dataframe.analyticsList.deleteActionName', {
+  defaultMessage: 'Delete',
+});
+
 interface DeleteButtonProps {
+  isDisabled: boolean;
   item: DataFrameAnalyticsListRow;
-  onClick: (item: DataFrameAnalyticsListRow) => void;
+  onClick: () => void;
 }
 
-export const DeleteButton: FC<DeleteButtonProps> = ({ item, onClick }) => {
-  const disabled = isDataFrameAnalyticsRunning(item.stats.state);
-  const canDeleteDataFrameAnalytics: boolean = checkPermission('canDeleteDataFrameAnalytics');
-
-  const buttonDeleteText = i18n.translate('xpack.ml.dataframe.analyticsList.deleteActionName', {
-    defaultMessage: 'Delete',
-  });
-
-  const buttonDisabled = disabled || !canDeleteDataFrameAnalytics;
-  let deleteButton = (
-    <EuiLink
+export const DeleteButton: FC<DeleteButtonProps> = ({ isDisabled, item, onClick }) => {
+  const button = (
+    <EuiButtonEmpty
+      aria-label={buttonText}
+      color="text"
       data-test-subj="mlAnalyticsJobDeleteButton"
-      color={buttonDisabled ? 'subdued' : 'text'}
-      disabled={buttonDisabled}
-      onClick={buttonDisabled ? undefined : () => onClick(item)}
-      aria-label={buttonDeleteText}
-      style={{ padding: 0 }}
+      flush="left"
+      iconType="trash"
+      isDisabled={isDisabled}
+      onClick={onClick}
+      size="s"
     >
-      <EuiIcon type="trash" /> {buttonDeleteText}
-    </EuiLink>
+      {buttonText}
+    </EuiButtonEmpty>
   );
 
-  if (disabled || !canDeleteDataFrameAnalytics) {
-    deleteButton = (
+  if (isDisabled) {
+    return (
       <EuiToolTip
         position="top"
         content={
-          disabled
+          isDataFrameAnalyticsRunning(item.stats.state)
             ? i18n.translate(
                 'xpack.ml.dataframe.analyticsList.deleteActionDisabledToolTipContent',
                 {
@@ -55,10 +51,10 @@ export const DeleteButton: FC<DeleteButtonProps> = ({ item, onClick }) => {
             : createPermissionFailureMessage('canStartStopDataFrameAnalytics')
         }
       >
-        {deleteButton}
+        {button}
       </EuiToolTip>
     );
   }
 
-  return deleteButton;
+  return button;
 };
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_edit/edit_button.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_edit/edit_button.tsx
index 0acb215336faf..764b421821ad0 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_edit/edit_button.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_edit/edit_button.tsx
@@ -8,36 +8,34 @@ import React, { FC } from 'react';
 
 import { i18n } from '@kbn/i18n';
 
-import { EuiIcon, EuiLink, EuiToolTip } from '@elastic/eui';
+import { EuiButtonEmpty, EuiToolTip } from '@elastic/eui';
 
-import { checkPermission } from '../../../../../capabilities/check_capabilities';
+const buttonText = i18n.translate('xpack.ml.dataframe.analyticsList.editActionName', {
+  defaultMessage: 'Edit',
+});
 
 interface EditButtonProps {
+  isDisabled: boolean;
   onClick: () => void;
 }
 
-export const EditButton: FC<EditButtonProps> = ({ onClick }) => {
-  const canCreateDataFrameAnalytics: boolean = checkPermission('canCreateDataFrameAnalytics');
-
-  const buttonEditText = i18n.translate('xpack.ml.dataframe.analyticsList.editActionName', {
-    defaultMessage: 'Edit',
-  });
-
-  const buttonDisabled = !canCreateDataFrameAnalytics;
-  const editButton = (
-    <EuiLink
+export const EditButton: FC<EditButtonProps> = ({ isDisabled, onClick }) => {
+  const button = (
+    <EuiButtonEmpty
+      aria-label={buttonText}
+      color="text"
       data-test-subj="mlAnalyticsJobEditButton"
-      color={buttonDisabled ? 'subdued' : 'text'}
-      disabled={buttonDisabled}
-      onClick={buttonDisabled ? undefined : onClick}
-      aria-label={buttonEditText}
-      style={{ padding: 0 }}
+      flush="left"
+      iconType="pencil"
+      isDisabled={isDisabled}
+      onClick={onClick}
+      size="s"
     >
-      <EuiIcon type="pencil" /> {buttonEditText}
-    </EuiLink>
+      {buttonText}
+    </EuiButtonEmpty>
   );
 
-  if (!canCreateDataFrameAnalytics) {
+  if (isDisabled) {
     return (
       <EuiToolTip
         position="top"
@@ -45,10 +43,10 @@ export const EditButton: FC<EditButtonProps> = ({ onClick }) => {
           defaultMessage: 'You do not have permission to edit analytics jobs.',
         })}
       >
-        {editButton}
+        {button}
       </EuiToolTip>
     );
   }
 
-  return editButton;
+  return button;
 };
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_start/start_button.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_start/start_button.tsx
index 279a335de8f42..3192a30f8312e 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_start/start_button.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_start/start_button.tsx
@@ -6,45 +6,46 @@
 
 import React, { FC } from 'react';
 import { i18n } from '@kbn/i18n';
-import { EuiIcon, EuiLink, EuiToolTip } from '@elastic/eui';
+import { EuiButtonEmpty, EuiToolTip } from '@elastic/eui';
 
-import {
-  checkPermission,
-  createPermissionFailureMessage,
-} from '../../../../../capabilities/check_capabilities';
+import { createPermissionFailureMessage } from '../../../../../capabilities/check_capabilities';
 
-import { DataFrameAnalyticsListRow, isCompletedAnalyticsJob } from '../analytics_list/common';
+import { DataFrameAnalyticsListRow } from '../analytics_list/common';
+
+const buttonText = i18n.translate('xpack.ml.dataframe.analyticsList.startActionName', {
+  defaultMessage: 'Start',
+});
 
 interface StartButtonProps {
+  canStartStopDataFrameAnalytics: boolean;
+  isDisabled: boolean;
   item: DataFrameAnalyticsListRow;
-  onClick: (item: DataFrameAnalyticsListRow) => void;
+  onClick: () => void;
 }
 
-export const StartButton: FC<StartButtonProps> = ({ item, onClick }) => {
-  const canStartStopDataFrameAnalytics: boolean = checkPermission('canStartStopDataFrameAnalytics');
-
-  const buttonStartText = i18n.translate('xpack.ml.dataframe.analyticsList.startActionName', {
-    defaultMessage: 'Start',
-  });
-
-  // Disable start for analytics jobs which have completed.
-  const completeAnalytics = isCompletedAnalyticsJob(item.stats);
-
-  const disabled = !canStartStopDataFrameAnalytics || completeAnalytics;
-
-  let startButton = (
-    <EuiLink
-      color={disabled ? 'subdued' : 'text'}
-      onClick={disabled ? undefined : () => onClick(item)}
-      aria-label={buttonStartText}
+export const StartButton: FC<StartButtonProps> = ({
+  canStartStopDataFrameAnalytics,
+  isDisabled,
+  item,
+  onClick,
+}) => {
+  const button = (
+    <EuiButtonEmpty
+      aria-label={buttonText}
+      color="text"
       data-test-subj="mlAnalyticsJobStartButton"
+      flush="left"
+      iconType="play"
+      isDisabled={isDisabled}
+      onClick={onClick}
+      size="s"
     >
-      <EuiIcon type="play" /> {buttonStartText}
-    </EuiLink>
+      {buttonText}
+    </EuiButtonEmpty>
   );
 
-  if (!canStartStopDataFrameAnalytics || completeAnalytics) {
-    startButton = (
+  if (isDisabled) {
+    return (
       <EuiToolTip
         position="top"
         content={
@@ -57,10 +58,10 @@ export const StartButton: FC<StartButtonProps> = ({ item, onClick }) => {
               })
         }
       >
-        {startButton}
+        {button}
       </EuiToolTip>
     );
   }
 
-  return startButton;
+  return button;
 };
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_stop/stop_button.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_stop/stop_button.tsx
index b8395f2f7c2a0..a3e8f16daf5ef 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_stop/stop_button.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_stop/stop_button.tsx
@@ -9,49 +9,46 @@ import { i18n } from '@kbn/i18n';
 
 import { EuiButtonEmpty, EuiToolTip } from '@elastic/eui';
 
-import {
-  checkPermission,
-  createPermissionFailureMessage,
-} from '../../../../../capabilities/check_capabilities';
-
-import { stopAnalytics } from '../../services/analytics_service';
+import { createPermissionFailureMessage } from '../../../../../capabilities/check_capabilities';
 
 import { DataFrameAnalyticsListRow } from '../analytics_list/common';
 
-const buttonStopText = i18n.translate('xpack.ml.dataframe.analyticsList.stopActionName', {
+const buttonText = i18n.translate('xpack.ml.dataframe.analyticsList.stopActionName', {
   defaultMessage: 'Stop',
 });
 
 interface StopButtonProps {
+  isDisabled: boolean;
   item: DataFrameAnalyticsListRow;
+  onClick: () => void;
 }
 
-export const StopButton: FC<StopButtonProps> = ({ item }) => {
-  const canStartStopDataFrameAnalytics: boolean = checkPermission('canStartStopDataFrameAnalytics');
-
-  const stopButton = (
+export const StopButton: FC<StopButtonProps> = ({ isDisabled, item, onClick }) => {
+  const button = (
     <EuiButtonEmpty
-      size="xs"
+      aria-label={buttonText}
       color="text"
-      disabled={!canStartStopDataFrameAnalytics}
-      iconType="stop"
-      onClick={() => stopAnalytics(item)}
-      aria-label={buttonStopText}
       data-test-subj="mlAnalyticsJobStopButton"
+      flush="left"
+      iconType="stop"
+      isDisabled={isDisabled}
+      onClick={onClick}
+      size="s"
     >
-      {buttonStopText}
+      {buttonText}
     </EuiButtonEmpty>
   );
-  if (!canStartStopDataFrameAnalytics) {
+
+  if (isDisabled) {
     return (
       <EuiToolTip
         position="top"
         content={createPermissionFailureMessage('canStartStopDataFrameAnalytics')}
       >
-        {stopButton}
+        {button}
       </EuiToolTip>
     );
   }
 
-  return stopButton;
+  return button;
 };
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_view/view_button.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_view/view_button.tsx
index 17a18c374dfa6..52b2513d13e39 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_view/view_button.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_view/view_button.tsx
@@ -6,7 +6,7 @@
 
 import React, { FC } from 'react';
 import { i18n } from '@kbn/i18n';
-import { EuiButtonEmpty } from '@elastic/eui';
+import { EuiButtonEmpty, EuiToolTip } from '@elastic/eui';
 
 import {
   getAnalysisType,
@@ -31,7 +31,7 @@ export const ViewButton: FC<ViewButtonProps> = ({ item, isManagementTable }) =>
   } = useMlKibana();
 
   const analysisType = getAnalysisType(item.config.analysis);
-  const isDisabled =
+  const buttonDisabled =
     !isRegressionAnalysis(item.config.analysis) &&
     !isOutlierAnalysis(item.config.analysis) &&
     !isClassificationAnalysis(item.config.analysis);
@@ -41,21 +41,38 @@ export const ViewButton: FC<ViewButtonProps> = ({ item, isManagementTable }) =>
     ? () => navigateToApp('ml', { path: url })
     : () => navigateToUrl(url);
 
-  return (
+  const buttonText = i18n.translate('xpack.ml.dataframe.analyticsList.viewActionName', {
+    defaultMessage: 'View',
+  });
+
+  const button = (
     <EuiButtonEmpty
-      isDisabled={isDisabled}
-      onClick={navigator}
-      size="xs"
+      aria-label={buttonText}
       color="text"
-      iconType="visTable"
-      aria-label={i18n.translate('xpack.ml.dataframe.analyticsList.viewAriaLabel', {
-        defaultMessage: 'View',
-      })}
       data-test-subj="mlAnalyticsJobViewButton"
+      flush="left"
+      iconType="visTable"
+      isDisabled={buttonDisabled}
+      onClick={navigator}
+      size="s"
     >
-      {i18n.translate('xpack.ml.dataframe.analyticsList.viewActionName', {
-        defaultMessage: 'View',
-      })}
+      {buttonText}
     </EuiButtonEmpty>
   );
+
+  if (buttonDisabled) {
+    return (
+      <EuiToolTip
+        position="top"
+        content={i18n.translate('xpack.ml.dataframe.analyticsList.viewActionToolTipContent', {
+          defaultMessage:
+            'There is no results page available for this type of data frame analytics job.',
+        })}
+      >
+        {button}
+      </EuiToolTip>
+    );
+  }
+
+  return button;
 };
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/_analytics_table.scss b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/_analytics_table.scss
index 4472e6dbf64f3..f8071c9210f9c 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/_analytics_table.scss
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/_analytics_table.scss
@@ -17,9 +17,6 @@
     animation: none !important;
   }
 }
-.mlAnalyticsProgressBar {
-  margin-bottom: $euiSizeM;
-}
 
 .mlTaskStateBadge, .mlTaskModeBadge {
   max-width: 100px;
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/analytics_list.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/analytics_list.tsx
index 4080f6cd7a77e..7b5c714c236b3 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/analytics_list.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/analytics_list.tsx
@@ -9,17 +9,18 @@ import React, { FC, useState, useEffect } from 'react';
 import { i18n } from '@kbn/i18n';
 
 import {
+  Direction,
   EuiButtonEmpty,
   EuiCallOut,
   EuiEmptyPrompt,
   EuiFlexGroup,
   EuiFlexItem,
+  EuiInMemoryTable,
+  EuiSearchBarProps,
   EuiSpacer,
-  EuiSearchBar,
 } from '@elastic/eui';
 
 import {
-  getAnalysisType,
   DataFrameAnalyticsId,
   useRefreshAnalyticsList,
   ANALYSIS_CONFIG_TYPE,
@@ -31,25 +32,12 @@ import {
   DataFrameAnalyticsListRow,
   ItemIdToExpandedRowMap,
   DATA_FRAME_TASK_STATE,
-  Query,
-  Clause,
-  TermClause,
-  FieldClause,
 } from './common';
 import { getAnalyticsFactory } from '../../services/analytics_service';
 import { getTaskStateBadge, getJobTypeBadge, useColumns } from './use_columns';
 import { ExpandedRow } from './expanded_row';
-import { stringMatch } from '../../../../../util/string_utils';
-import {
-  ProgressBar,
-  mlInMemoryTableFactory,
-  OnTableChangeArg,
-  SortDirection,
-  SORT_DIRECTION,
-} from '../../../../../components/ml_in_memory_table';
 import { AnalyticStatsBarStats, StatsBar } from '../../../../../components/stats_bar';
 import { CreateAnalyticsButton } from '../create_analytics_button';
-import { CreateAnalyticsFormProps } from '../../hooks/use_create_analytics_form';
 import { getSelectedJobIdFromUrl } from '../../../../../jobs/jobs_list/components/utils';
 import { SourceSelection } from '../source_selection';
 
@@ -66,32 +54,26 @@ function getItemIdToExpandedRowMap(
   }, {} as ItemIdToExpandedRowMap);
 }
 
-const MlInMemoryTable = mlInMemoryTableFactory<DataFrameAnalyticsListRow>();
-
 interface Props {
   isManagementTable?: boolean;
   isMlEnabledInSpace?: boolean;
   blockRefresh?: boolean;
-  createAnalyticsForm?: CreateAnalyticsFormProps;
 }
 export const DataFrameAnalyticsList: FC<Props> = ({
   isManagementTable = false,
   isMlEnabledInSpace = true,
   blockRefresh = false,
-  createAnalyticsForm,
 }) => {
   const [isInitialized, setIsInitialized] = useState(false);
   const [isSourceIndexModalVisible, setIsSourceIndexModalVisible] = useState(false);
   const [isLoading, setIsLoading] = useState(false);
-  const [filterActive, setFilterActive] = useState(false);
 
-  const [queryText, setQueryText] = useState('');
+  const [searchQueryText, setSearchQueryText] = useState('');
 
   const [analytics, setAnalytics] = useState<DataFrameAnalyticsListRow[]>([]);
   const [analyticsStats, setAnalyticsStats] = useState<AnalyticStatsBarStats | undefined>(
     undefined
   );
-  const [filteredAnalytics, setFilteredAnalytics] = useState<DataFrameAnalyticsListRow[]>([]);
   const [expandedRowItemIds, setExpandedRowItemIds] = useState<DataFrameAnalyticsId[]>([]);
 
   const [errorMessage, setErrorMessage] = useState<any>(undefined);
@@ -101,9 +83,8 @@ export const DataFrameAnalyticsList: FC<Props> = ({
   const [pageSize, setPageSize] = useState(10);
 
   const [sortField, setSortField] = useState<string>(DataFrameAnalyticsListColumn.id);
-  const [sortDirection, setSortDirection] = useState<SortDirection>(SORT_DIRECTION.ASC);
+  const [sortDirection, setSortDirection] = useState<Direction>('asc');
 
-  const [jobIdSelected, setJobIdSelected] = useState<boolean>(false);
   const disabled =
     !checkPermission('canCreateDataFrameAnalytics') ||
     !checkPermission('canStartStopDataFrameAnalytics');
@@ -117,18 +98,17 @@ export const DataFrameAnalyticsList: FC<Props> = ({
   );
 
   // Query text/job_id based on url but only after getAnalytics is done first
-  // jobIdSelected makes sure the query is only run once since analytics is being refreshed constantly
-  const selectedId = getSelectedJobIdFromUrl(window.location.href);
+  // selectedJobIdFromUrlInitialized makes sure the query is only run once since analytics is being refreshed constantly
+  const [selectedJobIdFromUrlInitialized, setSelectedJobIdFromUrlInitialized] = useState(false);
   useEffect(() => {
-    if (jobIdSelected === false && analytics.length > 0) {
-      if (selectedId !== undefined) {
-        setJobIdSelected(true);
-        setQueryText(selectedId);
-        const selectedIdQuery: Query = EuiSearchBar.Query.parse(selectedId);
-        onQueryChange({ query: selectedIdQuery, error: undefined });
+    if (selectedJobIdFromUrlInitialized === false && analytics.length > 0) {
+      const selectedJobIdFromUrl = getSelectedJobIdFromUrl(window.location.href);
+      if (selectedJobIdFromUrl !== undefined) {
+        setSelectedJobIdFromUrlInitialized(true);
+        setSearchQueryText(selectedJobIdFromUrl);
       }
     }
-  }, [jobIdSelected, analytics]);
+  }, [selectedJobIdFromUrlInitialized, analytics]);
 
   // Subscribe to the refresh observable to trigger reloading the analytics list.
   useRefreshAnalyticsList({
@@ -136,129 +116,36 @@ export const DataFrameAnalyticsList: FC<Props> = ({
     onRefresh: () => getAnalytics(true),
   });
 
-  const onQueryChange = ({ query, error }: { query: Query; error: any }) => {
-    if (error) {
-      setSearchError(error.message);
-    } else {
-      let clauses: Clause[] = [];
-      if (query && query.ast !== undefined && query.ast.clauses !== undefined) {
-        clauses = query.ast.clauses;
-      }
-      if (clauses.length > 0) {
-        setQueryText(query.text);
-        setFilterActive(true);
-        filterAnalytics(clauses as Array<TermClause | FieldClause>);
-      } else {
-        setFilterActive(false);
-      }
-      setSearchError(undefined);
-    }
-  };
-
-  const filterAnalytics = (clauses: Array<TermClause | FieldClause>) => {
-    setIsLoading(true);
-    // keep count of the number of matches we make as we're looping over the clauses
-    // we only want to return analytics which match all clauses, i.e. each search term is ANDed
-    // { analytics-one:  { analytics: { id: analytics-one, config: {}, state: {}, ... }, count: 0 }, analytics-two: {...} }
-    const matches: Record<string, any> = analytics.reduce((p: Record<string, any>, c) => {
-      p[c.id] = {
-        analytics: c,
-        count: 0,
-      };
-      return p;
-    }, {});
-
-    clauses.forEach((c) => {
-      // the search term could be negated with a minus, e.g. -bananas
-      const bool = c.match === 'must';
-      let ts: DataFrameAnalyticsListRow[];
-
-      if (c.type === 'term') {
-        // filter term based clauses, e.g. bananas
-        // match on id and description
-        // if the term has been negated, AND the matches
-        if (bool === true) {
-          ts = analytics.filter(
-            (d) => stringMatch(d.id, c.value) === bool // ||
-            // stringMatch(d.config.description, c.value) === bool
-          );
-        } else {
-          ts = analytics.filter(
-            (d) => stringMatch(d.id, c.value) === bool // &&
-            // stringMatch(d.config.description, c.value) === bool
-          );
-        }
-      } else {
-        // filter other clauses, i.e. the mode and status filters
-        if (Array.isArray(c.value)) {
-          if (c.field === 'job_type') {
-            ts = analytics.filter((d) =>
-              (c.value as string).includes(getAnalysisType(d.config.analysis))
-            );
-          } else {
-            // the status value is an array of string(s) e.g. ['failed', 'stopped']
-            ts = analytics.filter((d) => (c.value as string).includes(d.stats.state));
-          }
-        } else {
-          ts = analytics.filter((d) => d.mode === c.value);
-        }
-      }
-
-      ts.forEach((t) => matches[t.id].count++);
-    });
-
-    // loop through the matches and return only analytics which have match all the clauses
-    const filtered = Object.values(matches)
-      .filter((m) => (m && m.count) >= clauses.length)
-      .map((m) => m.analytics);
-
-    let pageStart = pageIndex * pageSize;
-    if (pageStart >= filtered.length && filtered.length !== 0) {
-      // if the page start is larger than the number of items due to
-      // filters being applied, calculate a new page start
-      pageStart = Math.floor((filtered.length - 1) / pageSize) * pageSize;
-      setPageIndex(pageStart / pageSize);
-    }
-
-    setFilteredAnalytics(filtered);
-    setIsLoading(false);
-  };
-
   const { columns, modals } = useColumns(
     expandedRowItemIds,
     setExpandedRowItemIds,
     isManagementTable,
-    isMlEnabledInSpace,
-    createAnalyticsForm
+    isMlEnabledInSpace
   );
 
   // Before the analytics have been loaded for the first time, display the loading indicator only.
   // Otherwise a user would see 'No data frame analytics found' during the initial loading.
   if (!isInitialized) {
-    return <ProgressBar isLoading={isLoading} />;
+    return null;
   }
 
   if (typeof errorMessage !== 'undefined') {
     return (
-      <>
-        <ProgressBar isLoading={isLoading} />
-        <EuiCallOut
-          title={i18n.translate('xpack.ml.dataFrame.analyticsList.errorPromptTitle', {
-            defaultMessage: 'An error occurred getting the data frame analytics list.',
-          })}
-          color="danger"
-          iconType="alert"
-        >
-          <pre>{JSON.stringify(errorMessage)}</pre>
-        </EuiCallOut>
-      </>
+      <EuiCallOut
+        title={i18n.translate('xpack.ml.dataFrame.analyticsList.errorPromptTitle', {
+          defaultMessage: 'An error occurred getting the data frame analytics list.',
+        })}
+        color="danger"
+        iconType="alert"
+      >
+        <pre>{JSON.stringify(errorMessage)}</pre>
+      </EuiCallOut>
     );
   }
 
   if (analytics.length === 0) {
     return (
       <>
-        <ProgressBar isLoading={isLoading} />
         <EuiEmptyPrompt
           title={
             <h2>
@@ -268,7 +155,7 @@ export const DataFrameAnalyticsList: FC<Props> = ({
             </h2>
           }
           actions={
-            !isManagementTable && createAnalyticsForm
+            !isManagementTable
               ? [
                   <EuiButtonEmpty
                     onClick={() => setIsSourceIndexModalVisible(true)}
@@ -308,9 +195,20 @@ export const DataFrameAnalyticsList: FC<Props> = ({
     hidePerPageOptions: false,
   };
 
-  const search = {
-    query: queryText,
-    onChange: onQueryChange,
+  const handleSearchOnChange: EuiSearchBarProps['onChange'] = (search) => {
+    if (search.error !== null) {
+      setSearchError(search.error.message);
+      return false;
+    }
+
+    setSearchError(undefined);
+    setSearchQueryText(search.queryText);
+    return true;
+  };
+
+  const search: EuiSearchBarProps = {
+    query: searchQueryText,
+    onChange: handleSearchOnChange,
     box: {
       incremental: true,
     },
@@ -330,7 +228,7 @@ export const DataFrameAnalyticsList: FC<Props> = ({
       },
       {
         type: 'field_value_selection',
-        field: 'state.state',
+        field: 'state',
         name: i18n.translate('xpack.ml.dataframe.analyticsList.statusFilter', {
           defaultMessage: 'Status',
         }),
@@ -344,10 +242,10 @@ export const DataFrameAnalyticsList: FC<Props> = ({
     ],
   };
 
-  const onTableChange = ({
+  const onTableChange: EuiInMemoryTable<DataFrameAnalyticsListRow>['onTableChange'] = ({
     page = { index: 0, size: 10 },
-    sort = { field: DataFrameAnalyticsListColumn.id, direction: SORT_DIRECTION.ASC },
-  }: OnTableChangeArg) => {
+    sort = { field: DataFrameAnalyticsListColumn.id, direction: 'asc' },
+  }) => {
     const { index, size } = page;
     setPageIndex(index);
     setPageSize(size);
@@ -370,10 +268,10 @@ export const DataFrameAnalyticsList: FC<Props> = ({
         </EuiFlexItem>
         <EuiFlexItem grow={false}>
           <EuiFlexGroup alignItems="center" gutterSize="s">
-            {!isManagementTable && createAnalyticsForm && (
+            {!isManagementTable && (
               <EuiFlexItem grow={false}>
                 <CreateAnalyticsButton
-                  {...createAnalyticsForm}
+                  isDisabled={disabled}
                   setIsSourceIndexModalVisible={setIsSourceIndexModalVisible}
                 />
               </EuiFlexItem>
@@ -383,7 +281,7 @@ export const DataFrameAnalyticsList: FC<Props> = ({
       </EuiFlexGroup>
       <EuiSpacer size="m" />
       <div data-test-subj="mlAnalyticsTableContainer">
-        <MlInMemoryTable
+        <EuiInMemoryTable
           allowNeutralSort={false}
           className="mlAnalyticsTable"
           columns={columns}
@@ -391,9 +289,10 @@ export const DataFrameAnalyticsList: FC<Props> = ({
           hasActions={false}
           isExpandable={true}
           isSelectable={false}
-          items={filterActive ? filteredAnalytics : analytics}
+          items={analytics}
           itemId={DataFrameAnalyticsListColumn.id}
           itemIdToExpandedRowMap={itemIdToExpandedRowMap}
+          loading={isLoading}
           onTableChange={onTableChange}
           pagination={pagination}
           sorting={sorting}
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/common.ts b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/common.ts
index 5998c62eeacea..e2d9ecccf0626 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/common.ts
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/common.ts
@@ -9,7 +9,11 @@ import { Query, Ast } from '@elastic/eui';
 import { DATA_FRAME_TASK_STATE } from './data_frame_task_state';
 export { DATA_FRAME_TASK_STATE };
 
-import { DataFrameAnalyticsId, DataFrameAnalyticsConfig } from '../../../../common';
+import {
+  DataFrameAnalyticsId,
+  DataFrameAnalyticsConfig,
+  ANALYSIS_CONFIG_TYPE,
+} from '../../../../common';
 
 export enum DATA_FRAME_MODE {
   BATCH = 'batch',
@@ -98,10 +102,15 @@ export function getDataFrameAnalyticsProgressPhase(
 }
 
 export interface DataFrameAnalyticsListRow {
-  id: DataFrameAnalyticsId;
   checkpointing: object;
   config: DataFrameAnalyticsConfig;
+  id: DataFrameAnalyticsId;
+  job_type:
+    | ANALYSIS_CONFIG_TYPE.CLASSIFICATION
+    | ANALYSIS_CONFIG_TYPE.OUTLIER_DETECTION
+    | ANALYSIS_CONFIG_TYPE.REGRESSION;
   mode: string;
+  state: DataFrameAnalyticsStats['state'];
   stats: DataFrameAnalyticsStats;
 }
 
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/use_actions.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/use_actions.tsx
index cb46a88fa3b21..bc02c81bac0f0 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/use_actions.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/use_actions.tsx
@@ -8,8 +8,11 @@ import React from 'react';
 
 import { EuiTableActionsColumnType } from '@elastic/eui';
 
-import { CreateAnalyticsFormProps } from '../../hooks/use_create_analytics_form';
-import { CloneButton } from '../action_clone';
+import { checkPermission } from '../../../../../capabilities/check_capabilities';
+
+import { stopAnalytics } from '../../services/analytics_service';
+
+import { useNavigateToWizardWithClonedJob, CloneButton } from '../action_clone';
 import { useDeleteAction, DeleteButton, DeleteButtonModal } from '../action_delete';
 import {
   isEditActionFlyoutVisible,
@@ -21,15 +24,22 @@ import { useStartAction, StartButton, StartButtonModal } from '../action_start';
 import { StopButton } from '../action_stop';
 import { getViewAction } from '../action_view';
 
-import { isDataFrameAnalyticsRunning, DataFrameAnalyticsListRow } from './common';
+import {
+  isCompletedAnalyticsJob,
+  isDataFrameAnalyticsRunning,
+  DataFrameAnalyticsListRow,
+} from './common';
 
 export const useActions = (
-  createAnalyticsForm: CreateAnalyticsFormProps,
   isManagementTable: boolean
 ): {
   actions: EuiTableActionsColumnType<DataFrameAnalyticsListRow>['actions'];
   modals: JSX.Element | null;
 } => {
+  const canCreateDataFrameAnalytics: boolean = checkPermission('canCreateDataFrameAnalytics');
+  const canDeleteDataFrameAnalytics: boolean = checkPermission('canDeleteDataFrameAnalytics');
+  const canStartStopDataFrameAnalytics: boolean = checkPermission('canStartStopDataFrameAnalytics');
+
   let modals: JSX.Element | null = null;
 
   const actions: EuiTableActionsColumnType<DataFrameAnalyticsListRow>['actions'] = [
@@ -52,29 +62,93 @@ export const useActions = (
         {isEditActionFlyoutVisible(editAction) && <EditButtonFlyout {...editAction} />}
       </>
     );
+
+    const startButtonEnabled = (item: DataFrameAnalyticsListRow) => {
+      if (!isDataFrameAnalyticsRunning(item.stats.state)) {
+        // Disable start for analytics jobs which have completed.
+        const completeAnalytics = isCompletedAnalyticsJob(item.stats);
+        return canStartStopDataFrameAnalytics && !completeAnalytics;
+      }
+      return canStartStopDataFrameAnalytics;
+    };
+
+    const navigateToWizardWithClonedJob = useNavigateToWizardWithClonedJob();
+
     actions.push(
       ...[
         {
           render: (item: DataFrameAnalyticsListRow) => {
             if (!isDataFrameAnalyticsRunning(item.stats.state)) {
-              return <StartButton item={item} onClick={startAction.openModal} />;
+              return (
+                <StartButton
+                  canStartStopDataFrameAnalytics={canStartStopDataFrameAnalytics}
+                  isDisabled={!startButtonEnabled(item)}
+                  item={item}
+                  onClick={() => {
+                    if (startButtonEnabled(item)) {
+                      startAction.openModal(item);
+                    }
+                  }}
+                />
+              );
             }
-            return <StopButton item={item} />;
+
+            return (
+              <StopButton
+                isDisabled={!canStartStopDataFrameAnalytics}
+                item={item}
+                onClick={() => {
+                  if (canStartStopDataFrameAnalytics) {
+                    stopAnalytics(item);
+                  }
+                }}
+              />
+            );
           },
         },
         {
           render: (item: DataFrameAnalyticsListRow) => {
-            return <EditButton onClick={() => editAction.openFlyout(item)} />;
+            return (
+              <EditButton
+                isDisabled={!canStartStopDataFrameAnalytics}
+                onClick={() => {
+                  if (canStartStopDataFrameAnalytics) {
+                    editAction.openFlyout(item);
+                  }
+                }}
+              />
+            );
           },
         },
         {
           render: (item: DataFrameAnalyticsListRow) => {
-            return <DeleteButton item={item} onClick={deleteAction.openModal} />;
+            return (
+              <DeleteButton
+                isDisabled={
+                  isDataFrameAnalyticsRunning(item.stats.state) || !canDeleteDataFrameAnalytics
+                }
+                item={item}
+                onClick={() => {
+                  if (canStartStopDataFrameAnalytics) {
+                    deleteAction.openModal(item);
+                  }
+                }}
+              />
+            );
           },
         },
         {
           render: (item: DataFrameAnalyticsListRow) => {
-            return <CloneButton item={item} createAnalyticsForm={createAnalyticsForm} />;
+            return (
+              <CloneButton
+                isDisabled={!canCreateDataFrameAnalytics}
+                onClick={() => {
+                  if (canCreateDataFrameAnalytics) {
+                    navigateToWizardWithClonedJob(item);
+                  }
+                }}
+              />
+            );
           },
         },
       ]
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/use_columns.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/use_columns.tsx
index fa88396461cd7..123fdada44866 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/use_columns.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/use_columns.tsx
@@ -22,7 +22,6 @@ import {
 import { getJobIdUrl } from '../../../../../util/get_job_id_url';
 
 import { getAnalysisType, DataFrameAnalyticsId } from '../../../../common';
-import { CreateAnalyticsFormProps } from '../../hooks/use_create_analytics_form';
 import {
   getDataFrameAnalyticsProgress,
   getDataFrameAnalyticsProgressPhase,
@@ -145,10 +144,9 @@ export const useColumns = (
   expandedRowItemIds: DataFrameAnalyticsId[],
   setExpandedRowItemIds: React.Dispatch<React.SetStateAction<DataFrameAnalyticsId[]>>,
   isManagementTable: boolean = false,
-  isMlEnabledInSpace: boolean = true,
-  createAnalyticsForm?: CreateAnalyticsFormProps
+  isMlEnabledInSpace: boolean = true
 ) => {
-  const { actions, modals } = useActions(createAnalyticsForm!, isManagementTable);
+  const { actions, modals } = useActions(isManagementTable);
 
   function toggleDetails(item: DataFrameAnalyticsListRow) {
     const index = expandedRowItemIds.indexOf(item.config.id);
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/create_analytics_button/create_analytics_button.test.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/create_analytics_button/create_analytics_button.test.tsx
index b438a3f006c6c..0597f377d2710 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/create_analytics_button/create_analytics_button.test.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/create_analytics_button/create_analytics_button.test.tsx
@@ -6,37 +6,15 @@
 
 import { mount } from 'enzyme';
 import React from 'react';
-import { mountHook } from 'test_utils/enzyme_helpers';
 
 import { CreateAnalyticsButton } from './create_analytics_button';
 
-import { MlContext } from '../../../../../contexts/ml';
-import { kibanaContextValueMock } from '../../../../../contexts/ml/__mocks__/kibana_context_value';
-
-import { useCreateAnalyticsForm } from '../../hooks/use_create_analytics_form';
-
-const getMountedHook = () =>
-  mountHook(
-    () => useCreateAnalyticsForm(),
-    ({ children }) => (
-      <MlContext.Provider value={kibanaContextValueMock}>{children}</MlContext.Provider>
-    )
-  );
-
-// workaround to make React.memo() work with enzyme
-jest.mock('react', () => {
-  const r = jest.requireActual('react');
-  return { ...r, memo: (x: any) => x };
-});
-
 jest.mock('../../../../../../../shared_imports');
 
 describe('Data Frame Analytics: <CreateAnalyticsButton />', () => {
   test('Minimal initialization', () => {
-    const { getLastHookValue } = getMountedHook();
-    const props = getLastHookValue();
     const wrapper = mount(
-      <CreateAnalyticsButton {...props} setIsSourceIndexModalVisible={jest.fn()} />
+      <CreateAnalyticsButton isDisabled={false} setIsSourceIndexModalVisible={jest.fn()} />
     );
 
     expect(wrapper.find('EuiButton').text()).toBe('Create job');
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/create_analytics_button/create_analytics_button.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/create_analytics_button/create_analytics_button.tsx
index c7c33787c37bc..e05684b23167c 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/create_analytics_button/create_analytics_button.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/create_analytics_button/create_analytics_button.tsx
@@ -8,26 +8,20 @@ import React, { FC } from 'react';
 import { EuiButton, EuiToolTip } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { createPermissionFailureMessage } from '../../../../../capabilities/check_capabilities';
-import { CreateAnalyticsFormProps } from '../../hooks/use_create_analytics_form';
 
-interface Props extends CreateAnalyticsFormProps {
+interface Props {
+  isDisabled: boolean;
   setIsSourceIndexModalVisible: React.Dispatch<React.SetStateAction<any>>;
 }
 
-export const CreateAnalyticsButton: FC<Props> = ({
-  state,
-  actions,
-  setIsSourceIndexModalVisible,
-}) => {
-  const { disabled } = state;
-
+export const CreateAnalyticsButton: FC<Props> = ({ isDisabled, setIsSourceIndexModalVisible }) => {
   const handleClick = () => {
     setIsSourceIndexModalVisible(true);
   };
 
   const button = (
     <EuiButton
-      disabled={disabled}
+      disabled={isDisabled}
       fill
       onClick={handleClick}
       iconType="plusInCircle"
@@ -40,7 +34,7 @@ export const CreateAnalyticsButton: FC<Props> = ({
     </EuiButton>
   );
 
-  if (disabled) {
+  if (isDisabled) {
     return (
       <EuiToolTip
         position="top"
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/hooks/use_create_analytics_form/actions.ts b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/hooks/use_create_analytics_form/actions.ts
index a9eedbb2bc5e3..4bfee9f308313 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/hooks/use_create_analytics_form/actions.ts
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/hooks/use_create_analytics_form/actions.ts
@@ -17,7 +17,6 @@ export enum ACTION {
   RESET_FORM,
   SET_ADVANCED_EDITOR_RAW_STRING,
   SET_FORM_STATE,
-  SET_INDEX_NAMES,
   SET_INDEX_PATTERN_TITLES,
   SET_IS_JOB_CREATED,
   SET_IS_JOB_STARTED,
@@ -48,7 +47,6 @@ export type Action =
       advancedEditorRawString: State['advancedEditorRawString'];
     }
   | { type: ACTION.SET_FORM_STATE; payload: Partial<State['form']> }
-  | { type: ACTION.SET_INDEX_NAMES; indexNames: State['indexNames'] }
   | {
       type: ACTION.SET_INDEX_PATTERN_TITLES;
       payload: {
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/hooks/use_create_analytics_form/reducer.ts b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/hooks/use_create_analytics_form/reducer.ts
index b344e44c97d59..acdaf15cdf4b7 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/hooks/use_create_analytics_form/reducer.ts
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/hooks/use_create_analytics_form/reducer.ts
@@ -480,9 +480,6 @@ export function reducer(state: State, action: Action): State {
 
       // update state attributes which are derived from other state attributes.
       if (action.payload.destinationIndex !== undefined) {
-        newFormState.destinationIndexNameExists = state.indexNames.some(
-          (name) => newFormState.destinationIndex === name
-        );
         newFormState.destinationIndexNameEmpty = newFormState.destinationIndex === '';
         newFormState.destinationIndexNameValid = isValidIndexName(newFormState.destinationIndex);
         newFormState.destinationIndexPatternTitleExists =
@@ -514,14 +511,6 @@ export function reducer(state: State, action: Action): State {
         ? validateAdvancedEditor({ ...state, form: newFormState })
         : validateForm({ ...state, form: newFormState });
 
-    case ACTION.SET_INDEX_NAMES: {
-      const newState = { ...state, indexNames: action.indexNames };
-      newState.form.destinationIndexNameExists = newState.indexNames.some(
-        (name) => newState.form.destinationIndex === name
-      );
-      return newState;
-    }
-
     case ACTION.SET_INDEX_PATTERN_TITLES: {
       const newState = {
         ...state,
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/hooks/use_create_analytics_form/state.ts b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/hooks/use_create_analytics_form/state.ts
index 68a3613f91b5e..725fc8751408e 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/hooks/use_create_analytics_form/state.ts
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/hooks/use_create_analytics_form/state.ts
@@ -94,7 +94,6 @@ export interface State {
     trainingPercent: number;
   };
   disabled: boolean;
-  indexNames: EsIndexName[];
   indexPatternsMap: SourceIndexMap;
   isAdvancedEditorEnabled: boolean;
   isAdvancedEditorValidJson: boolean;
@@ -165,7 +164,6 @@ export const getInitialState = (): State => ({
     !mlNodesAvailable() ||
     !checkPermission('canCreateDataFrameAnalytics') ||
     !checkPermission('canStartStopDataFrameAnalytics'),
-  indexNames: [],
   indexPatternsMap: {},
   isAdvancedEditorEnabled: false,
   isAdvancedEditorValidJson: true,
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/hooks/use_create_analytics_form/use_create_analytics_form.ts b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/hooks/use_create_analytics_form/use_create_analytics_form.ts
index 4c312be26613c..035610684d556 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/hooks/use_create_analytics_form/use_create_analytics_form.ts
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/hooks/use_create_analytics_form/use_create_analytics_form.ts
@@ -25,7 +25,6 @@ import { reducer } from './reducer';
 import {
   getInitialState,
   getJobConfigFromFormState,
-  EsIndexName,
   FormMessage,
   State,
   SourceIndexMap,
@@ -67,9 +66,6 @@ export const useCreateAnalyticsForm = (): CreateAnalyticsFormProps => {
   const resetAdvancedEditorMessages = () =>
     dispatch({ type: ACTION.RESET_ADVANCED_EDITOR_MESSAGES });
 
-  const setIndexNames = (indexNames: EsIndexName[]) =>
-    dispatch({ type: ACTION.SET_INDEX_NAMES, indexNames });
-
   const setAdvancedEditorRawString = (advancedEditorRawString: string) =>
     dispatch({ type: ACTION.SET_ADVANCED_EDITOR_RAW_STRING, advancedEditorRawString });
 
@@ -214,21 +210,7 @@ export const useCreateAnalyticsForm = (): CreateAnalyticsFormProps => {
     }
 
     try {
-      setIndexNames((await ml.getIndices()).map((index) => index.name));
-    } catch (e) {
-      addRequestMessage({
-        error: getErrorMessage(e),
-        message: i18n.translate(
-          'xpack.ml.dataframe.analytics.create.errorGettingDataFrameIndexNames',
-          {
-            defaultMessage: 'An error occurred getting the existing index names:',
-          }
-        ),
-      });
-    }
-
-    try {
-      // Set the index pattern titles which the user can choose as the source.
+      // Set the existing index pattern titles.
       const indexPatternsMap: SourceIndexMap = {};
       const savedObjects = (await mlContext.indexPatterns.getCache()) || [];
       savedObjects.forEach((obj) => {
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/page.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/page.tsx
index 07442124959d0..1e83e6c7d0e03 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/page.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/page.tsx
@@ -26,7 +26,6 @@ import { DatePickerWrapper } from '../../../components/navigation_menu/date_pick
 import { DataFrameAnalyticsList } from './components/analytics_list';
 import { useRefreshInterval } from './components/analytics_list/use_refresh_interval';
 import { RefreshAnalyticsListButton } from './components/refresh_analytics_list_button';
-import { useCreateAnalyticsForm } from './hooks/use_create_analytics_form';
 import { NodeAvailableWarning } from '../../../components/node_available_warning';
 import { UpgradeWarning } from '../../../components/upgrade';
 
@@ -35,8 +34,6 @@ export const Page: FC = () => {
 
   useRefreshInterval(setBlockRefresh);
 
-  const createAnalyticsForm = useCreateAnalyticsForm();
-
   return (
     <Fragment>
       <NavigationMenu tabId="data_frame_analytics" />
@@ -84,10 +81,7 @@ export const Page: FC = () => {
           <UpgradeWarning />
 
           <EuiPageContent>
-            <DataFrameAnalyticsList
-              blockRefresh={blockRefresh}
-              createAnalyticsForm={createAnalyticsForm}
-            />
+            <DataFrameAnalyticsList blockRefresh={blockRefresh} />
           </EuiPageContent>
         </EuiPageBody>
       </EuiPage>
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/services/analytics_service/get_analytics.ts b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/services/analytics_service/get_analytics.ts
index 964e8e4062b38..41f3bab8113f0 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/services/analytics_service/get_analytics.ts
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/services/analytics_service/get_analytics.ts
@@ -10,7 +10,11 @@ import {
   GetDataFrameAnalyticsStatsResponseError,
   GetDataFrameAnalyticsStatsResponseOk,
 } from '../../../../../services/ml_api_service/data_frame_analytics';
-import { REFRESH_ANALYTICS_LIST_STATE, refreshAnalyticsList$ } from '../../../../common';
+import {
+  ANALYSIS_CONFIG_TYPE,
+  REFRESH_ANALYTICS_LIST_STATE,
+  refreshAnalyticsList$,
+} from '../../../../common';
 
 import {
   DATA_FRAME_MODE,
@@ -136,10 +140,12 @@ export const getAnalyticsFactory = (
 
             // Table with expandable rows requires `id` on the outer most level
             reducedtableRows.push({
+              checkpointing: {},
               config,
               id: config.id,
-              checkpointing: {},
+              job_type: Object.keys(config.analysis)[0] as ANALYSIS_CONFIG_TYPE,
               mode: DATA_FRAME_MODE.BATCH,
+              state: stats.state,
               stats,
             });
             return reducedtableRows;
diff --git a/x-pack/plugins/ml/public/application/explorer/explorer_swimlane.tsx b/x-pack/plugins/ml/public/application/explorer/explorer_swimlane.tsx
index 926f38ac8b552..2590ab2f1cb23 100644
--- a/x-pack/plugins/ml/public/application/explorer/explorer_swimlane.tsx
+++ b/x-pack/plugins/ml/public/application/explorer/explorer_swimlane.tsx
@@ -204,6 +204,8 @@ export class ExplorerSwimlane extends React.Component<ExplorerSwimlaneProps> {
     });
 
     this.renderSwimlane();
+
+    this.dragSelect.stop();
   }
 
   componentDidUpdate() {
@@ -211,11 +213,11 @@ export class ExplorerSwimlane extends React.Component<ExplorerSwimlaneProps> {
   }
 
   componentWillUnmount() {
-    if (this.dragSelectSubscriber !== null) {
-      this.dragSelectSubscriber.unsubscribe();
-    }
-    const element = d3.select(this.rootNode.current!);
-    element.html('');
+    this.dragSelectSubscriber!.unsubscribe();
+    // Remove selector element from DOM
+    this.dragSelect.selector.remove();
+    // removes all mousedown event handlers
+    this.dragSelect.stop(true);
   }
 
   selectCell(cellsToSelect: any[], { laneLabels, bucketScore, times }: SelectedData) {
diff --git a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/start_datafeed_modal/start_datafeed_modal.js b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/start_datafeed_modal/start_datafeed_modal.js
index 9ce15fb881bd8..d0d3dc56ababf 100644
--- a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/start_datafeed_modal/start_datafeed_modal.js
+++ b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/start_datafeed_modal/start_datafeed_modal.js
@@ -222,6 +222,6 @@ StartDatafeedModal.propTypes = {
 };
 
 function getLowestLatestTime(jobs) {
-  const times = jobs.map((j) => j.latestTimestampSortValue);
+  const times = jobs.map((j) => j.earliestStartTimestampMs || 0);
   return moment(Math.min(...times));
 }
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/utils/new_job_utils.test.ts b/x-pack/plugins/ml/public/application/jobs/new_job/utils/new_job_utils.test.ts
new file mode 100644
index 0000000000000..b7c29abc96fb8
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/utils/new_job_utils.test.ts
@@ -0,0 +1,209 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IUiSettingsClient } from 'kibana/public';
+import { IIndexPattern } from '../../../../../../../../src/plugins/data/common/index_patterns';
+import { SavedSearchSavedObject } from '../../../../../common/types/kibana';
+import { createSearchItems } from './new_job_utils';
+
+describe('createSearchItems', () => {
+  const kibanaConfig = {} as IUiSettingsClient;
+  const indexPattern = ({
+    fields: [],
+  } as unknown) as IIndexPattern;
+
+  let savedSearch = ({} as unknown) as SavedSearchSavedObject;
+  beforeEach(() => {
+    savedSearch = ({
+      client: {
+        http: {
+          basePath: {
+            basePath: '/abc',
+            serverBasePath: '/abc',
+          },
+          anonymousPaths: {},
+        },
+        batchQueue: [],
+      },
+      attributes: {
+        title: 'not test',
+        description: '',
+        hits: 0,
+        columns: ['_source'],
+        sort: [],
+        version: 1,
+        kibanaSavedObjectMeta: {
+          searchSourceJSON: '',
+        },
+      },
+      _version: 'WzI0OSw0XQ==',
+      id: '4b9b1010-c678-11ea-b6e6-e942978da29c',
+      type: 'search',
+      migrationVersion: {
+        search: '7.4.0',
+      },
+      references: [
+        {
+          name: 'kibanaSavedObjectMeta.searchSourceJSON.index',
+          type: 'index-pattern',
+          id: '7e252840-bd27-11ea-8a6c-75d1a0bd08ab',
+        },
+      ],
+    } as unknown) as SavedSearchSavedObject;
+  });
+
+  test('should match index pattern', () => {
+    const resp = createSearchItems(kibanaConfig, indexPattern, null);
+    expect(resp).toStrictEqual({
+      combinedQuery: { bool: { must: [{ match_all: {} }] } },
+      query: { query: '', language: 'lucene' },
+    });
+  });
+
+  test('should match saved search with kuery and condition', () => {
+    const searchSource = {
+      highlightAll: true,
+      version: true,
+      query: { query: 'airline : "AAL" ', language: 'kuery' },
+      filter: [],
+      indexRefName: 'kibanaSavedObjectMeta.searchSourceJSON.index',
+    };
+    savedSearch.attributes.kibanaSavedObjectMeta.searchSourceJSON = JSON.stringify(searchSource);
+
+    const resp = createSearchItems(kibanaConfig, indexPattern, savedSearch);
+    expect(resp).toStrictEqual({
+      combinedQuery: {
+        bool: {
+          should: [{ match_phrase: { airline: 'AAL' } }],
+          minimum_should_match: 1,
+          filter: [],
+          must_not: [],
+        },
+      },
+      query: {
+        language: 'kuery',
+        query: 'airline : "AAL" ',
+      },
+    });
+  });
+
+  test('should match saved search with kuery and not condition', () => {
+    const searchSource = {
+      highlightAll: true,
+      version: true,
+      query: { query: 'NOT airline : "AAL" ', language: 'kuery' },
+      filter: [],
+      indexRefName: 'kibanaSavedObjectMeta.searchSourceJSON.index',
+    };
+    savedSearch.attributes.kibanaSavedObjectMeta.searchSourceJSON = JSON.stringify(searchSource);
+
+    const resp = createSearchItems(kibanaConfig, indexPattern, savedSearch);
+    expect(resp).toStrictEqual({
+      combinedQuery: {
+        bool: {
+          filter: [],
+          must_not: [
+            {
+              bool: {
+                minimum_should_match: 1,
+                should: [
+                  {
+                    match_phrase: {
+                      airline: 'AAL',
+                    },
+                  },
+                ],
+              },
+            },
+          ],
+        },
+      },
+      query: {
+        language: 'kuery',
+        query: 'NOT airline : "AAL" ',
+      },
+    });
+  });
+
+  test('should match saved search with kuery and condition and not condition', () => {
+    const searchSource = {
+      highlightAll: true,
+      version: true,
+      query: { query: 'airline : "AAL" and NOT airline : "AWE" ', language: 'kuery' },
+      filter: [],
+      indexRefName: 'kibanaSavedObjectMeta.searchSourceJSON.index',
+    };
+    savedSearch.attributes.kibanaSavedObjectMeta.searchSourceJSON = JSON.stringify(searchSource);
+
+    const resp = createSearchItems(kibanaConfig, indexPattern, savedSearch);
+    expect(resp).toStrictEqual({
+      combinedQuery: {
+        bool: {
+          filter: [
+            { bool: { should: [{ match_phrase: { airline: 'AAL' } }], minimum_should_match: 1 } },
+            {
+              bool: {
+                must_not: {
+                  bool: { should: [{ match_phrase: { airline: 'AWE' } }], minimum_should_match: 1 },
+                },
+              },
+            },
+          ],
+          must_not: [],
+        },
+      },
+      query: { query: 'airline : "AAL" and NOT airline : "AWE" ', language: 'kuery' },
+    });
+  });
+
+  test('should match saved search with kuery and filter', () => {
+    const searchSource = {
+      highlightAll: true,
+      version: true,
+      query: {
+        language: 'kuery',
+        query: '',
+      },
+      filter: [
+        {
+          meta: {
+            alias: null,
+            negate: false,
+            disabled: false,
+            type: 'phrase',
+            key: 'airline',
+            params: {
+              query: 'AAL',
+            },
+            indexRefName: 'kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index',
+          },
+          query: {
+            match_phrase: {
+              airline: 'AAL',
+            },
+          },
+          $state: {
+            store: 'appState',
+          },
+        },
+      ],
+      indexRefName: 'kibanaSavedObjectMeta.searchSourceJSON.index',
+    };
+    savedSearch.attributes.kibanaSavedObjectMeta.searchSourceJSON = JSON.stringify(searchSource);
+
+    const resp = createSearchItems(kibanaConfig, indexPattern, savedSearch);
+    expect(resp).toStrictEqual({
+      combinedQuery: {
+        bool: {
+          must: [{ match_all: {} }],
+          filter: [{ match_phrase: { airline: 'AAL' } }],
+          must_not: [],
+        },
+      },
+      query: { language: 'kuery', query: '' },
+    });
+  });
+});
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/utils/new_job_utils.ts b/x-pack/plugins/ml/public/application/jobs/new_job/utils/new_job_utils.ts
index 9ba10dc21000e..5fa6c817ec4c1 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/utils/new_job_utils.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/utils/new_job_utils.ts
@@ -52,12 +52,16 @@ export function createSearchItems(
       }
       const filterQuery = esQuery.buildQueryFromFilters(filters, indexPattern);
 
-      if (combinedQuery.bool.filter === undefined) {
-        combinedQuery.bool.filter = [];
+      if (Array.isArray(combinedQuery.bool.filter) === false) {
+        combinedQuery.bool.filter =
+          combinedQuery.bool.filter === undefined ? [] : [combinedQuery.bool.filter];
       }
-      if (combinedQuery.bool.must_not === undefined) {
-        combinedQuery.bool.must_not = [];
+
+      if (Array.isArray(combinedQuery.bool.must_not) === false) {
+        combinedQuery.bool.must_not =
+          combinedQuery.bool.must_not === undefined ? [] : [combinedQuery.bool.must_not];
       }
+
       combinedQuery.bool.filter = [...combinedQuery.bool.filter, ...filterQuery.filter];
       combinedQuery.bool.must_not = [...combinedQuery.bool.must_not, ...filterQuery.must_not];
     } else {
diff --git a/x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/_analytics_table.scss b/x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/_analytics_table.scss
index 1151599a526e4..f134c467e11b2 100644
--- a/x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/_analytics_table.scss
+++ b/x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/_analytics_table.scss
@@ -19,10 +19,6 @@
   }
 }
 
-.mlAnalyticsProgressBar {
-  margin-bottom: $euiSizeM;
-}
-
 .mlTaskStateBadge {
   max-width: 100px;
 }
diff --git a/x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/jobs_list_page.tsx b/x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/jobs_list_page.tsx
index e3c45c6cd0b04..33bb78c51e013 100644
--- a/x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/jobs_list_page.tsx
+++ b/x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/jobs_list_page.tsx
@@ -27,6 +27,7 @@ import { getDocLinks } from '../../../../util/dependency_cache';
 // @ts-ignore undeclared module
 import { JobsListView } from '../../../../jobs/jobs_list/components/jobs_list_view/index';
 import { DataFrameAnalyticsList } from '../../../../data_frame_analytics/pages/analytics_management/components/analytics_list';
+import { AccessDeniedPage } from '../access_denied_page';
 
 interface Tab {
   id: string;
@@ -68,6 +69,7 @@ function getTabs(isMlEnabledInSpace: boolean): Tab[] {
 
 export const JobsListPage: FC<{ coreStart: CoreStart }> = ({ coreStart }) => {
   const [initialized, setInitialized] = useState(false);
+  const [accessDenied, setAccessDenied] = useState(false);
   const [isMlEnabledInSpace, setIsMlEnabledInSpace] = useState(false);
   const tabs = getTabs(isMlEnabledInSpace);
   const [currentTabId, setCurrentTabId] = useState(tabs[0].id);
@@ -76,12 +78,11 @@ export const JobsListPage: FC<{ coreStart: CoreStart }> = ({ coreStart }) => {
   const check = async () => {
     try {
       const checkPrivilege = await checkGetManagementMlJobsResolver();
-      setInitialized(true);
       setIsMlEnabledInSpace(checkPrivilege.mlFeatureEnabledInSpace);
     } catch (e) {
-      // Silent fail, `checkGetManagementMlJobs()` should redirect when
-      // there are insufficient permissions.
+      setAccessDenied(true);
     }
+    setInitialized(true);
   };
 
   useEffect(() => {
@@ -120,6 +121,10 @@ export const JobsListPage: FC<{ coreStart: CoreStart }> = ({ coreStart }) => {
     );
   }
 
+  if (accessDenied) {
+    return <AccessDeniedPage />;
+  }
+
   return (
     <I18nContext>
       <KibanaContextProvider services={{ ...coreStart }}>
diff --git a/x-pack/plugins/ml/public/application/management/management_urls.ts b/x-pack/plugins/ml/public/application/management/management_urls.ts
index f346940e91ed0..1a83fd2fb4d42 100644
--- a/x-pack/plugins/ml/public/application/management/management_urls.ts
+++ b/x-pack/plugins/ml/public/application/management/management_urls.ts
@@ -9,4 +9,3 @@ type Path = string;
 export const MANAGEMENT_PATH: Path = '/management';
 export const ML_PATH: Path = `${MANAGEMENT_PATH}/ml`;
 export const JOBS_LIST_PATH: Path = `${ML_PATH}/jobs_list`;
-export const ACCESS_DENIED_PATH: Path = `${ML_PATH}/access_denied`;
diff --git a/x-pack/plugins/ml/public/application/overview/components/analytics_panel/table.tsx b/x-pack/plugins/ml/public/application/overview/components/analytics_panel/table.tsx
index 1eeff6287867d..b28729dcf157f 100644
--- a/x-pack/plugins/ml/public/application/overview/components/analytics_panel/table.tsx
+++ b/x-pack/plugins/ml/public/application/overview/components/analytics_panel/table.tsx
@@ -5,15 +5,15 @@
  */
 
 import React, { FC, useState } from 'react';
-import { EuiBadge } from '@elastic/eui';
-import { i18n } from '@kbn/i18n';
 import {
-  mlInMemoryTableFactory,
-  SortDirection,
-  SORT_DIRECTION,
-  OnTableChangeArg,
-  ColumnType,
-} from '../../../components/ml_in_memory_table';
+  Direction,
+  EuiBadge,
+  EuiInMemoryTable,
+  EuiTableActionsColumnType,
+  EuiTableComputedColumnType,
+  EuiTableFieldDataColumnType,
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
 import { getAnalysisType } from '../../../data_frame_analytics/common/analytics';
 import {
   DataFrameAnalyticsListColumn,
@@ -26,7 +26,14 @@ import {
 import { getViewAction } from '../../../data_frame_analytics/pages/analytics_management/components/action_view';
 import { formatHumanReadableDateTimeSeconds } from '../../../util/date_utils';
 
-const MlInMemoryTable = mlInMemoryTableFactory<DataFrameAnalyticsListRow>();
+type DataFrameAnalyticsTableColumns = [
+  EuiTableFieldDataColumnType<DataFrameAnalyticsListRow>,
+  EuiTableComputedColumnType<DataFrameAnalyticsListRow>,
+  EuiTableComputedColumnType<DataFrameAnalyticsListRow>,
+  EuiTableComputedColumnType<DataFrameAnalyticsListRow>,
+  EuiTableFieldDataColumnType<DataFrameAnalyticsListRow>,
+  EuiTableActionsColumnType<DataFrameAnalyticsListRow>
+];
 
 interface Props {
   items: DataFrameAnalyticsListRow[];
@@ -36,10 +43,10 @@ export const AnalyticsTable: FC<Props> = ({ items }) => {
   const [pageSize, setPageSize] = useState(10);
 
   const [sortField, setSortField] = useState<string>(DataFrameAnalyticsListColumn.id);
-  const [sortDirection, setSortDirection] = useState<SortDirection>(SORT_DIRECTION.ASC);
+  const [sortDirection, setSortDirection] = useState<Direction>('asc');
 
   // id, type, status, progress, created time, view icon
-  const columns: Array<ColumnType<DataFrameAnalyticsListRow>> = [
+  const columns: DataFrameAnalyticsTableColumns = [
     {
       field: DataFrameAnalyticsListColumn.id,
       name: i18n.translate('xpack.ml.overview.analyticsList.id', { defaultMessage: 'ID' }),
@@ -87,10 +94,10 @@ export const AnalyticsTable: FC<Props> = ({ items }) => {
     },
   ];
 
-  const onTableChange = ({
+  const onTableChange: EuiInMemoryTable<DataFrameAnalyticsListRow>['onTableChange'] = ({
     page = { index: 0, size: 10 },
-    sort = { field: DataFrameAnalyticsListColumn.id, direction: SORT_DIRECTION.ASC },
-  }: OnTableChangeArg) => {
+    sort = { field: DataFrameAnalyticsListColumn.id, direction: 'asc' },
+  }) => {
     const { index, size } = page;
     setPageIndex(index);
     setPageSize(size);
@@ -116,7 +123,7 @@ export const AnalyticsTable: FC<Props> = ({ items }) => {
   };
 
   return (
-    <MlInMemoryTable
+    <EuiInMemoryTable
       allowNeutralSort={false}
       className="mlAnalyticsTable"
       columns={columns}
diff --git a/x-pack/plugins/ml/public/application/overview/components/anomaly_detection_panel/table.tsx b/x-pack/plugins/ml/public/application/overview/components/anomaly_detection_panel/table.tsx
index cd45721d54a68..945116b0534bb 100644
--- a/x-pack/plugins/ml/public/application/overview/components/anomaly_detection_panel/table.tsx
+++ b/x-pack/plugins/ml/public/application/overview/components/anomaly_detection_panel/table.tsx
@@ -6,23 +6,20 @@
 
 import React, { FC, Fragment, useState } from 'react';
 import {
+  Direction,
   EuiFlexGroup,
   EuiFlexItem,
   EuiHealth,
   EuiIcon,
+  EuiInMemoryTable,
   EuiLoadingSpinner,
   EuiSpacer,
+  EuiTableComputedColumnType,
+  EuiTableFieldDataColumnType,
   EuiText,
   EuiToolTip,
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
-import {
-  mlInMemoryTableFactory,
-  SortDirection,
-  SORT_DIRECTION,
-  OnTableChangeArg,
-  ColumnType,
-} from '../../../components/ml_in_memory_table';
 import { formatHumanReadableDateTimeSeconds } from '../../../util/date_utils';
 import { ExplorerLink } from './actions';
 import { getJobsFromGroup } from './utils';
@@ -34,8 +31,6 @@ import { JobSelectorBadge } from '../../../components/job_selector/job_selector_
 import { toLocaleString } from '../../../util/string_utils';
 import { getSeverityColor } from '../../../../../common/util/anomaly_utils';
 
-const MlInMemoryTable = mlInMemoryTableFactory<Group>();
-
 // Used to pass on attribute names to table columns
 export enum AnomalyDetectionListColumns {
   id = 'id',
@@ -46,6 +41,15 @@ export enum AnomalyDetectionListColumns {
   jobsInGroup = 'jobs_in_group',
 }
 
+type AnomalyDetectionTableColumns = [
+  EuiTableFieldDataColumnType<Group>,
+  EuiTableFieldDataColumnType<Group>,
+  EuiTableFieldDataColumnType<Group>,
+  EuiTableFieldDataColumnType<Group>,
+  EuiTableFieldDataColumnType<Group>,
+  EuiTableComputedColumnType<Group>
+];
+
 interface Props {
   items: GroupsDictionary;
   statsBarData: JobStatsBarStats;
@@ -58,10 +62,10 @@ export const AnomalyDetectionTable: FC<Props> = ({ items, jobsList, statsBarData
   const [pageSize, setPageSize] = useState(10);
 
   const [sortField, setSortField] = useState<string>(AnomalyDetectionListColumns.id);
-  const [sortDirection, setSortDirection] = useState<SortDirection>(SORT_DIRECTION.ASC);
+  const [sortDirection, setSortDirection] = useState<Direction>('asc');
 
   // columns: group, max anomaly, jobs in group, latest timestamp, docs processed, action to explorer
-  const columns: Array<ColumnType<Group>> = [
+  const columns: AnomalyDetectionTableColumns = [
     {
       field: AnomalyDetectionListColumns.id,
       name: i18n.translate('xpack.ml.overview.anomalyDetection.tableId', {
@@ -169,17 +173,17 @@ export const AnomalyDetectionTable: FC<Props> = ({ items, jobsList, statsBarData
     },
   ];
 
-  const onTableChange = ({
+  const onTableChange: EuiInMemoryTable<Group>['onTableChange'] = ({
     page = { index: 0, size: 10 },
-    sort = { field: AnomalyDetectionListColumns.id, direction: SORT_DIRECTION.ASC },
-  }: OnTableChangeArg) => {
+    sort = { field: AnomalyDetectionListColumns.id, direction: 'asc' },
+  }) => {
     const { index, size } = page;
     setPageIndex(index);
     setPageSize(size);
 
     const { field, direction } = sort;
-    setSortField(field);
-    setSortDirection(direction);
+    setSortField(field as string);
+    setSortDirection(direction as Direction);
   };
 
   const pagination = {
@@ -214,7 +218,7 @@ export const AnomalyDetectionTable: FC<Props> = ({ items, jobsList, statsBarData
         </EuiFlexItem>
       </EuiFlexGroup>
       <EuiSpacer />
-      <MlInMemoryTable
+      <EuiInMemoryTable
         allowNeutralSort={false}
         className="mlAnomalyDetectionTable"
         columns={columns}
diff --git a/x-pack/plugins/ml/public/application/services/ml_api_service/index.ts b/x-pack/plugins/ml/public/application/services/ml_api_service/index.ts
index 599e4d4bb8a10..184039729f9ef 100644
--- a/x-pack/plugins/ml/public/application/services/ml_api_service/index.ts
+++ b/x-pack/plugins/ml/public/application/services/ml_api_service/index.ts
@@ -372,6 +372,16 @@ export function mlApiServicesProvider(httpService: HttpService) {
       });
     },
 
+    checkIndexExists({ index }: { index: string }) {
+      const body = JSON.stringify({ index });
+
+      return httpService.http<{ exists: boolean }>({
+        path: `${basePath()}/index_exists`,
+        method: 'POST',
+        body,
+      });
+    },
+
     getFieldCaps({ index, fields }: { index: string; fields: string[] }) {
       const body = JSON.stringify({
         ...(index !== undefined ? { index } : {}),
diff --git a/x-pack/plugins/ml/public/application/util/string_utils.test.ts b/x-pack/plugins/ml/public/application/util/string_utils.test.ts
index 034c406afb4b2..80e318629d352 100644
--- a/x-pack/plugins/ml/public/application/util/string_utils.test.ts
+++ b/x-pack/plugins/ml/public/application/util/string_utils.test.ts
@@ -38,17 +38,17 @@ describe('ML - string utils', () => {
       initial_record_score: 0,
     };
 
-    test('returns correct values without URI encoding', () => {
+    test('should return correct values without URI encoding', () => {
       const result = replaceStringTokens('user=$user$,time=$timestamp$', testRecord, false);
       expect(result).toBe("user=Des O'Connor,time=1454890500000");
     });
 
-    test('returns correct values for missing token without URI encoding', () => {
+    test('should return correct values for missing token without URI encoding', () => {
       const result = replaceStringTokens('user=$username$,time=$timestamp$', testRecord, false);
       expect(result).toBe('user=$username$,time=1454890500000');
     });
 
-    test('returns correct values with URI encoding', () => {
+    test('should return correct values with URI encoding', () => {
       const testString1 = 'https://www.google.co.uk/webhp#q=$testfield1$';
       const testString2 = 'https://www.google.co.uk/webhp#q=$testfield2$';
       const testString3 = 'https://www.google.co.uk/webhp#q=$testfield3$';
@@ -65,7 +65,7 @@ describe('ML - string utils', () => {
       expect(result4).toBe("https://www.google.co.uk/webhp#q=Des%20O'Connor");
     });
 
-    test('returns correct values for missing token with URI encoding', () => {
+    test('should return correct values for missing token with URI encoding', () => {
       const testString = 'https://www.google.co.uk/webhp#q=$username$&time=$timestamp$';
       const result = replaceStringTokens(testString, testRecord, true);
       expect(result).toBe('https://www.google.co.uk/webhp#q=$username$&time=1454890500000');
@@ -73,7 +73,7 @@ describe('ML - string utils', () => {
   });
 
   describe('detectorToString', () => {
-    test('returns the correct descriptions for detectors', () => {
+    test('should return the correct descriptions for detectors', () => {
       const detector1: Detector = {
         function: 'count',
       };
@@ -102,7 +102,7 @@ describe('ML - string utils', () => {
   });
 
   describe('toLocaleString', () => {
-    test('returns correct comma placement for large numbers', () => {
+    test('should return correct comma placement for large numbers', () => {
       expect(toLocaleString(1)).toBe('1');
       expect(toLocaleString(10)).toBe('10');
       expect(toLocaleString(100)).toBe('100');
@@ -114,21 +114,28 @@ describe('ML - string utils', () => {
       expect(toLocaleString(100000000)).toBe('100,000,000');
       expect(toLocaleString(1000000000)).toBe('1,000,000,000');
     });
+    test('should return empty string for undefined or null', () => {
+      expect(toLocaleString(undefined)).toBe('');
+      expect(toLocaleString(null)).toBe('');
+    });
   });
 
   describe('mlEscape', () => {
-    test('returns correct escaping of characters', () => {
+    test('should return correct escaping of characters', () => {
       expect(mlEscape('foo&bar')).toBe('foo&amp;bar');
       expect(mlEscape('foo<bar')).toBe('foo&lt;bar');
       expect(mlEscape('foo>bar')).toBe('foo&gt;bar');
       expect(mlEscape('foo"bar')).toBe('foo&quot;bar');
-      expect(mlEscape("foo'bar")).toBe('foo&#39;bar');
-      expect(mlEscape('foo/bar')).toBe('foo&#x2F;bar');
+      expect(mlEscape("foo'bar")).toBe('foo&apos;bar');
+      expect(mlEscape('foo/bar')).toBe('foo&sol;bar');
+      expect(mlEscape('escape © everything ≠ / 𝌆 \\')).toBe(
+        'escape&#x20;&copy;&#x20;everything&#x20;&ne;&#x20;&sol;&#x20;&#xD834;&#xDF06;&#x20;&#x5C;'
+      );
     });
   });
 
   describe('escapeForElasticsearchQuery', () => {
-    test('returns correct escaping of reserved elasticsearch characters', () => {
+    test('should return correct escaping of reserved elasticsearch characters', () => {
       expect(escapeForElasticsearchQuery('foo+bar')).toBe('foo\\+bar');
       expect(escapeForElasticsearchQuery('foo-bar')).toBe('foo\\-bar');
       expect(escapeForElasticsearchQuery('foo=bar')).toBe('foo\\=bar');
diff --git a/x-pack/plugins/ml/public/application/util/string_utils.ts b/x-pack/plugins/ml/public/application/util/string_utils.ts
index aa283fd71bf79..55dd16082a07c 100644
--- a/x-pack/plugins/ml/public/application/util/string_utils.ts
+++ b/x-pack/plugins/ml/public/application/util/string_utils.ts
@@ -9,6 +9,7 @@
  */
 import _ from 'lodash';
 import d3 from 'd3';
+import he from 'he';
 
 import { CustomUrlAnomalyRecordDoc } from '../../../common/types/custom_urls';
 import { Detector } from '../../../common/types/anomaly_detection_jobs';
@@ -90,7 +91,10 @@ function quoteField(field: string): string {
 
 // add commas to large numbers
 // Number.toLocaleString is not supported on safari
-export function toLocaleString(x: number): string {
+export function toLocaleString(x: number | undefined | null): string {
+  if (x === undefined || x === null) {
+    return '';
+  }
   let result = x.toString();
   if (x && typeof x === 'number') {
     const parts = x.toString().split('.');
@@ -102,15 +106,17 @@ export function toLocaleString(x: number): string {
 
 // escape html characters
 export function mlEscape(str: string): string {
-  const entityMap: { [escapeChar: string]: string } = {
-    '&': '&amp;',
-    '<': '&lt;',
-    '>': '&gt;',
-    '"': '&quot;',
-    "'": '&#39;',
-    '/': '&#x2F;',
-  };
-  return String(str).replace(/[&<>"'\/]/g, (s) => entityMap[s]);
+  // It's not possible to use "he" encoding directly
+  // because \ and / characters are not going to be replaced without
+  // encodeEverything option. But with this option enabled
+  // each word character is encoded as well.
+  return String(str).replace(/\W/g, (s) =>
+    he.encode(s, {
+      useNamedReferences: true,
+      encodeEverything: true,
+      allowUnsafeSymbols: false,
+    })
+  );
 }
 
 // Escapes reserved characters for use in Elasticsearch query terms.
diff --git a/x-pack/plugins/ml/server/models/job_service/jobs.ts b/x-pack/plugins/ml/server/models/job_service/jobs.ts
index aca0c5d72a9f5..e9ed2d0941d96 100644
--- a/x-pack/plugins/ml/server/models/job_service/jobs.ts
+++ b/x-pack/plugins/ml/server/models/job_service/jobs.ts
@@ -8,6 +8,7 @@ import { i18n } from '@kbn/i18n';
 import { uniq } from 'lodash';
 import Boom from 'boom';
 import { ILegacyScopedClusterClient } from 'kibana/server';
+import { parseTimeIntervalForJob } from '../../../common/util/job_utils';
 import { JOB_STATE, DATAFEED_STATE } from '../../../common/constants/states';
 import {
   MlSummaryJob,
@@ -24,11 +25,11 @@ import { resultsServiceProvider } from '../results_service';
 import { CalendarManager, Calendar } from '../calendar';
 import { fillResultsWithTimeouts, isRequestTimeout } from './error_utils';
 import {
+  getEarliestDatafeedStartTime,
   getLatestDataOrBucketTimestamp,
   isTimeSeriesViewJob,
 } from '../../../common/util/job_utils';
 import { groupsProvider } from './groups';
-
 export interface MlJobsResponse {
   jobs: Job[];
   count: number;
@@ -171,6 +172,11 @@ export function jobsProvider(mlClusterClient: ILegacyScopedClusterClient) {
         description: job.description || '',
         groups: Array.isArray(job.groups) ? job.groups.sort() : [],
         processed_record_count: job.data_counts?.processed_record_count,
+        earliestStartTimestampMs: getEarliestDatafeedStartTime(
+          dataCounts?.latest_record_timestamp,
+          dataCounts?.latest_bucket_timestamp,
+          parseTimeIntervalForJob(job.analysis_config?.bucket_span)
+        ),
         memory_status: job.model_size_stats ? job.model_size_stats.memory_status : '',
         jobState: job.deleting === true ? deletingStr : job.state,
         hasDatafeed,
@@ -182,8 +188,8 @@ export function jobsProvider(mlClusterClient: ILegacyScopedClusterClient) {
         latestTimestampMs: dataCounts?.latest_record_timestamp,
         earliestTimestampMs: dataCounts?.earliest_record_timestamp,
         latestResultsTimestampMs: getLatestDataOrBucketTimestamp(
-          dataCounts?.latest_record_timestamp as number,
-          dataCounts?.latest_bucket_timestamp as number
+          dataCounts?.latest_record_timestamp,
+          dataCounts?.latest_bucket_timestamp
         ),
         isSingleMetricViewerJob: isTimeSeriesViewJob(job),
         nodeName: job.node ? job.node.name : undefined,
diff --git a/x-pack/plugins/ml/server/routes/apidoc.json b/x-pack/plugins/ml/server/routes/apidoc.json
index c2cb1ad9f0a57..98f7a78537c5c 100644
--- a/x-pack/plugins/ml/server/routes/apidoc.json
+++ b/x-pack/plugins/ml/server/routes/apidoc.json
@@ -105,6 +105,7 @@
     "MlNodeCount",
     "MlInfo",
     "MlEsSearch",
+    "MlIndexExists",
 
     "JobAuditMessages",
     "GetJobAuditMessages",
diff --git a/x-pack/plugins/ml/server/routes/system.ts b/x-pack/plugins/ml/server/routes/system.ts
index 410d540ecb8f7..f2d8c89046178 100644
--- a/x-pack/plugins/ml/server/routes/system.ts
+++ b/x-pack/plugins/ml/server/routes/system.ts
@@ -226,4 +226,48 @@ export function systemRoutes(
       }
     })
   );
+
+  /**
+   * @apiGroup SystemRoutes
+   *
+   * @api {post} /api/ml/index_exists ES Field caps wrapper checks if index exists
+   * @apiName MlIndexExists
+   */
+  router.post(
+    {
+      path: '/api/ml/index_exists',
+      validate: {
+        body: schema.object({ index: schema.string() }),
+      },
+      options: {
+        tags: ['access:ml:canGetJobs'],
+      },
+    },
+    mlLicense.fullLicenseAPIGuard(async (context, request, response) => {
+      try {
+        const { index } = request.body;
+
+        const options = {
+          index: [index],
+          fields: ['*'],
+          ignoreUnavailable: true,
+          allowNoIndices: true,
+          ignore: 404,
+        };
+
+        const fieldsResult = await context.ml!.mlClient.callAsCurrentUser('fieldCaps', options);
+        const result = { exists: false };
+
+        if (Array.isArray(fieldsResult.indices) && fieldsResult.indices.length !== 0) {
+          result.exists = true;
+        }
+
+        return response.ok({
+          body: result,
+        });
+      } catch (error) {
+        return response.customError(wrapError(error));
+      }
+    })
+  );
 }
diff --git a/x-pack/plugins/monitoring/kibana.json b/x-pack/plugins/monitoring/kibana.json
index 3b9e60124b034..2b8756ea0cb46 100644
--- a/x-pack/plugins/monitoring/kibana.json
+++ b/x-pack/plugins/monitoring/kibana.json
@@ -11,7 +11,8 @@
     "kibanaLegacy",
     "triggers_actions_ui",
     "alerts",
-    "actions"
+    "actions",
+    "encryptedSavedObjects"
   ],
   "optionalPlugins": ["infra", "telemetryCollectionManager", "usageCollection", "home", "cloud"],
   "server": true,
diff --git a/x-pack/plugins/monitoring/public/alerts/callout.tsx b/x-pack/plugins/monitoring/public/alerts/callout.tsx
index 748ec257ea765..d000f470da334 100644
--- a/x-pack/plugins/monitoring/public/alerts/callout.tsx
+++ b/x-pack/plugins/monitoring/public/alerts/callout.tsx
@@ -24,7 +24,7 @@ const TYPES = [
     severity: AlertSeverity.Danger,
     color: 'danger',
     label: i18n.translate('xpack.monitoring.alerts.callout.dangerLabel', {
-      defaultMessage: 'DAnger alert(s)',
+      defaultMessage: 'Danger alert(s)',
     }),
   },
 ];
diff --git a/x-pack/plugins/monitoring/public/alerts/flyout_expressions/alert_param_duration.tsx b/x-pack/plugins/monitoring/public/alerts/flyout_expressions/alert_param_duration.tsx
index 23a9ea1facbc9..862f32efd7361 100644
--- a/x-pack/plugins/monitoring/public/alerts/flyout_expressions/alert_param_duration.tsx
+++ b/x-pack/plugins/monitoring/public/alerts/flyout_expressions/alert_param_duration.tsx
@@ -49,7 +49,7 @@ interface Props {
   setAlertParams: (property: string, value: any) => void;
 }
 
-const parseRegex = /(\d+)(\smhd)/;
+const parseRegex = /(\d+)([smhd]{1})/;
 export const AlertParamDuration: React.FC<Props> = (props: Props) => {
   const { name, label, setAlertParams, errors } = props;
   const parsed = parseRegex.exec(props.duration);
diff --git a/x-pack/plugins/monitoring/public/alerts/lib/security_toasts.tsx b/x-pack/plugins/monitoring/public/alerts/lib/security_toasts.tsx
new file mode 100644
index 0000000000000..918c0b5c9b609
--- /dev/null
+++ b/x-pack/plugins/monitoring/public/alerts/lib/security_toasts.tsx
@@ -0,0 +1,137 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { EuiSpacer, EuiLink, EuiCode, EuiText } from '@elastic/eui';
+import { Legacy } from '../../legacy_shims';
+import { toMountPoint } from '../../../../../../src/plugins/kibana_react/public';
+
+export interface AlertingFrameworkHealth {
+  isSufficientlySecure: boolean;
+  hasPermanentEncryptionKey: boolean;
+}
+
+const showTlsAndEncryptionError = () => {
+  const { ELASTIC_WEBSITE_URL, DOC_LINK_VERSION } = Legacy.shims.docLinks;
+
+  Legacy.shims.toastNotifications.addWarning({
+    title: toMountPoint(
+      <FormattedMessage
+        id="xpack.monitoring.healthCheck.tlsAndEncryptionErrorTitle"
+        defaultMessage="Additional setup required"
+      />
+    ),
+    text: toMountPoint(
+      <div>
+        <p>
+          {i18n.translate('xpack.monitoring.healthCheck.tlsAndEncryptionError', {
+            defaultMessage: `You must enable Transport Layer Security between Kibana and Elasticsearch 
+              and configure an encryption key in your kibana.yml file to use the Alerting feature.`,
+          })}
+        </p>
+        <EuiSpacer />
+        <EuiLink
+          href={`${ELASTIC_WEBSITE_URL}guide/en/kibana/${DOC_LINK_VERSION}/alert-action-settings-kb.html#general-alert-action-settings`}
+          external
+          target="_blank"
+        >
+          {i18n.translate('xpack.monitoring.healthCheck.encryptionErrorAction', {
+            defaultMessage: 'Learn how.',
+          })}
+        </EuiLink>
+      </div>
+    ),
+  });
+};
+
+const showEncryptionError = () => {
+  const { ELASTIC_WEBSITE_URL, DOC_LINK_VERSION } = Legacy.shims.docLinks;
+
+  Legacy.shims.toastNotifications.addWarning(
+    {
+      title: toMountPoint(
+        <FormattedMessage
+          id="xpack.monitoring.healthCheck.encryptionErrorTitle"
+          defaultMessage="You must set an encryption key"
+        />
+      ),
+      text: toMountPoint(
+        <div role="banner">
+          {i18n.translate('xpack.monitoring.healthCheck.encryptionErrorBeforeKey', {
+            defaultMessage: 'To create an alert, set a value for ',
+          })}
+          <EuiText size="xs">
+            <EuiCode>{'xpack.encryptedSavedObjects.encryptionKey'}</EuiCode>
+          </EuiText>
+          {i18n.translate('xpack.monitoring.healthCheck.encryptionErrorAfterKey', {
+            defaultMessage: ' in your kibana.yml file. ',
+          })}
+          <EuiLink
+            href={`${ELASTIC_WEBSITE_URL}guide/en/kibana/${DOC_LINK_VERSION}/alert-action-settings-kb.html#general-alert-action-settings`}
+            external
+            target="_blank"
+          >
+            {i18n.translate('xpack.monitoring.healthCheck.encryptionErrorAction', {
+              defaultMessage: 'Learn how.',
+            })}
+          </EuiLink>
+        </div>
+      ),
+    },
+    {}
+  );
+};
+
+const showTlsError = () => {
+  const { ELASTIC_WEBSITE_URL, DOC_LINK_VERSION } = Legacy.shims.docLinks;
+
+  Legacy.shims.toastNotifications.addWarning({
+    title: toMountPoint(
+      <FormattedMessage
+        id="xpack.monitoring.healthCheck.tlsErrorTitle"
+        defaultMessage="You must enable Transport Layer Security"
+      />
+    ),
+    text: toMountPoint(
+      <div role="banner">
+        {i18n.translate('xpack.monitoring.healthCheck.tlsError', {
+          defaultMessage:
+            'Alerting relies on API keys, which require TLS between Elasticsearch and Kibana. ',
+        })}
+        <EuiLink
+          href={`${ELASTIC_WEBSITE_URL}guide/en/kibana/${DOC_LINK_VERSION}/configuring-tls.html`}
+          external
+          target="_blank"
+        >
+          {i18n.translate('xpack.monitoring.healthCheck.tlsErrorAction', {
+            defaultMessage: 'Learn how to enable TLS.',
+          })}
+        </EuiLink>
+      </div>
+    ),
+  });
+};
+
+export const showSecurityToast = (alertingHealth: AlertingFrameworkHealth) => {
+  const { isSufficientlySecure, hasPermanentEncryptionKey } = alertingHealth;
+  if (
+    Array.isArray(alertingHealth) ||
+    (!alertingHealth.hasOwnProperty('isSufficientlySecure') &&
+      !alertingHealth.hasOwnProperty('hasPermanentEncryptionKey'))
+  ) {
+    return;
+  }
+
+  if (!isSufficientlySecure && !hasPermanentEncryptionKey) {
+    showTlsAndEncryptionError();
+  } else if (!isSufficientlySecure) {
+    showTlsError();
+  } else if (!hasPermanentEncryptionKey) {
+    showEncryptionError();
+  }
+};
diff --git a/x-pack/plugins/monitoring/public/alerts/lib/should_show_alert_badge.ts b/x-pack/plugins/monitoring/public/alerts/lib/should_show_alert_badge.ts
index c6773e9ca0156..6de371b53ef9b 100644
--- a/x-pack/plugins/monitoring/public/alerts/lib/should_show_alert_badge.ts
+++ b/x-pack/plugins/monitoring/public/alerts/lib/should_show_alert_badge.ts
@@ -10,6 +10,9 @@ export function shouldShowAlertBadge(
   alerts: { [alertTypeId: string]: CommonAlertStatus },
   alertTypeIds: string[]
 ) {
+  if (!alerts) {
+    return false;
+  }
   const inSetupMode = isInSetupMode();
   return inSetupMode || alertTypeIds.find((name) => alerts[name] && alerts[name].states.length);
 }
diff --git a/x-pack/plugins/monitoring/public/plugin.ts b/x-pack/plugins/monitoring/public/plugin.ts
index 1b9ae75a0968e..cfac5e195a127 100644
--- a/x-pack/plugins/monitoring/public/plugin.ts
+++ b/x-pack/plugins/monitoring/public/plugin.ts
@@ -74,7 +74,7 @@ export class MonitoringPlugin
     const app: App = {
       id,
       title,
-      order: 9002,
+      order: 9030,
       euiIconType: icon,
       category: DEFAULT_APP_CATEGORIES.management,
       mount: async (params: AppMountParameters) => {
diff --git a/x-pack/plugins/monitoring/public/services/clusters.js b/x-pack/plugins/monitoring/public/services/clusters.js
index f3eadcaf9831b..5173984dbe868 100644
--- a/x-pack/plugins/monitoring/public/services/clusters.js
+++ b/x-pack/plugins/monitoring/public/services/clusters.js
@@ -7,6 +7,7 @@
 import { ajaxErrorHandlersProvider } from '../lib/ajax_error_handler';
 import { Legacy } from '../legacy_shims';
 import { STANDALONE_CLUSTER_CLUSTER_UUID } from '../../common/constants';
+import { showSecurityToast } from '../alerts/lib/security_toasts';
 
 function formatClusters(clusters) {
   return clusters.map(formatCluster);
@@ -66,7 +67,8 @@ export function monitoringClustersProvider($injector) {
       return getClusters().then((clusters) => {
         if (clusters.length) {
           return ensureAlertsEnabled()
-            .then(() => {
+            .then(({ data }) => {
+              showSecurityToast(data);
               once = true;
               return clusters;
             })
diff --git a/x-pack/plugins/monitoring/server/alerts/base_alert.test.ts b/x-pack/plugins/monitoring/server/alerts/base_alert.test.ts
index 8fd31db421a30..c256cce362ff8 100644
--- a/x-pack/plugins/monitoring/server/alerts/base_alert.test.ts
+++ b/x-pack/plugins/monitoring/server/alerts/base_alert.test.ts
@@ -63,7 +63,7 @@ describe('BaseAlert', () => {
             interval: '1m',
           },
           tags: [],
-          throttle: '1m',
+          throttle: '1d',
         },
       });
     });
diff --git a/x-pack/plugins/monitoring/server/alerts/base_alert.ts b/x-pack/plugins/monitoring/server/alerts/base_alert.ts
index 622ee7dc51af1..cac57f599633d 100644
--- a/x-pack/plugins/monitoring/server/alerts/base_alert.ts
+++ b/x-pack/plugins/monitoring/server/alerts/base_alert.ts
@@ -40,7 +40,7 @@ import { MonitoringLicenseService } from '../types';
 export class BaseAlert {
   public type!: string;
   public label!: string;
-  public defaultThrottle: string = '1m';
+  public defaultThrottle: string = '1d';
   public defaultInterval: string = '1m';
   public rawAlert: Alert | undefined;
   public isLegacy: boolean = false;
diff --git a/x-pack/plugins/monitoring/server/alerts/cluster_health_alert.test.ts b/x-pack/plugins/monitoring/server/alerts/cluster_health_alert.test.ts
index 10b75c43ac879..f25179fa63c2f 100644
--- a/x-pack/plugins/monitoring/server/alerts/cluster_health_alert.test.ts
+++ b/x-pack/plugins/monitoring/server/alerts/cluster_health_alert.test.ts
@@ -22,7 +22,7 @@ describe('ClusterHealthAlert', () => {
     const alert = new ClusterHealthAlert();
     expect(alert.type).toBe(ALERT_CLUSTER_HEALTH);
     expect(alert.label).toBe('Cluster health');
-    expect(alert.defaultThrottle).toBe('1m');
+    expect(alert.defaultThrottle).toBe('1d');
     // @ts-ignore
     expect(alert.actionVariables).toStrictEqual([
       {
diff --git a/x-pack/plugins/monitoring/server/alerts/cpu_usage_alert.test.ts b/x-pack/plugins/monitoring/server/alerts/cpu_usage_alert.test.ts
index f0d11abab1492..1a66560ae124a 100644
--- a/x-pack/plugins/monitoring/server/alerts/cpu_usage_alert.test.ts
+++ b/x-pack/plugins/monitoring/server/alerts/cpu_usage_alert.test.ts
@@ -22,9 +22,9 @@ describe('CpuUsageAlert', () => {
     const alert = new CpuUsageAlert();
     expect(alert.type).toBe(ALERT_CPU_USAGE);
     expect(alert.label).toBe('CPU Usage');
-    expect(alert.defaultThrottle).toBe('1m');
+    expect(alert.defaultThrottle).toBe('1d');
     // @ts-ignore
-    expect(alert.defaultParams).toStrictEqual({ threshold: 90, duration: '5m' });
+    expect(alert.defaultParams).toStrictEqual({ threshold: 85, duration: '5m' });
     // @ts-ignore
     expect(alert.actionVariables).toStrictEqual([
       {
diff --git a/x-pack/plugins/monitoring/server/alerts/cpu_usage_alert.ts b/x-pack/plugins/monitoring/server/alerts/cpu_usage_alert.ts
index 9171745fba747..b543a4c976377 100644
--- a/x-pack/plugins/monitoring/server/alerts/cpu_usage_alert.ts
+++ b/x-pack/plugins/monitoring/server/alerts/cpu_usage_alert.ts
@@ -39,7 +39,7 @@ const FIRING = i18n.translate('xpack.monitoring.alerts.cpuUsage.firing', {
   defaultMessage: 'firing',
 });
 
-const DEFAULT_THRESHOLD = 90;
+const DEFAULT_THRESHOLD = 85;
 const DEFAULT_DURATION = '5m';
 
 interface CpuUsageParams {
@@ -393,7 +393,16 @@ export class CpuUsageAlert extends BaseAlert {
         continue;
       }
 
-      const instance = services.alertInstanceFactory(`${this.type}:${cluster.clusterUuid}`);
+      const firingNodeUuids = nodes.reduce((list: string[], node) => {
+        const stat = node.meta as AlertCpuUsageNodeStats;
+        if (node.shouldFire) {
+          list.push(stat.nodeId);
+        }
+        return list;
+      }, [] as string[]);
+      firingNodeUuids.sort(); // It doesn't matter how we sort, but keep the order consistent
+      const instanceId = `${this.type}:${cluster.clusterUuid}:${firingNodeUuids.join(',')}`;
+      const instance = services.alertInstanceFactory(instanceId);
       const state = (instance.getState() as unknown) as AlertInstanceState;
       const alertInstanceState: AlertInstanceState = { alertStates: state?.alertStates || [] };
       let shouldExecuteActions = false;
diff --git a/x-pack/plugins/monitoring/server/alerts/elasticsearch_version_mismatch_alert.test.ts b/x-pack/plugins/monitoring/server/alerts/elasticsearch_version_mismatch_alert.test.ts
index 44684939ca261..50bf40825c515 100644
--- a/x-pack/plugins/monitoring/server/alerts/elasticsearch_version_mismatch_alert.test.ts
+++ b/x-pack/plugins/monitoring/server/alerts/elasticsearch_version_mismatch_alert.test.ts
@@ -22,7 +22,7 @@ describe('ElasticsearchVersionMismatchAlert', () => {
     const alert = new ElasticsearchVersionMismatchAlert();
     expect(alert.type).toBe(ALERT_ELASTICSEARCH_VERSION_MISMATCH);
     expect(alert.label).toBe('Elasticsearch version mismatch');
-    expect(alert.defaultThrottle).toBe('1m');
+    expect(alert.defaultThrottle).toBe('1d');
     // @ts-ignore
     expect(alert.actionVariables).toStrictEqual([
       {
diff --git a/x-pack/plugins/monitoring/server/alerts/kibana_version_mismatch_alert.test.ts b/x-pack/plugins/monitoring/server/alerts/kibana_version_mismatch_alert.test.ts
index 6c56c7aa08d71..1a76fae9fc420 100644
--- a/x-pack/plugins/monitoring/server/alerts/kibana_version_mismatch_alert.test.ts
+++ b/x-pack/plugins/monitoring/server/alerts/kibana_version_mismatch_alert.test.ts
@@ -22,7 +22,7 @@ describe('KibanaVersionMismatchAlert', () => {
     const alert = new KibanaVersionMismatchAlert();
     expect(alert.type).toBe(ALERT_KIBANA_VERSION_MISMATCH);
     expect(alert.label).toBe('Kibana version mismatch');
-    expect(alert.defaultThrottle).toBe('1m');
+    expect(alert.defaultThrottle).toBe('1d');
     // @ts-ignore
     expect(alert.actionVariables).toStrictEqual([
       {
diff --git a/x-pack/plugins/monitoring/server/alerts/license_expiration_alert.test.ts b/x-pack/plugins/monitoring/server/alerts/license_expiration_alert.test.ts
index 09173df1d88b1..0f677dcc9c120 100644
--- a/x-pack/plugins/monitoring/server/alerts/license_expiration_alert.test.ts
+++ b/x-pack/plugins/monitoring/server/alerts/license_expiration_alert.test.ts
@@ -29,7 +29,7 @@ describe('LicenseExpirationAlert', () => {
     const alert = new LicenseExpirationAlert();
     expect(alert.type).toBe(ALERT_LICENSE_EXPIRATION);
     expect(alert.label).toBe('License expiration');
-    expect(alert.defaultThrottle).toBe('1m');
+    expect(alert.defaultThrottle).toBe('1d');
     // @ts-ignore
     expect(alert.actionVariables).toStrictEqual([
       {
diff --git a/x-pack/plugins/monitoring/server/alerts/logstash_version_mismatch_alert.test.ts b/x-pack/plugins/monitoring/server/alerts/logstash_version_mismatch_alert.test.ts
index 3f6d38809a949..f29c199b3f1e1 100644
--- a/x-pack/plugins/monitoring/server/alerts/logstash_version_mismatch_alert.test.ts
+++ b/x-pack/plugins/monitoring/server/alerts/logstash_version_mismatch_alert.test.ts
@@ -22,7 +22,7 @@ describe('LogstashVersionMismatchAlert', () => {
     const alert = new LogstashVersionMismatchAlert();
     expect(alert.type).toBe(ALERT_LOGSTASH_VERSION_MISMATCH);
     expect(alert.label).toBe('Logstash version mismatch');
-    expect(alert.defaultThrottle).toBe('1m');
+    expect(alert.defaultThrottle).toBe('1d');
     // @ts-ignore
     expect(alert.actionVariables).toStrictEqual([
       {
diff --git a/x-pack/plugins/monitoring/server/alerts/nodes_changed_alert.test.ts b/x-pack/plugins/monitoring/server/alerts/nodes_changed_alert.test.ts
index 13c3dbbbe6e8a..d45d404b38304 100644
--- a/x-pack/plugins/monitoring/server/alerts/nodes_changed_alert.test.ts
+++ b/x-pack/plugins/monitoring/server/alerts/nodes_changed_alert.test.ts
@@ -29,7 +29,7 @@ describe('NodesChangedAlert', () => {
     const alert = new NodesChangedAlert();
     expect(alert.type).toBe(ALERT_NODES_CHANGED);
     expect(alert.label).toBe('Nodes changed');
-    expect(alert.defaultThrottle).toBe('1m');
+    expect(alert.defaultThrottle).toBe('1d');
     // @ts-ignore
     expect(alert.actionVariables).toStrictEqual([
       {
diff --git a/x-pack/plugins/monitoring/server/alerts/nodes_changed_alert.ts b/x-pack/plugins/monitoring/server/alerts/nodes_changed_alert.ts
index 5b38503c7ece4..73f3ee055c928 100644
--- a/x-pack/plugins/monitoring/server/alerts/nodes_changed_alert.ts
+++ b/x-pack/plugins/monitoring/server/alerts/nodes_changed_alert.ts
@@ -155,6 +155,21 @@ export class NodesChangedAlert extends BaseAlert {
       };
     }
 
+    if (
+      Object.values(states.added).length === 0 &&
+      Object.values(states.removed).length === 0 &&
+      Object.values(states.restarted).length === 0
+    ) {
+      return {
+        text: i18n.translate(
+          'xpack.monitoring.alerts.nodesChanged.ui.nothingDetectedFiringMessage',
+          {
+            defaultMessage: `Elasticsearch nodes have changed`,
+          }
+        ),
+      };
+    }
+
     const addedText =
       Object.values(states.added).length > 0
         ? i18n.translate('xpack.monitoring.alerts.nodesChanged.ui.addedFiringMessage', {
diff --git a/x-pack/plugins/monitoring/server/lib/elasticsearch/verify_alerting_security.ts b/x-pack/plugins/monitoring/server/lib/elasticsearch/verify_alerting_security.ts
new file mode 100644
index 0000000000000..047b14bd37fbc
--- /dev/null
+++ b/x-pack/plugins/monitoring/server/lib/elasticsearch/verify_alerting_security.ts
@@ -0,0 +1,49 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { RequestHandlerContext } from 'kibana/server';
+import { EncryptedSavedObjectsPluginSetup } from '../../../../encrypted_saved_objects/server';
+
+export interface AlertingFrameworkHealth {
+  isSufficientlySecure: boolean;
+  hasPermanentEncryptionKey: boolean;
+}
+
+export interface XPackUsageSecurity {
+  security?: {
+    enabled?: boolean;
+    ssl?: {
+      http?: {
+        enabled?: boolean;
+      };
+    };
+  };
+}
+
+export class AlertingSecurity {
+  public static readonly getSecurityHealth = async (
+    context: RequestHandlerContext,
+    encryptedSavedObjects: EncryptedSavedObjectsPluginSetup
+  ): Promise<AlertingFrameworkHealth> => {
+    const {
+      security: {
+        enabled: isSecurityEnabled = false,
+        ssl: { http: { enabled: isTLSEnabled = false } = {} } = {},
+      } = {},
+    }: XPackUsageSecurity = await context.core.elasticsearch.legacy.client.callAsInternalUser(
+      'transport.request',
+      {
+        method: 'GET',
+        path: '/_xpack/usage',
+      }
+    );
+
+    return {
+      isSufficientlySecure: !isSecurityEnabled || (isSecurityEnabled && isTLSEnabled),
+      hasPermanentEncryptionKey: !encryptedSavedObjects.usingEphemeralEncryptionKey,
+    };
+  };
+}
diff --git a/x-pack/plugins/monitoring/server/plugin.ts b/x-pack/plugins/monitoring/server/plugin.ts
index 5f358badde401..39ec5fe1ffaa7 100644
--- a/x-pack/plugins/monitoring/server/plugin.ts
+++ b/x-pack/plugins/monitoring/server/plugin.ts
@@ -203,6 +203,7 @@ export class Plugin {
       requireUIRoutes(this.monitoringCore, {
         router,
         licenseService: this.licenseService,
+        encryptedSavedObjects: plugins.encryptedSavedObjects,
       });
       initInfraSource(config, plugins.infra);
     }
diff --git a/x-pack/plugins/monitoring/server/routes/api/v1/alerts/enable.ts b/x-pack/plugins/monitoring/server/routes/api/v1/alerts/enable.ts
index 1d83644fce756..64beb5c58dc07 100644
--- a/x-pack/plugins/monitoring/server/routes/api/v1/alerts/enable.ts
+++ b/x-pack/plugins/monitoring/server/routes/api/v1/alerts/enable.ts
@@ -10,19 +10,36 @@ import { AlertsFactory } from '../../../../alerts';
 import { RouteDependencies } from '../../../../types';
 import { ALERT_ACTION_TYPE_LOG } from '../../../../../common/constants';
 import { ActionResult } from '../../../../../../actions/common';
-// import { fetchDefaultEmailAddress } from '../../../../lib/alerts/fetch_default_email_address';
+import { AlertingSecurity } from '../../../../lib/elasticsearch/verify_alerting_security';
 
 const DEFAULT_SERVER_LOG_NAME = 'Monitoring: Write to Kibana log';
 
-export function enableAlertsRoute(server: any, npRoute: RouteDependencies) {
+export function enableAlertsRoute(_server: unknown, npRoute: RouteDependencies) {
   npRoute.router.post(
     {
       path: '/api/monitoring/v1/alerts/enable',
-      options: { tags: ['access:monitoring'] },
       validate: false,
     },
-    async (context, request, response) => {
+    async (context, _request, response) => {
       try {
+        const alerts = AlertsFactory.getAll().filter((a) => a.isEnabled(npRoute.licenseService));
+
+        if (alerts.length) {
+          const {
+            isSufficientlySecure,
+            hasPermanentEncryptionKey,
+          } = await AlertingSecurity.getSecurityHealth(context, npRoute.encryptedSavedObjects);
+
+          if (!isSufficientlySecure || !hasPermanentEncryptionKey) {
+            return response.ok({
+              body: {
+                isSufficientlySecure,
+                hasPermanentEncryptionKey,
+              },
+            });
+          }
+        }
+
         const alertsClient = context.alerting?.getAlertsClient();
         const actionsClient = context.actions?.getActionsClient();
         const types = context.actions?.listTypes();
@@ -58,7 +75,6 @@ export function enableAlertsRoute(server: any, npRoute: RouteDependencies) {
           },
         ];
 
-        const alerts = AlertsFactory.getAll().filter((a) => a.isEnabled(npRoute.licenseService));
         const createdAlerts = await Promise.all(
           alerts.map(
             async (alert) => await alert.createIfDoesNotExist(alertsClient, actionsClient, actions)
diff --git a/x-pack/plugins/monitoring/server/routes/api/v1/alerts/status.ts b/x-pack/plugins/monitoring/server/routes/api/v1/alerts/status.ts
index eef99bbc4ac68..78daa5e47c49f 100644
--- a/x-pack/plugins/monitoring/server/routes/api/v1/alerts/status.ts
+++ b/x-pack/plugins/monitoring/server/routes/api/v1/alerts/status.ts
@@ -15,7 +15,6 @@ export function alertStatusRoute(server: any, npRoute: RouteDependencies) {
   npRoute.router.post(
     {
       path: '/api/monitoring/v1/alert/{clusterUuid}/status',
-      options: { tags: ['access:monitoring'] },
       validate: {
         params: schema.object({
           clusterUuid: schema.string(),
diff --git a/x-pack/plugins/monitoring/server/types.ts b/x-pack/plugins/monitoring/server/types.ts
index 0c346c8082475..1e7a5acb33644 100644
--- a/x-pack/plugins/monitoring/server/types.ts
+++ b/x-pack/plugins/monitoring/server/types.ts
@@ -16,6 +16,7 @@ import {
 import { InfraPluginSetup } from '../../infra/server';
 import { LicensingPluginSetup } from '../../licensing/server';
 import { PluginSetupContract as FeaturesPluginSetupContract } from '../../features/server';
+import { EncryptedSavedObjectsPluginSetup } from '../../encrypted_saved_objects/server';
 
 export interface MonitoringLicenseService {
   refresh: () => Promise<any>;
@@ -36,6 +37,7 @@ export interface LegacyAPI {
 }
 
 export interface PluginsSetup {
+  encryptedSavedObjects: EncryptedSavedObjectsPluginSetup;
   telemetryCollectionManager?: TelemetryCollectionManagerPluginSetup;
   usageCollection?: UsageCollectionSetup;
   licensing: LicensingPluginSetup;
@@ -56,6 +58,7 @@ export interface MonitoringCoreConfig {
 export interface RouteDependencies {
   router: IRouter;
   licenseService: MonitoringLicenseService;
+  encryptedSavedObjects: EncryptedSavedObjectsPluginSetup;
 }
 
 export interface MonitoringCore {
diff --git a/x-pack/plugins/observability/public/application/index.tsx b/x-pack/plugins/observability/public/application/index.tsx
index 8cfbca37e8d05..d76c033a41756 100644
--- a/x-pack/plugins/observability/public/application/index.tsx
+++ b/x-pack/plugins/observability/public/application/index.tsx
@@ -3,18 +3,31 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
+import { i18n } from '@kbn/i18n';
 import { createHashHistory } from 'history';
 import React, { useEffect } from 'react';
 import ReactDOM from 'react-dom';
 import { Route, Router, Switch } from 'react-router-dom';
-import { i18n } from '@kbn/i18n';
-import { RedirectAppLinks } from '../../../../../src/plugins/kibana_react/public';
 import { AppMountParameters, CoreStart } from '../../../../../src/core/public';
+import { RedirectAppLinks } from '../../../../../src/plugins/kibana_react/public';
 import { EuiThemeProvider } from '../../../../legacy/common/eui_styled_components';
 import { PluginContext } from '../context/plugin_context';
-import { useRouteParams } from '../hooks/use_route_params';
-import { routes } from '../routes';
 import { usePluginContext } from '../hooks/use_plugin_context';
+import { useRouteParams } from '../hooks/use_route_params';
+import { Breadcrumbs, routes } from '../routes';
+
+const observabilityLabelBreadcrumb = {
+  text: i18n.translate('xpack.observability.observability.breadcrumb.', {
+    defaultMessage: 'Observability',
+  }),
+};
+
+function getTitleFromBreadCrumbs(breadcrumbs: Breadcrumbs) {
+  return breadcrumbs
+    .map(({ text }) => text)
+    .reverse()
+    .join(' | ');
+}
 
 const App = () => {
   return (
@@ -25,16 +38,12 @@ const App = () => {
           const route = routes[path];
           const Wrapper = () => {
             const { core } = usePluginContext();
+
+            const breadcrumb = [observabilityLabelBreadcrumb, ...route.breadcrumb];
             useEffect(() => {
-              core.chrome.setBreadcrumbs([
-                {
-                  text: i18n.translate('xpack.observability.observability.breadcrumb.', {
-                    defaultMessage: 'Observability',
-                  }),
-                },
-                ...route.breadcrumb,
-              ]);
-            }, [core]);
+              core.chrome.setBreadcrumbs(breadcrumb);
+              document.title = getTitleFromBreadCrumbs(breadcrumb);
+            }, [core, breadcrumb]);
 
             const { query, path: pathParams } = useRouteParams(route.params);
             return route.handler({ query, path: pathParams });
diff --git a/x-pack/plugins/observability/public/components/app/header/index.tsx b/x-pack/plugins/observability/public/components/app/header/index.tsx
index 1c6ce766d0901..531e6abf3d236 100644
--- a/x-pack/plugins/observability/public/components/app/header/index.tsx
+++ b/x-pack/plugins/observability/public/components/app/header/index.tsx
@@ -69,10 +69,7 @@ export const Header = ({
           </EuiFlexItem>
           {showGiveFeedback && (
             <EuiFlexItem style={{ alignItems: 'flex-end' }} grow={false}>
-              <EuiButtonEmpty
-                href={'https://discuss.elastic.co/c/observability/'}
-                iconType="popout"
-              >
+              <EuiButtonEmpty href={'https://ela.st/observability-discuss'} iconType="popout">
                 {i18n.translate('xpack.observability.home.feedback', {
                   defaultMessage: 'Give us feedback',
                 })}
diff --git a/x-pack/plugins/observability/public/components/app/ingest_manager_panel/index.tsx b/x-pack/plugins/observability/public/components/app/ingest_manager_panel/index.tsx
index f7a1deb83fbe4..41bcfa1da7fa1 100644
--- a/x-pack/plugins/observability/public/components/app/ingest_manager_panel/index.tsx
+++ b/x-pack/plugins/observability/public/components/app/ingest_manager_panel/index.tsx
@@ -40,7 +40,7 @@ export const IngestManagerPanel = () => {
           </EuiText>
         </EuiFlexItem>
         <EuiFlexItem>
-          <EuiLink href="https://www.elastic.co/blog/introducing-elastic-agent-and-ingest-manager">
+          <EuiLink href="https://ela.st/ingest-manager-announcement">
             {i18n.translate('xpack.observability.ingestManafer.button', {
               defaultMessage: 'Try Ingest Manager Beta',
             })}
diff --git a/x-pack/plugins/observability/public/components/app/resources/index.tsx b/x-pack/plugins/observability/public/components/app/resources/index.tsx
index c330c358d022a..929802df3329b 100644
--- a/x-pack/plugins/observability/public/components/app/resources/index.tsx
+++ b/x-pack/plugins/observability/public/components/app/resources/index.tsx
@@ -13,21 +13,21 @@ const resources = [
     label: i18n.translate('xpack.observability.resources.documentation', {
       defaultMessage: 'Documentation',
     }),
-    href: 'https://www.elastic.co/guide/en/observability/current/observability-ui.html',
+    href: 'https://ela.st/observability-documentation',
   },
   {
     iconType: 'editorComment',
     label: i18n.translate('xpack.observability.resources.forum', {
       defaultMessage: 'Discuss forum',
     }),
-    href: 'https://discuss.elastic.co/c/observability/',
+    href: 'https://ela.st/observability-discuss',
   },
   {
     iconType: 'training',
     label: i18n.translate('xpack.observability.resources.training', {
       defaultMessage: 'Observability fundamentals',
     }),
-    href: 'https://www.elastic.co/training/observability-fundamentals',
+    href: 'https://ela.st/observability-training',
   },
 ];
 
diff --git a/x-pack/plugins/observability/public/data_handler.test.ts b/x-pack/plugins/observability/public/data_handler.test.ts
index 7170ffe1486dc..935fc0682c414 100644
--- a/x-pack/plugins/observability/public/data_handler.test.ts
+++ b/x-pack/plugins/observability/public/data_handler.test.ts
@@ -3,8 +3,19 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import { registerDataHandler, getDataHandler } from './data_handler';
+import {
+  registerDataHandler,
+  getDataHandler,
+  unregisterDataHandler,
+  fetchHasData,
+} from './data_handler';
 import moment from 'moment';
+import {
+  ApmFetchDataResponse,
+  LogsFetchDataResponse,
+  MetricsFetchDataResponse,
+  UptimeFetchDataResponse,
+} from './typings';
 
 const params = {
   absoluteTime: {
@@ -19,6 +30,16 @@ const params = {
 };
 
 describe('registerDataHandler', () => {
+  const originalConsole = global.console;
+  beforeAll(() => {
+    // mocks console to avoid poluting the test output
+    global.console = ({ error: jest.fn() } as unknown) as typeof console;
+  });
+
+  afterAll(() => {
+    global.console = originalConsole;
+  });
+
   describe('APM', () => {
     registerDataHandler({
       appName: 'apm',
@@ -369,4 +390,163 @@ describe('registerDataHandler', () => {
       expect(hasData).toBeTruthy();
     });
   });
+  describe('fetchHasData', () => {
+    it('returns false when an exception happens', async () => {
+      unregisterDataHandler({ appName: 'apm' });
+      unregisterDataHandler({ appName: 'infra_logs' });
+      unregisterDataHandler({ appName: 'infra_metrics' });
+      unregisterDataHandler({ appName: 'uptime' });
+
+      registerDataHandler({
+        appName: 'apm',
+        fetchData: async () => (({} as unknown) as ApmFetchDataResponse),
+        hasData: async () => {
+          throw new Error('BOOM');
+        },
+      });
+      registerDataHandler({
+        appName: 'infra_logs',
+        fetchData: async () => (({} as unknown) as LogsFetchDataResponse),
+        hasData: async () => {
+          throw new Error('BOOM');
+        },
+      });
+      registerDataHandler({
+        appName: 'infra_metrics',
+        fetchData: async () => (({} as unknown) as MetricsFetchDataResponse),
+        hasData: async () => {
+          throw new Error('BOOM');
+        },
+      });
+      registerDataHandler({
+        appName: 'uptime',
+        fetchData: async () => (({} as unknown) as UptimeFetchDataResponse),
+        hasData: async () => {
+          throw new Error('BOOM');
+        },
+      });
+      expect(await fetchHasData()).toEqual({
+        apm: false,
+        uptime: false,
+        infra_logs: false,
+        infra_metrics: false,
+      });
+    });
+    it('returns true when has data and false when an exception happens', async () => {
+      unregisterDataHandler({ appName: 'apm' });
+      unregisterDataHandler({ appName: 'infra_logs' });
+      unregisterDataHandler({ appName: 'infra_metrics' });
+      unregisterDataHandler({ appName: 'uptime' });
+
+      registerDataHandler({
+        appName: 'apm',
+        fetchData: async () => (({} as unknown) as ApmFetchDataResponse),
+        hasData: async () => true,
+      });
+      registerDataHandler({
+        appName: 'infra_logs',
+        fetchData: async () => (({} as unknown) as LogsFetchDataResponse),
+        hasData: async () => true,
+      });
+      registerDataHandler({
+        appName: 'infra_metrics',
+        fetchData: async () => (({} as unknown) as MetricsFetchDataResponse),
+        hasData: async () => {
+          throw new Error('BOOM');
+        },
+      });
+      registerDataHandler({
+        appName: 'uptime',
+        fetchData: async () => (({} as unknown) as UptimeFetchDataResponse),
+        hasData: async () => {
+          throw new Error('BOOM');
+        },
+      });
+      expect(await fetchHasData()).toEqual({
+        apm: true,
+        uptime: false,
+        infra_logs: true,
+        infra_metrics: false,
+      });
+    });
+    it('returns true when has data', async () => {
+      unregisterDataHandler({ appName: 'apm' });
+      unregisterDataHandler({ appName: 'infra_logs' });
+      unregisterDataHandler({ appName: 'infra_metrics' });
+      unregisterDataHandler({ appName: 'uptime' });
+
+      registerDataHandler({
+        appName: 'apm',
+        fetchData: async () => (({} as unknown) as ApmFetchDataResponse),
+        hasData: async () => true,
+      });
+      registerDataHandler({
+        appName: 'infra_logs',
+        fetchData: async () => (({} as unknown) as LogsFetchDataResponse),
+        hasData: async () => true,
+      });
+      registerDataHandler({
+        appName: 'infra_metrics',
+        fetchData: async () => (({} as unknown) as MetricsFetchDataResponse),
+        hasData: async () => true,
+      });
+      registerDataHandler({
+        appName: 'uptime',
+        fetchData: async () => (({} as unknown) as UptimeFetchDataResponse),
+        hasData: async () => true,
+      });
+      expect(await fetchHasData()).toEqual({
+        apm: true,
+        uptime: true,
+        infra_logs: true,
+        infra_metrics: true,
+      });
+    });
+    it('returns false when has no data', async () => {
+      unregisterDataHandler({ appName: 'apm' });
+      unregisterDataHandler({ appName: 'infra_logs' });
+      unregisterDataHandler({ appName: 'infra_metrics' });
+      unregisterDataHandler({ appName: 'uptime' });
+
+      registerDataHandler({
+        appName: 'apm',
+        fetchData: async () => (({} as unknown) as ApmFetchDataResponse),
+        hasData: async () => false,
+      });
+      registerDataHandler({
+        appName: 'infra_logs',
+        fetchData: async () => (({} as unknown) as LogsFetchDataResponse),
+        hasData: async () => false,
+      });
+      registerDataHandler({
+        appName: 'infra_metrics',
+        fetchData: async () => (({} as unknown) as MetricsFetchDataResponse),
+        hasData: async () => false,
+      });
+      registerDataHandler({
+        appName: 'uptime',
+        fetchData: async () => (({} as unknown) as UptimeFetchDataResponse),
+        hasData: async () => false,
+      });
+      expect(await fetchHasData()).toEqual({
+        apm: false,
+        uptime: false,
+        infra_logs: false,
+        infra_metrics: false,
+      });
+    });
+    it('returns false when has data was not registered', async () => {
+      unregisterDataHandler({ appName: 'apm' });
+      unregisterDataHandler({ appName: 'infra_logs' });
+      unregisterDataHandler({ appName: 'infra_metrics' });
+      unregisterDataHandler({ appName: 'uptime' });
+
+      expect(await fetchHasData()).toEqual({
+        apm: false,
+        uptime: false,
+        infra_logs: false,
+        infra_metrics: false,
+      });
+    });
+  });
 });
diff --git a/x-pack/plugins/observability/public/data_handler.ts b/x-pack/plugins/observability/public/data_handler.ts
index 73e34f214da28..834d7a52d767f 100644
--- a/x-pack/plugins/observability/public/data_handler.ts
+++ b/x-pack/plugins/observability/public/data_handler.ts
@@ -28,9 +28,27 @@ export function getDataHandler<T extends ObservabilityApp>(appName: T) {
   }
 }
 
-export async function fetchHasData() {
+export async function fetchHasData(): Promise<Record<ObservabilityApp, boolean>> {
   const apps: ObservabilityApp[] = ['apm', 'uptime', 'infra_logs', 'infra_metrics'];
-  const promises = apps.map((app) => getDataHandler(app)?.hasData());
-  const [apm, uptime, logs, metrics] = await Promise.allSettled(promises);
-  return { apm, uptime, infra_logs: logs, infra_metrics: metrics };
+
+  const promises = apps.map(async (app) => getDataHandler(app)?.hasData() || false);
+
+  const results = await Promise.allSettled(promises);
+
+  const [apm, uptime, logs, metrics] = results.map((result) => {
+    if (result.status === 'fulfilled') {
+      return result.value;
+    }
+
+    // eslint-disable-next-line no-console
+    console.error('Error while fetching has data', result.reason);
+    return false;
+  });
+
+  return {
+    apm,
+    uptime,
+    infra_logs: logs,
+    infra_metrics: metrics,
+  };
 }
diff --git a/x-pack/plugins/observability/public/pages/overview/empty_section.ts b/x-pack/plugins/observability/public/pages/overview/empty_section.ts
index e30eda9f3e056..0330ba5cc04b4 100644
--- a/x-pack/plugins/observability/public/pages/overview/empty_section.ts
+++ b/x-pack/plugins/observability/public/pages/overview/empty_section.ts
@@ -22,7 +22,7 @@ export const getEmptySections = ({ core }: { core: AppMountContext['core'] }): I
       linkTitle: i18n.translate('xpack.observability.emptySection.apps.logs.link', {
         defaultMessage: 'Install Filebeat',
       }),
-      href: 'https://www.elastic.co',
+      href: core.http.basePath.prepend('/app/home#/tutorial_directory/logging'),
     },
     {
       id: 'apm',
@@ -35,9 +35,9 @@ export const getEmptySections = ({ core }: { core: AppMountContext['core'] }): I
           'Trace transactions through a distributed architecture and map your services’ interactions to easily spot performance bottlenecks.',
       }),
       linkTitle: i18n.translate('xpack.observability.emptySection.apps.apm.link', {
-        defaultMessage: 'Install agent',
+        defaultMessage: 'Install Agent',
       }),
-      href: 'https://www.elastic.co',
+      href: core.http.basePath.prepend('/app/home#/tutorial/apm'),
     },
     {
       id: 'infra_metrics',
@@ -50,9 +50,9 @@ export const getEmptySections = ({ core }: { core: AppMountContext['core'] }): I
           'Analyze metrics from your infrastructure, apps, and services. Discover trends, forecast behavior, get alerts on anomalies, and more.',
       }),
       linkTitle: i18n.translate('xpack.observability.emptySection.apps.metrics.link', {
-        defaultMessage: 'Install metrics module',
+        defaultMessage: 'Install Metricbeat',
       }),
-      href: 'https://www.elastic.co',
+      href: core.http.basePath.prepend('/app/home#/tutorial_directory/metrics'),
     },
     {
       id: 'uptime',
@@ -67,7 +67,7 @@ export const getEmptySections = ({ core }: { core: AppMountContext['core'] }): I
       linkTitle: i18n.translate('xpack.observability.emptySection.apps.uptime.link', {
         defaultMessage: 'Install Heartbeat',
       }),
-      href: 'https://www.elastic.co',
+      href: core.http.basePath.prepend('/app/home#/tutorial/uptimeMonitors'),
     },
     {
       id: 'alert',
diff --git a/x-pack/plugins/observability/public/pages/overview/overview.stories.tsx b/x-pack/plugins/observability/public/pages/overview/overview.stories.tsx
index 896cad7b72ecd..79f3c63a98051 100644
--- a/x-pack/plugins/observability/public/pages/overview/overview.stories.tsx
+++ b/x-pack/plugins/observability/public/pages/overview/overview.stories.tsx
@@ -495,7 +495,7 @@ storiesOf('app/Overview', module)
       fetchData: fetchApmData,
       // @ts-ignore thows an error instead
       hasData: async () => {
-        new Error('Error has data');
+        throw new Error('Error has data');
       },
     });
     registerDataHandler({
@@ -503,7 +503,7 @@ storiesOf('app/Overview', module)
       fetchData: fetchLogsData,
       // @ts-ignore thows an error instead
       hasData: async () => {
-        new Error('Error has data');
+        throw new Error('Error has data');
       },
     });
     registerDataHandler({
@@ -511,7 +511,7 @@ storiesOf('app/Overview', module)
       fetchData: fetchMetricsData,
       // @ts-ignore thows an error instead
       hasData: async () => {
-        new Error('Error has data');
+        throw new Error('Error has data');
       },
     });
     registerDataHandler({
@@ -519,7 +519,7 @@ storiesOf('app/Overview', module)
       fetchData: fetchUptimeData,
       // @ts-ignore thows an error instead
       hasData: async () => {
-        new Error('Error has data');
+        throw new Error('Error has data');
       },
     });
     return (
@@ -545,7 +545,7 @@ storiesOf('app/Overview', module)
       fetchData: fetchApmData,
       // @ts-ignore thows an error instead
       hasData: async () => {
-        new Error('Error has data');
+        throw new Error('Error has data');
       },
     });
     registerDataHandler({
@@ -553,7 +553,7 @@ storiesOf('app/Overview', module)
       fetchData: fetchLogsData,
       // @ts-ignore thows an error instead
       hasData: async () => {
-        new Error('Error has data');
+        throw new Error('Error has data');
       },
     });
     registerDataHandler({
@@ -561,7 +561,7 @@ storiesOf('app/Overview', module)
       fetchData: fetchMetricsData,
       // @ts-ignore thows an error instead
       hasData: async () => {
-        new Error('Error has data');
+        throw new Error('Error has data');
       },
     });
     registerDataHandler({
@@ -569,7 +569,7 @@ storiesOf('app/Overview', module)
       fetchData: fetchUptimeData,
       // @ts-ignore thows an error instead
       hasData: async () => {
-        new Error('Error has data');
+        throw new Error('Error has data');
       },
     });
     return (
diff --git a/x-pack/plugins/observability/public/routes/index.tsx b/x-pack/plugins/observability/public/routes/index.tsx
index 10f9b4dc42723..bee6a4dd7133a 100644
--- a/x-pack/plugins/observability/public/routes/index.tsx
+++ b/x-pack/plugins/observability/public/routes/index.tsx
@@ -17,6 +17,8 @@ type DecodeParams<TParams extends Params | undefined> = {
   [key in keyof TParams]: TParams[key] extends t.Any ? t.TypeOf<TParams[key]> : never;
 };
 
+export type Breadcrumbs = Array<{ text: string }>;
+
 export interface Params {
   query?: t.HasProps;
   path?: t.HasProps;
diff --git a/x-pack/plugins/observability/public/services/get_news_feed.test.ts b/x-pack/plugins/observability/public/services/get_news_feed.test.ts
index 49eb2da803ab6..eca0108095b24 100644
--- a/x-pack/plugins/observability/public/services/get_news_feed.test.ts
+++ b/x-pack/plugins/observability/public/services/get_news_feed.test.ts
@@ -7,6 +7,15 @@ import { getNewsFeed } from './get_news_feed';
 import { AppMountContext } from 'kibana/public';
 
 describe('getNewsFeed', () => {
+  const originalConsole = global.console;
+  beforeAll(() => {
+    // mocks console to avoid poluting the test output
+    global.console = ({ error: jest.fn() } as unknown) as typeof console;
+  });
+
+  afterAll(() => {
+    global.console = originalConsole;
+  });
   it('Returns empty array when api throws exception', async () => {
     const core = ({
       http: {
diff --git a/x-pack/plugins/observability/public/services/get_observability_alerts.test.ts b/x-pack/plugins/observability/public/services/get_observability_alerts.test.ts
index 36ef1241983a5..64f5f4aab1c2b 100644
--- a/x-pack/plugins/observability/public/services/get_observability_alerts.test.ts
+++ b/x-pack/plugins/observability/public/services/get_observability_alerts.test.ts
@@ -10,6 +10,15 @@ import { getObservabilityAlerts } from './get_observability_alerts';
 const basePath = { prepend: (path: string) => path };
 
 describe('getObservabilityAlerts', () => {
+  const originalConsole = global.console;
+  beforeAll(() => {
+    // mocks console to avoid poluting the test output
+    global.console = ({ error: jest.fn() } as unknown) as typeof console;
+  });
+
+  afterAll(() => {
+    global.console = originalConsole;
+  });
   it('Returns empty array when api throws exception', async () => {
     const core = ({
       http: {
@@ -40,7 +49,43 @@ describe('getObservabilityAlerts', () => {
     expect(alerts).toEqual([]);
   });
 
-  it('Shows alerts from Observability', async () => {
+  it('Returns empty array when alerts are not allowed based on consumer type', async () => {
+    const core = ({
+      http: {
+        get: async () => {
+          return {
+            data: [
+              {
+                id: 1,
+                consumer: 'siem',
+              },
+              {
+                id: 2,
+                consumer: 'kibana',
+              },
+              {
+                id: 3,
+                consumer: 'index',
+              },
+              {
+                id: 4,
+                consumer: 'foo',
+              },
+              {
+                id: 5,
+                consumer: 'bar',
+              },
+            ],
+          };
+        },
+        basePath,
+      },
+    } as unknown) as AppMountContext['core'];
+    const alerts = await getObservabilityAlerts({ core });
+    expect(alerts).toEqual([]);
+  });
+
+  it('Shows alerts from Observability and Alerts', async () => {
     const core = ({
       http: {
         get: async () => {
@@ -66,6 +111,10 @@ describe('getObservabilityAlerts', () => {
                 id: 5,
                 consumer: 'metrics',
               },
+              {
+                id: 6,
+                consumer: 'alerts',
+              },
             ],
           };
         },
@@ -91,6 +140,10 @@ describe('getObservabilityAlerts', () => {
         id: 5,
         consumer: 'metrics',
       },
+      {
+        id: 6,
+        consumer: 'alerts',
+      },
     ]);
   });
 });
diff --git a/x-pack/plugins/observability/public/services/get_observability_alerts.ts b/x-pack/plugins/observability/public/services/get_observability_alerts.ts
index 58ff9c92acbff..fe5451597688a 100644
--- a/x-pack/plugins/observability/public/services/get_observability_alerts.ts
+++ b/x-pack/plugins/observability/public/services/get_observability_alerts.ts
@@ -7,6 +7,8 @@
 import { AppMountContext } from 'kibana/public';
 import { Alert } from '../../../alerts/common';
 
+const allowedConsumers = ['apm', 'uptime', 'logs', 'metrics', 'alerts'];
+
 export async function getObservabilityAlerts({ core }: { core: AppMountContext['core'] }) {
   try {
     const { data = [] }: { data: Alert[] } = await core.http.get(
@@ -19,11 +21,7 @@ export async function getObservabilityAlerts({ core }: { core: AppMountContext['
       }
     );
 
-    return data.filter(({ consumer }) => {
-      return (
-        consumer === 'apm' || consumer === 'uptime' || consumer === 'logs' || consumer === 'metrics'
-      );
-    });
+    return data.filter(({ consumer }) => allowedConsumers.includes(consumer));
   } catch (e) {
     // eslint-disable-next-line no-console
     console.error('Error while fetching alerts', e);
diff --git a/x-pack/plugins/security/server/authorization/privileges/feature_privilege_builder/navlink.ts b/x-pack/plugins/security/server/authorization/privileges/feature_privilege_builder/navlink.ts
index dd076477a9c11..f25632407be86 100644
--- a/x-pack/plugins/security/server/authorization/privileges/feature_privilege_builder/navlink.ts
+++ b/x-pack/plugins/security/server/authorization/privileges/feature_privilege_builder/navlink.ts
@@ -9,6 +9,9 @@ import { BaseFeaturePrivilegeBuilder } from './feature_privilege_builder';
 
 export class FeaturePrivilegeNavlinkBuilder extends BaseFeaturePrivilegeBuilder {
   public getActions(privilegeDefinition: FeatureKibanaPrivileges, feature: Feature): string[] {
-    return feature.navLinkId ? [this.actions.ui.get('navLinks', feature.navLinkId)] : [];
+    const appNavLinks = feature.app.map((app) => this.actions.ui.get('navLinks', app));
+    return feature.navLinkId
+      ? [this.actions.ui.get('navLinks', feature.navLinkId), ...appNavLinks]
+      : appNavLinks;
   }
 }
diff --git a/x-pack/plugins/security/server/authorization/privileges/privileges.test.ts b/x-pack/plugins/security/server/authorization/privileges/privileges.test.ts
index 8a499a3eba8fa..d8ece8f68d425 100644
--- a/x-pack/plugins/security/server/authorization/privileges/privileges.test.ts
+++ b/x-pack/plugins/security/server/authorization/privileges/privileges.test.ts
@@ -54,8 +54,20 @@ describe('features', () => {
 
     const actual = privileges.get();
     expect(actual).toHaveProperty('features.foo-feature', {
-      all: [actions.login, actions.version, actions.ui.get('navLinks', 'kibana:foo')],
-      read: [actions.login, actions.version, actions.ui.get('navLinks', 'kibana:foo')],
+      all: [
+        actions.login,
+        actions.version,
+        actions.ui.get('navLinks', 'kibana:foo'),
+        actions.ui.get('navLinks', 'app-1'),
+        actions.ui.get('navLinks', 'app-2'),
+      ],
+      read: [
+        actions.login,
+        actions.version,
+        actions.ui.get('navLinks', 'kibana:foo'),
+        actions.ui.get('navLinks', 'app-1'),
+        actions.ui.get('navLinks', 'app-2'),
+      ],
     });
   });
 
@@ -635,6 +647,8 @@ describe('reserved', () => {
     expect(actual).toHaveProperty('reserved.foo', [
       actions.version,
       actions.ui.get('navLinks', 'kibana:foo'),
+      actions.ui.get('navLinks', 'app-1'),
+      actions.ui.get('navLinks', 'app-2'),
     ]);
   });
 
diff --git a/x-pack/plugins/security_solution/common/detection_engine/utils.ts b/x-pack/plugins/security_solution/common/detection_engine/utils.ts
index fa1812235f897..153130fc16d60 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/utils.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/utils.ts
@@ -5,6 +5,7 @@
  */
 
 import { EntriesArray } from '../shared_imports';
+import { RuleType } from './types';
 
 export const hasLargeValueList = (entries: EntriesArray): boolean => {
   const found = entries.filter(({ type }) => type === 'list');
@@ -15,3 +16,5 @@ export const hasNestedEntry = (entries: EntriesArray): boolean => {
   const found = entries.filter(({ type }) => type === 'nested');
   return found.length > 0;
 };
+
+export const isThresholdRule = (ruleType: RuleType) => ruleType === 'threshold';
diff --git a/x-pack/plugins/security_solution/common/endpoint/models/event.ts b/x-pack/plugins/security_solution/common/endpoint/models/event.ts
index f8a6807196557..f53da8fb1f096 100644
--- a/x-pack/plugins/security_solution/common/endpoint/models/event.ts
+++ b/x-pack/plugins/security_solution/common/endpoint/models/event.ts
@@ -32,9 +32,9 @@ export function eventName(event: ResolverEvent): string {
   }
 }
 
-export function eventId(event: ResolverEvent): string {
+export function eventId(event: ResolverEvent): number | undefined | string {
   if (isLegacyEvent(event)) {
-    return event.endgame.serial_event_id ? String(event.endgame.serial_event_id) : '';
+    return event.endgame.serial_event_id;
   }
   return event.event.id;
 }
diff --git a/x-pack/plugins/security_solution/cypress/fixtures/overview.json b/x-pack/plugins/security_solution/cypress/fixtures/overview.json
index 893661a693043..69594b88b7515 100644
--- a/x-pack/plugins/security_solution/cypress/fixtures/overview.json
+++ b/x-pack/plugins/security_solution/cypress/fixtures/overview.json
@@ -33,6 +33,11 @@
         "winlogbeatMWSysmonOperational": 30,
         "__typename": "OverviewHostData"
       },
+      "status": {
+        "indicesExist": true,
+        "indexFields": [],
+        "__typename": "SourceStatus"
+      },
       "__typename": "Source"
     }
   }
diff --git a/x-pack/plugins/security_solution/cypress/integration/alerts.spec.ts b/x-pack/plugins/security_solution/cypress/integration/alerts.spec.ts
index 67186e1087d44..3de57b085a9c6 100644
--- a/x-pack/plugins/security_solution/cypress/integration/alerts.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/alerts.spec.ts
@@ -30,8 +30,7 @@ import { loginAndWaitForPage } from '../tasks/login';
 
 import { DETECTIONS_URL } from '../urls/navigation';
 
-// Flaky: https://github.com/elastic/kibana/issues/70727
-describe.skip('Alerts', () => {
+describe('Alerts', () => {
   context('Closing alerts', () => {
     beforeEach(() => {
       esArchiverLoad('alerts');
diff --git a/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_custom.spec.ts b/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_custom.spec.ts
index a51ad4388c428..ba1de0e40e270 100644
--- a/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_custom.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_custom.spec.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { newRule, totalNumberOfPrebuiltRulesInEsArchiveCustomRule } from '../objects/rule';
+import { newRule } from '../objects/rule';
 
 import {
   CUSTOM_RULES_BTN,
@@ -64,14 +64,13 @@ import { loginAndWaitForPageWithoutDateRange } from '../tasks/login';
 
 import { DETECTIONS_URL } from '../urls/navigation';
 
-// Flaky: https://github.com/elastic/kibana/issues/67814
-describe.skip('Detection rules, custom', () => {
+describe('Detection rules, custom', () => {
   before(() => {
-    esArchiverLoad('custom_rule_with_timeline');
+    esArchiverLoad('timeline');
   });
 
   after(() => {
-    esArchiverUnload('custom_rule_with_timeline');
+    esArchiverUnload('timeline');
   });
 
   it('Creates and activates a new custom rule', () => {
@@ -90,7 +89,7 @@ describe.skip('Detection rules, custom', () => {
     changeToThreeHundredRowsPerPage();
     waitForRulesToBeLoaded();
 
-    const expectedNumberOfRules = totalNumberOfPrebuiltRulesInEsArchiveCustomRule + 1;
+    const expectedNumberOfRules = 1;
     cy.get(RULES_TABLE).then(($table) => {
       cy.wrap($table.find(RULES_ROW).length).should('eql', expectedNumberOfRules);
     });
diff --git a/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_export.spec.ts b/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_export.spec.ts
index a7e6652613493..eb8448233c624 100644
--- a/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_export.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_export.spec.ts
@@ -17,8 +17,7 @@ import { DETECTIONS_URL } from '../urls/navigation';
 
 const EXPECTED_EXPORTED_RULE_FILE_PATH = 'cypress/test_files/expected_rules_export.ndjson';
 
-// Flakky: https://github.com/elastic/kibana/issues/69849
-describe.skip('Export rules', () => {
+describe('Export rules', () => {
   before(() => {
     esArchiverLoad('export_rule');
     cy.server();
diff --git a/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_prebuilt.spec.ts b/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_prebuilt.spec.ts
index 00ddc85a73650..986a7c7177a79 100644
--- a/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_prebuilt.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_prebuilt.spec.ts
@@ -67,8 +67,7 @@ describe('Alerts rules, prebuilt rules', () => {
   });
 });
 
-// https://github.com/elastic/kibana/issues/71814
-describe.skip('Deleting prebuilt rules', () => {
+describe('Deleting prebuilt rules', () => {
   beforeEach(() => {
     const expectedNumberOfRules = totalNumberOfPrebuiltRules;
     const expectedElasticRulesBtnText = `Elastic rules (${expectedNumberOfRules})`;
diff --git a/x-pack/plugins/security_solution/cypress/integration/alerts_timeline.spec.ts b/x-pack/plugins/security_solution/cypress/integration/alerts_timeline.spec.ts
index b37aabf4825fc..2fed23755963b 100644
--- a/x-pack/plugins/security_solution/cypress/integration/alerts_timeline.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/alerts_timeline.spec.ts
@@ -17,8 +17,7 @@ import { loginAndWaitForPage } from '../tasks/login';
 
 import { DETECTIONS_URL } from '../urls/navigation';
 
-// Flakky: https://github.com/elastic/kibana/issues/71220
-describe.skip('Alerts timeline', () => {
+describe('Alerts timeline', () => {
   beforeEach(() => {
     esArchiverLoad('timeline_alerts');
     loginAndWaitForPage(DETECTIONS_URL);
diff --git a/x-pack/plugins/security_solution/cypress/integration/events_viewer.spec.ts b/x-pack/plugins/security_solution/cypress/integration/events_viewer.spec.ts
index 843d99cf06cab..84ca1e20e9576 100644
--- a/x-pack/plugins/security_solution/cypress/integration/events_viewer.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/events_viewer.spec.ts
@@ -46,8 +46,7 @@ const defaultHeadersInDefaultEcsCategory = [
   { id: 'destination.ip' },
 ];
 
-// Flakky: https://github.com/elastic/kibana/issues/70757
-describe.skip('Events Viewer', () => {
+describe('Events Viewer', () => {
   context('Fields rendering', () => {
     before(() => {
       loginAndWaitForPage(HOSTS_URL);
diff --git a/x-pack/plugins/security_solution/cypress/integration/overview.spec.ts b/x-pack/plugins/security_solution/cypress/integration/overview.spec.ts
index 6fb3840d89764..b799d487acd08 100644
--- a/x-pack/plugins/security_solution/cypress/integration/overview.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/overview.spec.ts
@@ -11,7 +11,7 @@ import { loginAndWaitForPage } from '../tasks/login';
 
 import { OVERVIEW_URL } from '../urls/navigation';
 
-describe.skip('Overview Page', () => {
+describe('Overview Page', () => {
   before(() => {
     cy.stubSecurityApi('overview');
     loginAndWaitForPage(OVERVIEW_URL);
diff --git a/x-pack/plugins/security_solution/cypress/integration/timeline_toggle_column.spec.ts b/x-pack/plugins/security_solution/cypress/integration/timeline_toggle_column.spec.ts
index 759eec69bc022..12e6f3db9b61e 100644
--- a/x-pack/plugins/security_solution/cypress/integration/timeline_toggle_column.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/timeline_toggle_column.spec.ts
@@ -24,8 +24,7 @@ import {
 
 import { HOSTS_URL } from '../urls/navigation';
 
-// Flaky: https://github.com/elastic/kibana/issues/71361
-describe.skip('toggle column in timeline', () => {
+describe('toggle column in timeline', () => {
   before(() => {
     loginAndWaitForPage(HOSTS_URL);
   });
diff --git a/x-pack/plugins/security_solution/cypress/objects/rule.ts b/x-pack/plugins/security_solution/cypress/objects/rule.ts
index c9d3af57e5e59..a30fddc3c3a69 100644
--- a/x-pack/plugins/security_solution/cypress/objects/rule.ts
+++ b/x-pack/plugins/security_solution/cypress/objects/rule.ts
@@ -59,7 +59,7 @@ const mitre2: Mitre = {
 };
 
 export const newRule: CustomRule = {
-  customQuery: 'host.name: * ',
+  customQuery: 'host.name:*',
   name: 'New Rule Test',
   description: 'The new rule description.',
   severity: 'High',
@@ -69,7 +69,7 @@ export const newRule: CustomRule = {
   falsePositivesExamples: ['False1', 'False2'],
   mitre: [mitre1, mitre2],
   note: '# test markdown',
-  timelineId: '3270f530-bc84-11ea-b73f-89980a6a1ce7',
+  timelineId: '0162c130-78be-11ea-9718-118a926974a4',
 };
 
 export const machineLearningRule: MachineLearningRule = {
diff --git a/x-pack/plugins/security_solution/cypress/test_files/expected_rules_export.ndjson b/x-pack/plugins/security_solution/cypress/test_files/expected_rules_export.ndjson
index 7baa59fb3d8c0..b0ef52fc0b223 100644
--- a/x-pack/plugins/security_solution/cypress/test_files/expected_rules_export.ndjson
+++ b/x-pack/plugins/security_solution/cypress/test_files/expected_rules_export.ndjson
@@ -1,2 +1,2 @@
-{"author":[],"actions":[],"created_at":"2020-07-03T10:44:10.567Z","updated_at":"2020-07-03T10:44:10.941Z","created_by":"elastic","description":"Export rule","enabled":true,"false_positives":[],"filters":[],"from":"now-360s","id":"ad65b1b6-be18-4e41-9d0a-89d8576053d8","immutable":false,"index":["apm-*-transaction*","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*"],"interval":"5m","rule_id":"50a3776b-144d-4cff-9f1f-1173e0d5d4a4","language":"kuery","license":"","output_index":".siem-signals-default","max_signals":100,"risk_score":50,"risk_score_mapping":[],"rule_name_override":"","name":"Export rule","query":"host.name: * ","references":[],"meta":{"from":"1m","kibana_siem_app_url":"http://localhost:5620/app/security"},"severity":"low","severity_mapping":[],"updated_by":"elastic","tags":[],"to":"now","type":"query","threat":[],"throttle":"no_actions","timestamp_override":"","version":1,"exceptions_list":[]}
+{"author":[],"actions":[],"created_at":"2020-07-15T10:45:15.954Z","updated_at":"2020-07-15T10:45:16.874Z","created_by":"elastic","description":"Export rule","enabled":true,"false_positives":[],"filters":[],"from":"now-360s","id":"a4772daa-a3ef-44a3-8035-6abd1bf2893a","immutable":false,"index":["apm-*-transaction*","auditbeat-*","endgame-*","filebeat-*","logs-*","packetbeat-*","winlogbeat-*"],"interval":"5m","rule_id":"1b08a0c2-8243-463e-92c2-b464a8c97cd4","language":"kuery","license":"","output_index":".siem-signals-default","max_signals":100,"risk_score":50,"risk_score_mapping":[],"name":"Export rule","query":"host.name: *","references":[],"meta":{"from":"1m","kibana_siem_app_url":"http://localhost:5620/app/security/detections"},"severity":"low","severity_mapping":[],"updated_by":"elastic","tags":[],"to":"now","type":"query","threat":[],"throttle":"no_actions","version":1,"exceptions_list":[]}
 {"exported_count":1,"missing_rules":[],"missing_rules_count":0}
diff --git a/x-pack/plugins/security_solution/public/cases/components/add_comment/index.tsx b/x-pack/plugins/security_solution/public/cases/components/add_comment/index.tsx
index 980083e8e9d20..a54cf142c18b7 100644
--- a/x-pack/plugins/security_solution/public/cases/components/add_comment/index.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/add_comment/index.tsx
@@ -47,7 +47,7 @@ export const AddComment = React.memo<AddCommentProps>(
       options: { stripEmptyFields: false },
       schema,
     });
-
+    const { getFormData, setFieldValue, reset, submit } = form;
     const { handleCursorChange, handleOnTimelineChange } = useInsertTimeline<CommentRequest>(
       form,
       'comment'
@@ -55,26 +55,23 @@ export const AddComment = React.memo<AddCommentProps>(
 
     useEffect(() => {
       if (insertQuote !== null) {
-        const { comment } = form.getFormData();
-        form.setFieldValue(
-          'comment',
-          `${comment}${comment.length > 0 ? '\n\n' : ''}${insertQuote}`
-        );
+        const { comment } = getFormData();
+        setFieldValue('comment', `${comment}${comment.length > 0 ? '\n\n' : ''}${insertQuote}`);
       }
-    }, [form, insertQuote]);
+    }, [getFormData, insertQuote, setFieldValue]);
 
     const handleTimelineClick = useTimelineClick();
 
     const onSubmit = useCallback(async () => {
-      const { isValid, data } = await form.submit();
+      const { isValid, data } = await submit();
       if (isValid) {
         if (onCommentSaving != null) {
           onCommentSaving();
         }
         postComment(data, onCommentPosted);
-        form.reset();
+        reset();
       }
-    }, [form, onCommentPosted, onCommentSaving, postComment]);
+    }, [onCommentPosted, onCommentSaving, postComment, reset, submit]);
 
     return (
       <span id="add-comment-permLink">
diff --git a/x-pack/plugins/security_solution/public/cases/components/case_view/index.test.tsx b/x-pack/plugins/security_solution/public/cases/components/case_view/index.test.tsx
index b93df325b5a8b..4e29db4022e65 100644
--- a/x-pack/plugins/security_solution/public/cases/components/case_view/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/case_view/index.test.tsx
@@ -409,4 +409,32 @@ describe('CaseView ', () => {
       wrapper.find('button[data-test-subj="push-to-external-service"]').first().prop('disabled')
     ).toBeTruthy();
   });
+
+  it('should revert to the initial connector in case of failure', async () => {
+    updateCaseProperty.mockImplementation(({ onError }) => {
+      onError();
+    });
+    const wrapper = mount(
+      <TestProviders>
+        <Router history={mockHistory}>
+          <CaseComponent
+            {...caseProps}
+            caseData={{ ...caseProps.caseData, connectorId: 'servicenow-1' }}
+          />
+        </Router>
+      </TestProviders>
+    );
+    await wait();
+    wrapper.find('button[data-test-subj="dropdown-connectors"]').simulate('click');
+    wrapper.update();
+    wrapper.find('button[data-test-subj="dropdown-connector-servicenow-2"]').simulate('click');
+    wrapper.update();
+    wrapper.find(`[data-test-subj="edit-connectors-submit"]`).last().simulate('click');
+    wrapper.update();
+    await wait();
+    wrapper.update();
+    expect(
+      wrapper.find('[data-test-subj="dropdown-connectors"]').at(0).prop('valueOfSelected')
+    ).toBe('servicenow-1');
+  });
 });
diff --git a/x-pack/plugins/security_solution/public/cases/components/case_view/index.tsx b/x-pack/plugins/security_solution/public/cases/components/case_view/index.tsx
index 3718249479b63..b23169af6ceb3 100644
--- a/x-pack/plugins/security_solution/public/cases/components/case_view/index.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/case_view/index.tsx
@@ -44,6 +44,13 @@ interface Props {
   userCanCrud: boolean;
 }
 
+export interface OnUpdateFields {
+  key: keyof Case;
+  value: Case[keyof Case];
+  onSuccess?: () => void;
+  onError?: () => void;
+}
+
 const MyWrapper = styled.div`
   padding: ${({
     theme,
@@ -88,12 +95,12 @@ export const CaseComponent = React.memo<CaseProps>(
 
     // Update Fields
     const onUpdateField = useCallback(
-      (newUpdateKey: keyof Case, updateValue: Case[keyof Case]) => {
+      ({ key, value, onSuccess, onError }: OnUpdateFields) => {
         const handleUpdateNewCase = (newCase: Case) =>
           updateCase({ ...newCase, comments: caseData.comments });
-        switch (newUpdateKey) {
+        switch (key) {
           case 'title':
-            const titleUpdate = getTypedPayload<string>(updateValue);
+            const titleUpdate = getTypedPayload<string>(value);
             if (titleUpdate.length > 0) {
               updateCaseProperty({
                 fetchCaseUserActions,
@@ -101,11 +108,13 @@ export const CaseComponent = React.memo<CaseProps>(
                 updateValue: titleUpdate,
                 updateCase: handleUpdateNewCase,
                 version: caseData.version,
+                onSuccess,
+                onError,
               });
             }
             break;
           case 'connectorId':
-            const connectorId = getTypedPayload<string>(updateValue);
+            const connectorId = getTypedPayload<string>(value);
             if (connectorId.length > 0) {
               updateCaseProperty({
                 fetchCaseUserActions,
@@ -113,11 +122,13 @@ export const CaseComponent = React.memo<CaseProps>(
                 updateValue: connectorId,
                 updateCase: handleUpdateNewCase,
                 version: caseData.version,
+                onSuccess,
+                onError,
               });
             }
             break;
           case 'description':
-            const descriptionUpdate = getTypedPayload<string>(updateValue);
+            const descriptionUpdate = getTypedPayload<string>(value);
             if (descriptionUpdate.length > 0) {
               updateCaseProperty({
                 fetchCaseUserActions,
@@ -125,28 +136,34 @@ export const CaseComponent = React.memo<CaseProps>(
                 updateValue: descriptionUpdate,
                 updateCase: handleUpdateNewCase,
                 version: caseData.version,
+                onSuccess,
+                onError,
               });
             }
             break;
           case 'tags':
-            const tagsUpdate = getTypedPayload<string[]>(updateValue);
+            const tagsUpdate = getTypedPayload<string[]>(value);
             updateCaseProperty({
               fetchCaseUserActions,
               updateKey: 'tags',
               updateValue: tagsUpdate,
               updateCase: handleUpdateNewCase,
               version: caseData.version,
+              onSuccess,
+              onError,
             });
             break;
           case 'status':
-            const statusUpdate = getTypedPayload<string>(updateValue);
-            if (caseData.status !== updateValue) {
+            const statusUpdate = getTypedPayload<string>(value);
+            if (caseData.status !== value) {
               updateCaseProperty({
                 fetchCaseUserActions,
                 updateKey: 'status',
                 updateValue: statusUpdate,
                 updateCase: handleUpdateNewCase,
                 version: caseData.version,
+                onSuccess,
+                onError,
               });
             }
           default:
@@ -191,15 +208,28 @@ export const CaseComponent = React.memo<CaseProps>(
     });
 
     const onSubmitConnector = useCallback(
-      (connectorId) => onUpdateField('connectorId', connectorId),
+      (connectorId, onSuccess, onError) =>
+        onUpdateField({
+          key: 'connectorId',
+          value: connectorId,
+          onSuccess,
+          onError,
+        }),
       [onUpdateField]
     );
-    const onSubmitTags = useCallback((newTags) => onUpdateField('tags', newTags), [onUpdateField]);
-    const onSubmitTitle = useCallback((newTitle) => onUpdateField('title', newTitle), [
+    const onSubmitTags = useCallback((newTags) => onUpdateField({ key: 'tags', value: newTags }), [
       onUpdateField,
     ]);
+    const onSubmitTitle = useCallback(
+      (newTitle) => onUpdateField({ key: 'title', value: newTitle }),
+      [onUpdateField]
+    );
     const toggleStatusCase = useCallback(
-      (e) => onUpdateField('status', e.target.checked ? 'closed' : 'open'),
+      (e) =>
+        onUpdateField({
+          key: 'status',
+          value: e.target.checked ? 'closed' : 'open',
+        }),
       [onUpdateField]
     );
     const handleRefresh = useCallback(() => {
diff --git a/x-pack/plugins/security_solution/public/cases/components/create/index.tsx b/x-pack/plugins/security_solution/public/cases/components/create/index.tsx
index 1a2697bb132b0..31e6da4269ead 100644
--- a/x-pack/plugins/security_solution/public/cases/components/create/index.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/create/index.tsx
@@ -69,6 +69,7 @@ export const Create = React.memo(() => {
     options: { stripEmptyFields: false },
     schema,
   });
+  const { submit } = form;
   const { tags: tagOptions } = useGetTags();
   const [options, setOptions] = useState(
     tagOptions.map((label) => ({
@@ -91,12 +92,12 @@ export const Create = React.memo(() => {
   const handleTimelineClick = useTimelineClick();
 
   const onSubmit = useCallback(async () => {
-    const { isValid, data } = await form.submit();
+    const { isValid, data } = await submit();
     if (isValid) {
       // `postCase`'s type is incorrect, it actually returns a promise
       await postCase(data);
     }
-  }, [form, postCase]);
+  }, [submit, postCase]);
 
   const handleSetIsCancel = useCallback(() => {
     history.push('/');
diff --git a/x-pack/plugins/security_solution/public/cases/components/edit_connector/index.test.tsx b/x-pack/plugins/security_solution/public/cases/components/edit_connector/index.test.tsx
index 251d0b6e81bf8..564ce2e19df00 100644
--- a/x-pack/plugins/security_solution/public/cases/components/edit_connector/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/edit_connector/index.test.tsx
@@ -69,10 +69,35 @@ describe('EditConnector ', () => {
     await act(async () => {
       wrapper.find(`[data-test-subj="edit-connectors-submit"]`).last().simulate('click');
       await wait();
-      expect(onSubmit).toBeCalledWith(sampleConnector);
+      expect(onSubmit.mock.calls[0][0]).toBe(sampleConnector);
     });
   });
 
+  it('Revert to initial external service on error', async () => {
+    onSubmit.mockImplementation((connector, onSuccess, onError) => {
+      onError(new Error('An error has occurred'));
+    });
+    const wrapper = mount(
+      <TestProviders>
+        <EditConnector {...defaultProps} />
+      </TestProviders>
+    );
+
+    wrapper.find('button[data-test-subj="dropdown-connectors"]').simulate('click');
+    wrapper.update();
+    wrapper.find('button[data-test-subj="dropdown-connector-servicenow-2"]').simulate('click');
+    wrapper.update();
+
+    expect(wrapper.find(`[data-test-subj="edit-connectors-submit"]`).last().exists()).toBeTruthy();
+
+    await act(async () => {
+      wrapper.find(`[data-test-subj="edit-connectors-submit"]`).last().simulate('click');
+      await wait();
+      wrapper.update();
+    });
+    expect(formHookMock.setFieldValue).toHaveBeenCalledWith('connector', 'none');
+  });
+
   it('Resets selector on cancel', async () => {
     const props = {
       ...defaultProps,
diff --git a/x-pack/plugins/security_solution/public/cases/components/edit_connector/index.tsx b/x-pack/plugins/security_solution/public/cases/components/edit_connector/index.tsx
index ba0b97b6088a8..95ef3353a025f 100644
--- a/x-pack/plugins/security_solution/public/cases/components/edit_connector/index.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/edit_connector/index.tsx
@@ -15,6 +15,8 @@ import {
   EuiLoadingSpinner,
 } from '@elastic/eui';
 import styled, { css } from 'styled-components';
+import { noop } from 'lodash/fp';
+
 import * as i18n from '../../translations';
 import { Form, UseField, useForm } from '../../../shared_imports';
 import { schema } from './schema';
@@ -25,7 +27,7 @@ interface EditConnectorProps {
   connectors: Connector[];
   disabled?: boolean;
   isLoading: boolean;
-  onSubmit: (a: string[]) => void;
+  onSubmit: (a: string[], onSuccess: () => void, onError: () => void) => void;
   selectedConnector: string;
 }
 
@@ -46,11 +48,13 @@ export const EditConnector = React.memo(
     onSubmit,
     selectedConnector,
   }: EditConnectorProps) => {
+    const initialState = { connectors };
     const { form } = useForm({
-      defaultValue: { connectors },
+      defaultValue: initialState,
       options: { stripEmptyFields: false },
       schema,
     });
+    const { setFieldValue, submit } = form;
     const [connectorHasChanged, setConnectorHasChanged] = useState(false);
     const onChangeConnector = useCallback(
       (connectorId) => {
@@ -59,18 +63,24 @@ export const EditConnector = React.memo(
       [selectedConnector]
     );
 
+    const onError = useCallback(() => {
+      setFieldValue('connector', selectedConnector);
+      setConnectorHasChanged(false);
+    }, [setFieldValue, selectedConnector]);
+
     const onCancelConnector = useCallback(() => {
-      form.setFieldValue('connector', selectedConnector);
+      setFieldValue('connector', selectedConnector);
       setConnectorHasChanged(false);
-    }, [form, selectedConnector]);
+    }, [selectedConnector, setFieldValue]);
 
     const onSubmitConnector = useCallback(async () => {
-      const { isValid, data: newData } = await form.submit();
+      const { isValid, data: newData } = await submit();
       if (isValid && newData.connector) {
-        onSubmit(newData.connector);
+        onSubmit(newData.connector, noop, onError);
         setConnectorHasChanged(false);
       }
-    }, [form, onSubmit]);
+    }, [submit, onSubmit, onError]);
+
     return (
       <EuiText>
         <MyFlexGroup alignItems="center" gutterSize="xs" justifyContent="spaceBetween">
diff --git a/x-pack/plugins/security_solution/public/cases/components/tag_list/index.tsx b/x-pack/plugins/security_solution/public/cases/components/tag_list/index.tsx
index 5f8404ca2dcc4..7bb10c743a418 100644
--- a/x-pack/plugins/security_solution/public/cases/components/tag_list/index.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/tag_list/index.tsx
@@ -42,20 +42,23 @@ const MyFlexGroup = styled(EuiFlexGroup)`
 
 export const TagList = React.memo(
   ({ disabled = false, isLoading, onSubmit, tags }: TagListProps) => {
+    const initialState = { tags };
     const { form } = useForm({
-      defaultValue: { tags },
+      defaultValue: initialState,
       options: { stripEmptyFields: false },
       schema,
     });
+    const { submit } = form;
     const [isEditTags, setIsEditTags] = useState(false);
 
     const onSubmitTags = useCallback(async () => {
-      const { isValid, data: newData } = await form.submit();
+      const { isValid, data: newData } = await submit();
       if (isValid && newData.tags) {
         onSubmit(newData.tags);
         setIsEditTags(false);
       }
-    }, [form, onSubmit]);
+    }, [onSubmit, submit]);
+
     const { tags: tagOptions } = useGetTags();
     const [options, setOptions] = useState(
       tagOptions.map((label) => ({
diff --git a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/index.test.tsx b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/index.test.tsx
index 285584cf2233c..23f1fb222a841 100644
--- a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/index.test.tsx
@@ -277,7 +277,7 @@ describe('UserActionTree ', () => {
           )
           .exists()
       ).toEqual(false);
-      expect(onUpdateField).toBeCalledWith('description', sampleData.content);
+      expect(onUpdateField).toBeCalledWith({ key: 'description', value: sampleData.content });
     });
   });
 
diff --git a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/index.tsx b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/index.tsx
index 52c2779a93fc0..0c1da8694bf1a 100644
--- a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/index.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/index.tsx
@@ -21,6 +21,7 @@ import { UserActionMarkdown } from './user_action_markdown';
 import { Connector } from '../../../../../case/common/api/cases';
 import { CaseServices } from '../../containers/use_get_case_user_actions';
 import { parseString } from '../../containers/utils';
+import { OnUpdateFields } from '../case_view';
 
 export interface UserActionTreeProps {
   caseServices: CaseServices;
@@ -30,7 +31,7 @@ export interface UserActionTreeProps {
   fetchUserActions: () => void;
   isLoadingDescription: boolean;
   isLoadingUserActions: boolean;
-  onUpdateField: (updateKey: keyof Case, updateValue: string | string[]) => void;
+  onUpdateField: ({ key, value, onSuccess, onError }: OnUpdateFields) => void;
   updateCase: (newCase: Case) => void;
   userCanCrud: boolean;
 }
@@ -138,7 +139,7 @@ export const UserActionTree = React.memo(
           content={caseData.description}
           isEditable={manageMarkdownEditIds.includes(DESCRIPTION_ID)}
           onSaveContent={(content: string) => {
-            onUpdateField(DESCRIPTION_ID, content);
+            onUpdateField({ key: DESCRIPTION_ID, value: content });
           }}
           onChangeEditable={handleManageMarkdownEditId}
         />
diff --git a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_markdown.tsx b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_markdown.tsx
index 0a8167049266f..da081fea5eac0 100644
--- a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_markdown.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_markdown.tsx
@@ -6,7 +6,7 @@
 
 import { EuiFlexGroup, EuiFlexItem, EuiButtonEmpty, EuiButton } from '@elastic/eui';
 import React, { useCallback } from 'react';
-import styled, { css } from 'styled-components';
+import styled from 'styled-components';
 
 import * as i18n from '../case_view/translations';
 import { Markdown } from '../../../common/components/markdown';
@@ -18,9 +18,7 @@ import { MarkdownEditorForm } from '../../../common/components//markdown_editor/
 import { useTimelineClick } from '../utils/use_timeline_click';
 
 const ContentWrapper = styled.div`
-  ${({ theme }) => css`
-    padding: ${theme.eui.euiSizeM} ${theme.eui.euiSizeL};
-  `}
+  padding: ${({ theme }) => `${theme.eui.euiSizeM} ${theme.eui.euiSizeL}`};
 `;
 
 interface UserActionMarkdownProps {
@@ -37,11 +35,13 @@ export const UserActionMarkdown = ({
   onChangeEditable,
   onSaveContent,
 }: UserActionMarkdownProps) => {
+  const initialState = { content };
   const { form } = useForm<Content>({
-    defaultValue: { content },
+    defaultValue: initialState,
     options: { stripEmptyFields: false },
     schema,
   });
+  const { submit } = form;
   const { handleCursorChange, handleOnTimelineChange } = useInsertTimeline<Content>(
     form,
     'content'
@@ -53,45 +53,43 @@ export const UserActionMarkdown = ({
   const handleTimelineClick = useTimelineClick();
 
   const handleSaveAction = useCallback(async () => {
-    const { isValid, data } = await form.submit();
+    const { isValid, data } = await submit();
     if (isValid) {
       onSaveContent(data.content);
     }
     onChangeEditable(id);
-  }, [form, id, onChangeEditable, onSaveContent]);
+  }, [id, onChangeEditable, onSaveContent, submit]);
 
   const renderButtons = useCallback(
-    ({ cancelAction, saveAction }) => {
-      return (
-        <EuiFlexGroup gutterSize="s" alignItems="center">
-          <EuiFlexItem grow={false}>
-            <EuiButtonEmpty
-              data-test-subj="user-action-cancel-markdown"
-              size="s"
-              onClick={cancelAction}
-              iconType="cross"
-            >
-              {i18n.CANCEL}
-            </EuiButtonEmpty>
-          </EuiFlexItem>
-          <EuiFlexItem grow={false}>
-            <EuiButton
-              data-test-subj="user-action-save-markdown"
-              color="secondary"
-              fill
-              iconType="save"
-              onClick={saveAction}
-              size="s"
-            >
-              {i18n.SAVE}
-            </EuiButton>
-          </EuiFlexItem>
-        </EuiFlexGroup>
-      );
-    },
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-    [handleCancelAction, handleSaveAction]
+    ({ cancelAction, saveAction }) => (
+      <EuiFlexGroup gutterSize="s" alignItems="center">
+        <EuiFlexItem grow={false}>
+          <EuiButtonEmpty
+            data-test-subj="user-action-cancel-markdown"
+            size="s"
+            onClick={cancelAction}
+            iconType="cross"
+          >
+            {i18n.CANCEL}
+          </EuiButtonEmpty>
+        </EuiFlexItem>
+        <EuiFlexItem grow={false}>
+          <EuiButton
+            data-test-subj="user-action-save-markdown"
+            color="secondary"
+            fill
+            iconType="save"
+            onClick={saveAction}
+            size="s"
+          >
+            {i18n.SAVE}
+          </EuiButton>
+        </EuiFlexItem>
+      </EuiFlexGroup>
+    ),
+    []
   );
+
   return isEditable ? (
     <Form form={form} data-test-subj="user-action-markdown-form">
       <UseField
diff --git a/x-pack/plugins/security_solution/public/cases/containers/use_update_case.test.tsx b/x-pack/plugins/security_solution/public/cases/containers/use_update_case.test.tsx
index 86cfc3459c595..01e64fa780d52 100644
--- a/x-pack/plugins/security_solution/public/cases/containers/use_update_case.test.tsx
+++ b/x-pack/plugins/security_solution/public/cases/containers/use_update_case.test.tsx
@@ -16,12 +16,17 @@ describe('useUpdateCase', () => {
   const fetchCaseUserActions = jest.fn();
   const updateCase = jest.fn();
   const updateKey: UpdateKey = 'description';
+  const onSuccess = jest.fn();
+  const onError = jest.fn();
+
   const sampleUpdate = {
     fetchCaseUserActions,
     updateKey,
     updateValue: 'updated description',
     updateCase,
     version: basicCase.version,
+    onSuccess,
+    onError,
   };
   beforeEach(() => {
     jest.clearAllMocks();
@@ -79,6 +84,7 @@ describe('useUpdateCase', () => {
       });
       expect(fetchCaseUserActions).toBeCalledWith(basicCase.id);
       expect(updateCase).toBeCalledWith(basicCase);
+      expect(onSuccess).toHaveBeenCalled();
     });
   });
 
@@ -114,6 +120,7 @@ describe('useUpdateCase', () => {
         isError: true,
         updateCaseProperty: result.current.updateCaseProperty,
       });
+      expect(onError).toHaveBeenCalled();
     });
   });
 });
diff --git a/x-pack/plugins/security_solution/public/cases/containers/use_update_case.tsx b/x-pack/plugins/security_solution/public/cases/containers/use_update_case.tsx
index 18dd9f5278503..6ede91b572dba 100644
--- a/x-pack/plugins/security_solution/public/cases/containers/use_update_case.tsx
+++ b/x-pack/plugins/security_solution/public/cases/containers/use_update_case.tsx
@@ -5,6 +5,7 @@
  */
 
 import { useReducer, useCallback } from 'react';
+
 import {
   displaySuccessToast,
   errorToToaster,
@@ -33,6 +34,8 @@ export interface UpdateByKey {
   fetchCaseUserActions?: (caseId: string) => void;
   updateCase?: (newCase: Case) => void;
   version: string;
+  onSuccess?: () => void;
+  onError?: () => void;
 }
 
 type Action =
@@ -81,7 +84,15 @@ export const useUpdateCase = ({ caseId }: { caseId: string }): UseUpdateCase =>
   const [, dispatchToaster] = useStateToaster();
 
   const dispatchUpdateCaseProperty = useCallback(
-    async ({ fetchCaseUserActions, updateKey, updateValue, updateCase, version }: UpdateByKey) => {
+    async ({
+      fetchCaseUserActions,
+      updateKey,
+      updateValue,
+      updateCase,
+      version,
+      onSuccess,
+      onError,
+    }: UpdateByKey) => {
       let cancel = false;
       const abortCtrl = new AbortController();
 
@@ -102,6 +113,9 @@ export const useUpdateCase = ({ caseId }: { caseId: string }): UseUpdateCase =>
           }
           dispatch({ type: 'FETCH_SUCCESS' });
           displaySuccessToast(i18n.UPDATED_CASE(response[0].title), dispatchToaster);
+          if (onSuccess) {
+            onSuccess();
+          }
         }
       } catch (error) {
         if (!cancel) {
@@ -111,6 +125,9 @@ export const useUpdateCase = ({ caseId }: { caseId: string }): UseUpdateCase =>
             dispatchToaster,
           });
           dispatch({ type: 'FETCH_FAILURE' });
+          if (onError) {
+            onError();
+          }
         }
       }
       return () => {
diff --git a/x-pack/plugins/security_solution/public/cases/pages/saved_object_no_permissions.tsx b/x-pack/plugins/security_solution/public/cases/pages/saved_object_no_permissions.tsx
index a560f697de415..7129aa04bdf69 100644
--- a/x-pack/plugins/security_solution/public/cases/pages/saved_object_no_permissions.tsx
+++ b/x-pack/plugins/security_solution/public/cases/pages/saved_object_no_permissions.tsx
@@ -17,7 +17,7 @@ export const CaseSavedObjectNoPermissions = React.memo(() => {
     <EmptyPage
       actionPrimaryIcon="documents"
       actionPrimaryLabel={i18n.GO_TO_DOCUMENTATION}
-      actionPrimaryUrl={`${docLinks.ELASTIC_WEBSITE_URL}guide/en/siem/guide/${docLinks.DOC_LINK_VERSION}s`}
+      actionPrimaryUrl={`${docLinks.ELASTIC_WEBSITE_URL}guide/en/security/${docLinks.DOC_LINK_VERSION}s`}
       actionPrimaryTarget="_blank"
       message={i18n.SAVED_OBJECT_NO_PERMISSIONS_MSG}
       data-test-subj="no_saved_objects_permissions"
diff --git a/x-pack/plugins/security_solution/public/common/components/add_filter_to_global_search_bar/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/add_filter_to_global_search_bar/index.test.tsx
index 9c08e05ddfa39..2af6569394e8f 100644
--- a/x-pack/plugins/security_solution/public/common/components/add_filter_to_global_search_bar/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/add_filter_to_global_search_bar/index.test.tsx
@@ -157,8 +157,10 @@ describe('AddFilterToGlobalSearchBar Component', () => {
       </TestProviders>
     );
 
+    wrapper.find('[data-test-subj="withHoverActionsButton"]').simulate('mouseenter');
+    wrapper.update();
+
     wrapper
-      .simulate('mouseenter')
       .find('[data-test-subj="hover-actions-container"] [data-euiicon-type]')
       .first()
       .simulate('click');
diff --git a/x-pack/plugins/security_solution/public/common/components/drag_and_drop/draggable_wrapper.test.tsx b/x-pack/plugins/security_solution/public/common/components/drag_and_drop/draggable_wrapper.test.tsx
index da68280ed760c..e17fc7b9ef9bd 100644
--- a/x-pack/plugins/security_solution/public/common/components/drag_and_drop/draggable_wrapper.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/drag_and_drop/draggable_wrapper.test.tsx
@@ -65,7 +65,7 @@ describe('DraggableWrapper', () => {
       expect(wrapper.find('[data-test-subj="copy-to-clipboard"]').exists()).toBe(false);
     });
 
-    test('it renders hover actions when the mouse is over the draggable wrapper', () => {
+    test('it renders hover actions when the mouse is over the text of draggable wrapper', () => {
       const wrapper = mount(
         <TestProviders>
           <MockedProvider mocks={mocksSource} addTypename={false}>
@@ -76,7 +76,7 @@ describe('DraggableWrapper', () => {
         </TestProviders>
       );
 
-      wrapper.simulate('mouseenter');
+      wrapper.find('[data-test-subj="withHoverActionsButton"]').simulate('mouseenter');
       wrapper.update();
       expect(wrapper.find('[data-test-subj="copy-to-clipboard"]').exists()).toBe(true);
     });
diff --git a/x-pack/plugins/security_solution/public/common/components/drag_and_drop/draggable_wrapper_hover_content.test.tsx b/x-pack/plugins/security_solution/public/common/components/drag_and_drop/draggable_wrapper_hover_content.test.tsx
index 3f06a8168b5ce..8e76a88572e42 100644
--- a/x-pack/plugins/security_solution/public/common/components/drag_and_drop/draggable_wrapper_hover_content.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/drag_and_drop/draggable_wrapper_hover_content.test.tsx
@@ -436,14 +436,14 @@ describe('DraggableWrapperHoverContent', () => {
       expect(wrapper.find('[data-test-subj="show-top-field"]').first().exists()).toBe(true);
     });
 
-    test(`it renders the 'Show top field' button when showTopN is false and a whitelisted signal field is provided`, async () => {
-      const whitelistedField = 'signal.rule.name';
+    test(`it renders the 'Show top field' button when showTopN is false and a allowlisted signal field is provided`, async () => {
+      const allowlistedField = 'signal.rule.name';
       const wrapper = mount(
         <TestProviders>
           <DraggableWrapperHoverContent
             {...{
               ...defaultProps,
-              field: whitelistedField,
+              field: allowlistedField,
             }}
           />
         </TestProviders>
@@ -473,13 +473,13 @@ describe('DraggableWrapperHoverContent', () => {
     });
 
     test(`it should invokes goGetTimelineId when user is over the 'Show top field' button`, () => {
-      const whitelistedField = 'signal.rule.name';
+      const allowlistedField = 'signal.rule.name';
       const wrapper = mount(
         <TestProviders>
           <DraggableWrapperHoverContent
             {...{
               ...defaultProps,
-              field: whitelistedField,
+              field: allowlistedField,
               timelineId: undefined,
             }}
           />
@@ -491,13 +491,13 @@ describe('DraggableWrapperHoverContent', () => {
     });
 
     test(`invokes the toggleTopN function when the 'Show top field' button is clicked`, async () => {
-      const whitelistedField = 'signal.rule.name';
+      const allowlistedField = 'signal.rule.name';
       const wrapper = mount(
         <TestProviders>
           <DraggableWrapperHoverContent
             {...{
               ...defaultProps,
-              field: whitelistedField,
+              field: allowlistedField,
             }}
           />
         </TestProviders>
@@ -512,13 +512,13 @@ describe('DraggableWrapperHoverContent', () => {
     });
 
     test(`it does NOT render the Top N histogram when when showTopN is false`, async () => {
-      const whitelistedField = 'signal.rule.name';
+      const allowlistedField = 'signal.rule.name';
       const wrapper = mount(
         <TestProviders>
           <DraggableWrapperHoverContent
             {...{
               ...defaultProps,
-              field: whitelistedField,
+              field: allowlistedField,
             }}
           />
         </TestProviders>
@@ -532,13 +532,13 @@ describe('DraggableWrapperHoverContent', () => {
     });
 
     test(`it does NOT render the 'Show top field' button when showTopN is true`, async () => {
-      const whitelistedField = 'signal.rule.name';
+      const allowlistedField = 'signal.rule.name';
       const wrapper = mount(
         <TestProviders>
           <DraggableWrapperHoverContent
             {...{
               ...defaultProps,
-              field: whitelistedField,
+              field: allowlistedField,
               showTopN: true,
             }}
           />
@@ -551,13 +551,13 @@ describe('DraggableWrapperHoverContent', () => {
     });
 
     test(`it renders the Top N histogram when when showTopN is true`, async () => {
-      const whitelistedField = 'signal.rule.name';
+      const allowlistedField = 'signal.rule.name';
       const wrapper = mount(
         <TestProviders>
           <DraggableWrapperHoverContent
             {...{
               ...defaultProps,
-              field: whitelistedField,
+              field: allowlistedField,
               showTopN: true,
             }}
           />
diff --git a/x-pack/plugins/security_solution/public/common/components/drag_and_drop/helpers.test.ts b/x-pack/plugins/security_solution/public/common/components/drag_and_drop/helpers.test.ts
index afdfde6e08224..68032fb7dc512 100644
--- a/x-pack/plugins/security_solution/public/common/components/drag_and_drop/helpers.test.ts
+++ b/x-pack/plugins/security_solution/public/common/components/drag_and_drop/helpers.test.ts
@@ -658,7 +658,7 @@ describe('helpers', () => {
       ).toBe(true);
     });
 
-    test('it returns true for a whitelisted non-BrowserField', () => {
+    test('it returns true for a allowlisted non-BrowserField', () => {
       expect(
         allowTopN({
           browserField: undefined,
@@ -717,11 +717,11 @@ describe('helpers', () => {
       ).toBe(false);
     });
 
-    test('it returns false for a non-whitelisted field when a BrowserField is not provided', () => {
+    test('it returns false for a non-allowlisted field when a BrowserField is not provided', () => {
       expect(
         allowTopN({
           browserField: undefined,
-          fieldName: 'non-whitelisted',
+          fieldName: 'non-allowlisted',
         })
       ).toBe(false);
     });
diff --git a/x-pack/plugins/security_solution/public/common/components/drag_and_drop/helpers.ts b/x-pack/plugins/security_solution/public/common/components/drag_and_drop/helpers.ts
index ba328eff62e51..132ab054c3afd 100644
--- a/x-pack/plugins/security_solution/public/common/components/drag_and_drop/helpers.ts
+++ b/x-pack/plugins/security_solution/public/common/components/drag_and_drop/helpers.ts
@@ -264,8 +264,8 @@ export const allowTopN = ({
     'string',
   ].includes(fieldType);
 
-  // TODO: remove this explicit whitelist when the ECS documentation includes alerts
-  const isWhitelistedNonBrowserField = [
+  // TODO: remove this explicit allowlist when the ECS documentation includes alerts
+  const isAllowlistedNonBrowserField = [
     'signal.ancestors.depth',
     'signal.ancestors.id',
     'signal.ancestors.rule',
@@ -336,7 +336,7 @@ export const allowTopN = ({
     'signal.status',
   ].includes(fieldName);
 
-  return isWhitelistedNonBrowserField || (isAggregatable && isAllowedType);
+  return isAllowlistedNonBrowserField || (isAggregatable && isAllowedType);
 };
 
 export const getTimelineIdFromColumnDroppableId = (droppableId: string) =>
diff --git a/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.test.tsx b/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.test.tsx
index 8c1f69279d31c..2a7cbff5ee149 100644
--- a/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.test.tsx
@@ -32,18 +32,18 @@ mockUseResizeObserver.mockImplementation(() => ({}));
 const from = '2019-08-26T22:10:56.791Z';
 const to = '2019-08-27T22:10:56.794Z';
 
+const defaultMocks = {
+  browserFields: mockBrowserFields,
+  indexPatterns: mockIndexPattern,
+  docValueFields: mockDocValueFields,
+  isLoading: false,
+};
+
 describe('EventsViewer', () => {
   const mount = useMountAppended();
 
   beforeEach(() => {
-    mockUseFetchIndexPatterns.mockImplementation(() => [
-      {
-        browserFields: mockBrowserFields,
-        indexPatterns: mockIndexPattern,
-        docValueFields: mockDocValueFields,
-        isLoading: false,
-      },
-    ]);
+    mockUseFetchIndexPatterns.mockImplementation(() => [{ ...defaultMocks }]);
   });
 
   test('it renders the "Showing..." subtitle with the expected event count', async () => {
@@ -69,14 +69,7 @@ describe('EventsViewer', () => {
   });
 
   test('it does NOT render fetch index pattern is loading', async () => {
-    mockUseFetchIndexPatterns.mockImplementation(() => [
-      {
-        browserFields: mockBrowserFields,
-        indexPatterns: mockIndexPattern,
-        docValueFields: mockDocValueFields,
-        isLoading: true,
-      },
-    ]);
+    mockUseFetchIndexPatterns.mockImplementation(() => [{ ...defaultMocks, isLoading: true }]);
 
     const wrapper = mount(
       <TestProviders>
@@ -98,14 +91,7 @@ describe('EventsViewer', () => {
   });
 
   test('it does NOT render when start is empty', async () => {
-    mockUseFetchIndexPatterns.mockImplementation(() => [
-      {
-        browserFields: mockBrowserFields,
-        indexPatterns: mockIndexPattern,
-        docValueFields: mockDocValueFields,
-        isLoading: true,
-      },
-    ]);
+    mockUseFetchIndexPatterns.mockImplementation(() => [{ ...defaultMocks, isLoading: true }]);
 
     const wrapper = mount(
       <TestProviders>
@@ -127,14 +113,7 @@ describe('EventsViewer', () => {
   });
 
   test('it does NOT render when end is empty', async () => {
-    mockUseFetchIndexPatterns.mockImplementation(() => [
-      {
-        browserFields: mockBrowserFields,
-        indexPatterns: mockIndexPattern,
-        docValueFields: mockDocValueFields,
-        isLoading: true,
-      },
-    ]);
+    mockUseFetchIndexPatterns.mockImplementation(() => [{ ...defaultMocks, isLoading: true }]);
 
     const wrapper = mount(
       <TestProviders>
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.tsx
index d5eeef0f1e768..79383676266f5 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.tsx
@@ -29,8 +29,8 @@ import {
 } from '../../../../../public/lists_plugin_deps';
 import * as i18n from './translations';
 import { TimelineNonEcsData, Ecs } from '../../../../graphql/types';
+import { useAppToasts } from '../../../hooks/use_app_toasts';
 import { useKibana } from '../../../lib/kibana';
-import { errorToToaster, displaySuccessToast, useStateToaster } from '../../toasters';
 import { ExceptionBuilder } from '../builder';
 import { Loader } from '../../loader';
 import { useAddOrUpdateException } from '../use_add_exception';
@@ -115,7 +115,7 @@ export const AddExceptionModal = memo(function AddExceptionModal({
     Array<ExceptionListItemSchema | CreateExceptionListItemSchema>
   >([]);
   const [fetchOrCreateListError, setFetchOrCreateListError] = useState(false);
-  const [, dispatchToaster] = useStateToaster();
+  const { addError, addSuccess } = useAppToasts();
   const { loading: isSignalIndexLoading, signalIndexName } = useSignalIndex();
 
   const [{ isLoading: indexPatternLoading, indexPatterns }] = useFetchIndexPatterns(
@@ -124,15 +124,15 @@ export const AddExceptionModal = memo(function AddExceptionModal({
 
   const onError = useCallback(
     (error: Error) => {
-      errorToToaster({ title: i18n.ADD_EXCEPTION_ERROR, error, dispatchToaster });
+      addError(error, { title: i18n.ADD_EXCEPTION_ERROR });
       onCancel();
     },
-    [dispatchToaster, onCancel]
+    [addError, onCancel]
   );
   const onSuccess = useCallback(() => {
-    displaySuccessToast(i18n.ADD_EXCEPTION_SUCCESS, dispatchToaster);
+    addSuccess(i18n.ADD_EXCEPTION_SUCCESS);
     onConfirm(shouldCloseAlert);
-  }, [dispatchToaster, onConfirm, shouldCloseAlert]);
+  }, [addSuccess, onConfirm, shouldCloseAlert]);
 
   const [{ isLoading: addExceptionIsLoading }, addOrUpdateExceptionItems] = useAddOrUpdateException(
     {
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/builder/builder_button_options.stories.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/builder/builder_button_options.stories.tsx
index 7e4cbe34f9a64..9486008e708ea 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/builder/builder_button_options.stories.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/builder/builder_button_options.stories.tsx
@@ -16,26 +16,12 @@ addDecorator((storyFn) => (
 ));
 
 storiesOf('Components|Exceptions|BuilderButtonOptions', module)
-  .add('init button', () => {
-    return (
-      <BuilderButtonOptions
-        isAndDisabled={false}
-        isOrDisabled={false}
-        showNestedButton={false}
-        displayInitButton
-        onOrClicked={action('onClick')}
-        onAndClicked={action('onClick')}
-        onNestedClicked={action('onClick')}
-      />
-    );
-  })
   .add('and/or buttons', () => {
     return (
       <BuilderButtonOptions
         isAndDisabled={false}
         isOrDisabled={false}
         showNestedButton={false}
-        displayInitButton={false}
         onOrClicked={action('onClick')}
         onAndClicked={action('onClick')}
         onNestedClicked={action('onClick')}
@@ -48,7 +34,6 @@ storiesOf('Components|Exceptions|BuilderButtonOptions', module)
         isAndDisabled={false}
         isOrDisabled={false}
         showNestedButton
-        displayInitButton={false}
         onOrClicked={action('onClick')}
         onAndClicked={action('onClick')}
         onNestedClicked={action('onClick')}
@@ -61,7 +46,6 @@ storiesOf('Components|Exceptions|BuilderButtonOptions', module)
         isAndDisabled
         isOrDisabled={false}
         showNestedButton={false}
-        displayInitButton={false}
         onOrClicked={action('onClick')}
         onAndClicked={action('onClick')}
         onNestedClicked={action('onClick')}
@@ -74,7 +58,6 @@ storiesOf('Components|Exceptions|BuilderButtonOptions', module)
         isAndDisabled={false}
         isOrDisabled
         showNestedButton={false}
-        displayInitButton={false}
         onOrClicked={action('onClick')}
         onAndClicked={action('onClick')}
         onNestedClicked={action('onClick')}
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/builder/builder_button_options.test.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/builder/builder_button_options.test.tsx
index 59306b5343743..66968ee95d3fa 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/builder/builder_button_options.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/builder/builder_button_options.test.tsx
@@ -16,7 +16,6 @@ describe('BuilderButtonOptions', () => {
         isAndDisabled={false}
         isOrDisabled={false}
         showNestedButton={false}
-        displayInitButton={false}
         onOrClicked={jest.fn()}
         onAndClicked={jest.fn()}
         onNestedClicked={jest.fn()}
@@ -31,44 +30,6 @@ describe('BuilderButtonOptions', () => {
     expect(wrapper.find('[data-test-subj="exceptionsNestedButton"] button')).toHaveLength(0);
   });
 
-  test('it renders "add exception" button if "displayInitButton" is true', () => {
-    const wrapper = mount(
-      <BuilderButtonOptions
-        isAndDisabled={false}
-        isOrDisabled={false}
-        showNestedButton={false}
-        displayInitButton
-        onOrClicked={jest.fn()}
-        onAndClicked={jest.fn()}
-        onNestedClicked={jest.fn()}
-      />
-    );
-
-    expect(wrapper.find('[data-test-subj="exceptionsAddNewExceptionButton"] button')).toHaveLength(
-      1
-    );
-  });
-
-  test('it invokes "onAddExceptionClicked" when "add exception" button is clicked', () => {
-    const onOrClicked = jest.fn();
-
-    const wrapper = mount(
-      <BuilderButtonOptions
-        isAndDisabled={false}
-        isOrDisabled={false}
-        showNestedButton={false}
-        displayInitButton
-        onOrClicked={onOrClicked}
-        onAndClicked={jest.fn()}
-        onNestedClicked={jest.fn()}
-      />
-    );
-
-    wrapper.find('[data-test-subj="exceptionsAddNewExceptionButton"] button').simulate('click');
-
-    expect(onOrClicked).toHaveBeenCalledTimes(1);
-  });
-
   test('it invokes "onOrClicked" when "or" button is clicked', () => {
     const onOrClicked = jest.fn();
 
@@ -77,7 +38,6 @@ describe('BuilderButtonOptions', () => {
         isAndDisabled={false}
         isOrDisabled={false}
         showNestedButton={false}
-        displayInitButton={false}
         onOrClicked={onOrClicked}
         onAndClicked={jest.fn()}
         onNestedClicked={jest.fn()}
@@ -97,7 +57,6 @@ describe('BuilderButtonOptions', () => {
         isAndDisabled={false}
         isOrDisabled={false}
         showNestedButton={false}
-        displayInitButton={false}
         onOrClicked={jest.fn()}
         onAndClicked={onAndClicked}
         onNestedClicked={jest.fn()}
@@ -113,7 +72,6 @@ describe('BuilderButtonOptions', () => {
     const wrapper = mount(
       <BuilderButtonOptions
         showNestedButton={false}
-        displayInitButton={false}
         isOrDisabled={false}
         isAndDisabled
         onOrClicked={jest.fn()}
@@ -131,7 +89,6 @@ describe('BuilderButtonOptions', () => {
     const wrapper = mount(
       <BuilderButtonOptions
         showNestedButton={false}
-        displayInitButton={false}
         isOrDisabled
         isAndDisabled={false}
         onOrClicked={jest.fn()}
@@ -153,7 +110,6 @@ describe('BuilderButtonOptions', () => {
         isAndDisabled={false}
         isOrDisabled={false}
         showNestedButton
-        displayInitButton={false}
         onOrClicked={jest.fn()}
         onAndClicked={jest.fn()}
         onNestedClicked={onNestedClicked}
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/builder/builder_button_options.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/builder/builder_button_options.tsx
index ff1556bcc4d25..eb224b82d756f 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/builder/builder_button_options.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/builder/builder_button_options.tsx
@@ -16,7 +16,6 @@ const MyEuiButton = styled(EuiButton)`
 interface BuilderButtonOptionsProps {
   isOrDisabled: boolean;
   isAndDisabled: boolean;
-  displayInitButton: boolean;
   showNestedButton: boolean;
   onAndClicked: () => void;
   onOrClicked: () => void;
@@ -26,64 +25,47 @@ interface BuilderButtonOptionsProps {
 export const BuilderButtonOptions: React.FC<BuilderButtonOptionsProps> = ({
   isOrDisabled = false,
   isAndDisabled = false,
-  displayInitButton,
   showNestedButton = false,
   onAndClicked,
   onOrClicked,
   onNestedClicked,
 }) => (
   <EuiFlexGroup gutterSize="s" alignItems="center">
-    {displayInitButton ? (
+    <EuiFlexItem grow={false}>
+      <MyEuiButton
+        fill
+        size="s"
+        iconType="plusInCircle"
+        onClick={onAndClicked}
+        data-test-subj="exceptionsAndButton"
+        isDisabled={isAndDisabled}
+      >
+        {i18n.AND}
+      </MyEuiButton>
+    </EuiFlexItem>
+    <EuiFlexItem grow={false}>
+      <MyEuiButton
+        fill
+        size="s"
+        iconType="plusInCircle"
+        onClick={onOrClicked}
+        isDisabled={isOrDisabled}
+        data-test-subj="exceptionsOrButton"
+      >
+        {i18n.OR}
+      </MyEuiButton>
+    </EuiFlexItem>
+    {showNestedButton && (
       <EuiFlexItem grow={false}>
         <EuiButton
-          fill
           size="s"
-          iconType="plusInCircle"
-          onClick={onOrClicked}
-          data-test-subj="exceptionsAddNewExceptionButton"
+          iconType="nested"
+          onClick={onNestedClicked}
+          data-test-subj="exceptionsNestedButton"
         >
-          {i18n.ADD_EXCEPTION_TITLE}
+          {i18n.ADD_NESTED_DESCRIPTION}
         </EuiButton>
       </EuiFlexItem>
-    ) : (
-      <>
-        <EuiFlexItem grow={false}>
-          <MyEuiButton
-            fill
-            size="s"
-            iconType="plusInCircle"
-            onClick={onAndClicked}
-            data-test-subj="exceptionsAndButton"
-            isDisabled={isAndDisabled}
-          >
-            {i18n.AND}
-          </MyEuiButton>
-        </EuiFlexItem>
-        <EuiFlexItem grow={false}>
-          <MyEuiButton
-            fill
-            size="s"
-            iconType="plusInCircle"
-            onClick={onOrClicked}
-            isDisabled={isOrDisabled}
-            data-test-subj="exceptionsOrButton"
-          >
-            {i18n.OR}
-          </MyEuiButton>
-        </EuiFlexItem>
-        {showNestedButton && (
-          <EuiFlexItem grow={false}>
-            <EuiButton
-              size="s"
-              iconType="nested"
-              onClick={onNestedClicked}
-              data-test-subj="exceptionsNestedButton"
-            >
-              {i18n.ADD_NESTED_DESCRIPTION}
-            </EuiButton>
-          </EuiFlexItem>
-        )}
-      </>
     )}
   </EuiFlexGroup>
 );
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/builder/builder_exception_item.test.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/builder/builder_exception_item.test.tsx
new file mode 100644
index 0000000000000..9ca7a371ce81b
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/builder/builder_exception_item.test.tsx
@@ -0,0 +1,282 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { ThemeProvider } from 'styled-components';
+import { mount } from 'enzyme';
+import euiLightVars from '@elastic/eui/dist/eui_theme_light.json';
+
+import { ExceptionListItemComponent } from './builder_exception_item';
+import { fields } from '../../../../../../../../src/plugins/data/common/index_patterns/fields/fields.mocks.ts';
+import { getExceptionListItemSchemaMock } from '../../../../../../lists/common/schemas/response/exception_list_item_schema.mock';
+import {
+  getEntryMatchMock,
+  getEntryMatchAnyMock,
+} from '../../../../../../lists/common/schemas/types/entries.mock';
+
+describe('ExceptionListItemComponent', () => {
+  describe('and badge logic', () => {
+    test('it renders "and" badge with extra top padding for the first exception item when "andLogicIncluded" is "true"', () => {
+      const exceptionItem = getExceptionListItemSchemaMock();
+      exceptionItem.entries = [getEntryMatchMock(), getEntryMatchMock()];
+      const wrapper = mount(
+        <ThemeProvider theme={() => ({ eui: euiLightVars, darkMode: false })}>
+          <ExceptionListItemComponent
+            exceptionItem={exceptionItem}
+            exceptionId={'123'}
+            exceptionItemIndex={0}
+            indexPattern={{
+              id: '1234',
+              title: 'logstash-*',
+              fields,
+            }}
+            isLoading={false}
+            andLogicIncluded={true}
+            isOnlyItem={false}
+            onDeleteExceptionItem={jest.fn()}
+            onChangeExceptionItem={jest.fn()}
+          />
+        </ThemeProvider>
+      );
+
+      expect(
+        wrapper.find('[data-test-subj="exceptionItemEntryFirstRowAndBadge"]').exists()
+      ).toBeTruthy();
+    });
+
+    test('it renders "and" badge when more than one exception item entry exists and it is not the first exception item', () => {
+      const exceptionItem = getExceptionListItemSchemaMock();
+      exceptionItem.entries = [getEntryMatchMock(), getEntryMatchMock()];
+      const wrapper = mount(
+        <ThemeProvider theme={() => ({ eui: euiLightVars, darkMode: false })}>
+          <ExceptionListItemComponent
+            exceptionItem={exceptionItem}
+            exceptionId={'123'}
+            exceptionItemIndex={1}
+            indexPattern={{
+              id: '1234',
+              title: 'logstash-*',
+              fields,
+            }}
+            isLoading={false}
+            andLogicIncluded={true}
+            isOnlyItem={false}
+            onDeleteExceptionItem={jest.fn()}
+            onChangeExceptionItem={jest.fn()}
+          />
+        </ThemeProvider>
+      );
+
+      expect(wrapper.find('[data-test-subj="exceptionItemEntryAndBadge"]').exists()).toBeTruthy();
+    });
+
+    test('it renders indented "and" badge when "andLogicIncluded" is "true" and only one entry exists', () => {
+      const exceptionItem = getExceptionListItemSchemaMock();
+      exceptionItem.entries = [getEntryMatchMock()];
+      const wrapper = mount(
+        <ThemeProvider theme={() => ({ eui: euiLightVars, darkMode: false })}>
+          <ExceptionListItemComponent
+            exceptionItem={exceptionItem}
+            exceptionId={'123'}
+            exceptionItemIndex={1}
+            indexPattern={{
+              id: '1234',
+              title: 'logstash-*',
+              fields,
+            }}
+            isLoading={false}
+            andLogicIncluded={true}
+            isOnlyItem={false}
+            onDeleteExceptionItem={jest.fn()}
+            onChangeExceptionItem={jest.fn()}
+          />
+        </ThemeProvider>
+      );
+
+      expect(
+        wrapper.find('[data-test-subj="exceptionItemEntryInvisibleAndBadge"]').exists()
+      ).toBeTruthy();
+    });
+
+    test('it renders no "and" badge when "andLogicIncluded" is "false"', () => {
+      const exceptionItem = getExceptionListItemSchemaMock();
+      exceptionItem.entries = [getEntryMatchMock()];
+      const wrapper = mount(
+        <ThemeProvider theme={() => ({ eui: euiLightVars, darkMode: false })}>
+          <ExceptionListItemComponent
+            exceptionItem={exceptionItem}
+            exceptionId={'123'}
+            exceptionItemIndex={1}
+            indexPattern={{
+              id: '1234',
+              title: 'logstash-*',
+              fields,
+            }}
+            isLoading={false}
+            andLogicIncluded={false}
+            isOnlyItem={false}
+            onDeleteExceptionItem={jest.fn()}
+            onChangeExceptionItem={jest.fn()}
+          />
+        </ThemeProvider>
+      );
+
+      expect(
+        wrapper.find('[data-test-subj="exceptionItemEntryInvisibleAndBadge"]').exists()
+      ).toBeFalsy();
+      expect(wrapper.find('[data-test-subj="exceptionItemEntryAndBadge"]').exists()).toBeFalsy();
+      expect(
+        wrapper.find('[data-test-subj="exceptionItemEntryFirstRowAndBadge"]').exists()
+      ).toBeFalsy();
+    });
+  });
+
+  describe('delete button logic', () => {
+    test('it renders delete button disabled when it is only entry left in builder', () => {
+      const exceptionItem = getExceptionListItemSchemaMock();
+      exceptionItem.entries = [getEntryMatchMock()];
+      const wrapper = mount(
+        <ExceptionListItemComponent
+          exceptionItem={exceptionItem}
+          exceptionId={'123'}
+          exceptionItemIndex={0}
+          indexPattern={{
+            id: '1234',
+            title: 'logstash-*',
+            fields,
+          }}
+          isLoading={false}
+          andLogicIncluded={false}
+          isOnlyItem={true}
+          onDeleteExceptionItem={jest.fn()}
+          onChangeExceptionItem={jest.fn()}
+        />
+      );
+
+      expect(
+        wrapper.find('[data-test-subj="exceptionItemEntryDeleteButton"] button').props().disabled
+      ).toBeTruthy();
+    });
+
+    test('it does not render delete button disabled when it is not the only entry left in builder', () => {
+      const exceptionItem = getExceptionListItemSchemaMock();
+      exceptionItem.entries = [getEntryMatchMock()];
+
+      const wrapper = mount(
+        <ExceptionListItemComponent
+          exceptionItem={exceptionItem}
+          exceptionId={'123'}
+          exceptionItemIndex={0}
+          indexPattern={{
+            id: '1234',
+            title: 'logstash-*',
+            fields,
+          }}
+          isLoading={false}
+          andLogicIncluded={false}
+          isOnlyItem={false}
+          onDeleteExceptionItem={jest.fn()}
+          onChangeExceptionItem={jest.fn()}
+        />
+      );
+
+      expect(
+        wrapper.find('[data-test-subj="exceptionItemEntryDeleteButton"] button').props().disabled
+      ).toBeFalsy();
+    });
+
+    test('it does not render delete button disabled when "exceptionItemIndex" is not "0"', () => {
+      const exceptionItem = getExceptionListItemSchemaMock();
+      exceptionItem.entries = [getEntryMatchMock()];
+      const wrapper = mount(
+        <ExceptionListItemComponent
+          exceptionItem={exceptionItem}
+          exceptionId={'123'}
+          exceptionItemIndex={1}
+          indexPattern={{
+            id: '1234',
+            title: 'logstash-*',
+            fields,
+          }}
+          isLoading={false}
+          andLogicIncluded={false}
+          // if exceptionItemIndex is not 0, wouldn't make sense for
+          // this to be true, but done for testing purposes
+          isOnlyItem={true}
+          onDeleteExceptionItem={jest.fn()}
+          onChangeExceptionItem={jest.fn()}
+        />
+      );
+
+      expect(
+        wrapper.find('[data-test-subj="exceptionItemEntryDeleteButton"] button').props().disabled
+      ).toBeFalsy();
+    });
+
+    test('it does not render delete button disabled when more than one entry exists', () => {
+      const exceptionItem = getExceptionListItemSchemaMock();
+      exceptionItem.entries = [getEntryMatchMock(), getEntryMatchMock()];
+      const wrapper = mount(
+        <ExceptionListItemComponent
+          exceptionItem={exceptionItem}
+          exceptionId={'123'}
+          exceptionItemIndex={0}
+          indexPattern={{
+            id: '1234',
+            title: 'logstash-*',
+            fields,
+          }}
+          isLoading={false}
+          andLogicIncluded={false}
+          isOnlyItem={true}
+          onDeleteExceptionItem={jest.fn()}
+          onChangeExceptionItem={jest.fn()}
+        />
+      );
+
+      expect(
+        wrapper.find('[data-test-subj="exceptionItemEntryDeleteButton"] button').at(0).props()
+          .disabled
+      ).toBeFalsy();
+    });
+
+    test('it invokes "onChangeExceptionItem" when delete button clicked', () => {
+      const mockOnDeleteExceptionItem = jest.fn();
+      const exceptionItem = getExceptionListItemSchemaMock();
+      exceptionItem.entries = [getEntryMatchMock(), getEntryMatchAnyMock()];
+      const wrapper = mount(
+        <ExceptionListItemComponent
+          exceptionItem={exceptionItem}
+          exceptionId={'123'}
+          exceptionItemIndex={0}
+          indexPattern={{
+            id: '1234',
+            title: 'logstash-*',
+            fields,
+          }}
+          isLoading={false}
+          andLogicIncluded={false}
+          isOnlyItem={true}
+          onDeleteExceptionItem={mockOnDeleteExceptionItem}
+          onChangeExceptionItem={jest.fn()}
+        />
+      );
+
+      wrapper
+        .find('[data-test-subj="exceptionItemEntryDeleteButton"] button')
+        .at(0)
+        .simulate('click');
+
+      expect(mockOnDeleteExceptionItem).toHaveBeenCalledWith(
+        {
+          ...exceptionItem,
+          entries: [getEntryMatchAnyMock()],
+        },
+        0
+      );
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/builder/builder_exception_item.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/builder/builder_exception_item.tsx
new file mode 100644
index 0000000000000..8e57e83d0e7e4
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/builder/builder_exception_item.tsx
@@ -0,0 +1,161 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useMemo, useCallback } from 'react';
+import { EuiButtonIcon, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
+import styled from 'styled-components';
+
+import { IIndexPattern } from '../../../../../../../../src/plugins/data/common';
+import { AndOrBadge } from '../../and_or_badge';
+import { EntryItemComponent } from './entry_item';
+import { getFormattedBuilderEntries } from '../helpers';
+import { FormattedBuilderEntry, ExceptionsBuilderExceptionItem, BuilderEntry } from '../types';
+
+const MyInvisibleAndBadge = styled(EuiFlexItem)`
+  visibility: hidden;
+`;
+
+const MyFirstRowContainer = styled(EuiFlexItem)`
+  padding-top: 20px;
+`;
+
+interface ExceptionListItemProps {
+  exceptionItem: ExceptionsBuilderExceptionItem;
+  exceptionId: string;
+  exceptionItemIndex: number;
+  isLoading: boolean;
+  indexPattern: IIndexPattern;
+  andLogicIncluded: boolean;
+  isOnlyItem: boolean;
+  onDeleteExceptionItem: (item: ExceptionsBuilderExceptionItem, index: number) => void;
+  onChangeExceptionItem: (item: ExceptionsBuilderExceptionItem, index: number) => void;
+}
+
+export const ExceptionListItemComponent = React.memo<ExceptionListItemProps>(
+  ({
+    exceptionItem,
+    exceptionId,
+    exceptionItemIndex,
+    indexPattern,
+    isLoading,
+    isOnlyItem,
+    andLogicIncluded,
+    onDeleteExceptionItem,
+    onChangeExceptionItem,
+  }) => {
+    const handleEntryChange = useCallback(
+      (entry: BuilderEntry, entryIndex: number): void => {
+        const updatedEntries: BuilderEntry[] = [
+          ...exceptionItem.entries.slice(0, entryIndex),
+          { ...entry },
+          ...exceptionItem.entries.slice(entryIndex + 1),
+        ];
+        const updatedExceptionItem: ExceptionsBuilderExceptionItem = {
+          ...exceptionItem,
+          entries: updatedEntries,
+        };
+        onChangeExceptionItem(updatedExceptionItem, exceptionItemIndex);
+      },
+      [onChangeExceptionItem, exceptionItem, exceptionItemIndex]
+    );
+
+    const handleDeleteEntry = useCallback(
+      (entryIndex: number): void => {
+        const updatedEntries: BuilderEntry[] = [
+          ...exceptionItem.entries.slice(0, entryIndex),
+          ...exceptionItem.entries.slice(entryIndex + 1),
+        ];
+        const updatedExceptionItem: ExceptionsBuilderExceptionItem = {
+          ...exceptionItem,
+          entries: updatedEntries,
+        };
+
+        onDeleteExceptionItem(updatedExceptionItem, exceptionItemIndex);
+      },
+      [exceptionItem, onDeleteExceptionItem, exceptionItemIndex]
+    );
+
+    const entries = useMemo(
+      (): FormattedBuilderEntry[] =>
+        indexPattern != null ? getFormattedBuilderEntries(indexPattern, exceptionItem.entries) : [],
+      [indexPattern, exceptionItem]
+    );
+
+    const andBadge = useMemo((): JSX.Element => {
+      const badge = <AndOrBadge includeAntennas type="and" />;
+      if (entries.length > 1 && exceptionItemIndex === 0) {
+        return (
+          <MyFirstRowContainer grow={false} data-test-subj="exceptionItemEntryFirstRowAndBadge">
+            {badge}
+          </MyFirstRowContainer>
+        );
+      } else if (entries.length > 1) {
+        return (
+          <EuiFlexItem grow={false} data-test-subj="exceptionItemEntryAndBadge">
+            {badge}
+          </EuiFlexItem>
+        );
+      } else {
+        return (
+          <MyInvisibleAndBadge grow={false} data-test-subj="exceptionItemEntryInvisibleAndBadge">
+            {badge}
+          </MyInvisibleAndBadge>
+        );
+      }
+    }, [entries.length, exceptionItemIndex]);
+
+    const getDeleteButton = useCallback(
+      (index: number): JSX.Element => {
+        const button = (
+          <EuiButtonIcon
+            color="danger"
+            iconType="trash"
+            onClick={() => handleDeleteEntry(index)}
+            isDisabled={isOnlyItem && entries.length === 1 && exceptionItemIndex === 0}
+            aria-label="entryDeleteButton"
+            className="exceptionItemEntryDeleteButton"
+            data-test-subj="exceptionItemEntryDeleteButton"
+          />
+        );
+        if (index === 0 && exceptionItemIndex === 0) {
+          return <MyFirstRowContainer grow={false}>{button}</MyFirstRowContainer>;
+        } else {
+          return <EuiFlexItem grow={false}>{button}</EuiFlexItem>;
+        }
+      },
+      [entries.length, exceptionItemIndex, handleDeleteEntry, isOnlyItem]
+    );
+
+    return (
+      <EuiFlexGroup gutterSize="s" data-test-subj="exceptionEntriesContainer">
+        {andLogicIncluded && andBadge}
+        <EuiFlexItem grow={6}>
+          <EuiFlexGroup gutterSize="s" direction="column">
+            {entries.map((item, index) => (
+              <EuiFlexItem key={`${exceptionId}-${index}`} grow={1}>
+                <EuiFlexGroup gutterSize="xs" alignItems="center" direction="row">
+                  <EuiFlexItem grow={1}>
+                    <EntryItemComponent
+                      entry={item}
+                      entryIndex={index}
+                      indexPattern={indexPattern}
+                      showLabel={exceptionItemIndex === 0 && index === 0}
+                      isLoading={isLoading}
+                      onChange={handleEntryChange}
+                    />
+                  </EuiFlexItem>
+                  {getDeleteButton(index)}
+                </EuiFlexGroup>
+              </EuiFlexItem>
+            ))}
+          </EuiFlexGroup>
+        </EuiFlexItem>
+      </EuiFlexGroup>
+    );
+  }
+);
+
+ExceptionListItemComponent.displayName = 'ExceptionListItem';
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/builder/exception_item.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/builder/exception_item.tsx
deleted file mode 100644
index 5e53ce3ba6578..0000000000000
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/builder/exception_item.tsx
+++ /dev/null
@@ -1,140 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import React, { useMemo } from 'react';
-import { EuiButtonIcon, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
-import styled from 'styled-components';
-
-import { IIndexPattern } from '../../../../../../../../src/plugins/data/common';
-import { AndOrBadge } from '../../and_or_badge';
-import { EntryItemComponent } from './entry_item';
-import { getFormattedBuilderEntries } from '../helpers';
-import { FormattedBuilderEntry, ExceptionsBuilderExceptionItem, BuilderEntry } from '../types';
-
-const MyInvisibleAndBadge = styled(EuiFlexItem)`
-  visibility: hidden;
-`;
-
-const MyFirstRowContainer = styled(EuiFlexItem)`
-  padding-top: 20px;
-`;
-
-interface ExceptionListItemProps {
-  exceptionItem: ExceptionsBuilderExceptionItem;
-  exceptionId: string;
-  exceptionItemIndex: number;
-  isLoading: boolean;
-  indexPattern: IIndexPattern;
-  andLogicIncluded: boolean;
-  onCheckAndLogic: (item: ExceptionsBuilderExceptionItem[]) => void;
-  onDeleteExceptionItem: (item: ExceptionsBuilderExceptionItem, index: number) => void;
-  onExceptionItemChange: (item: ExceptionsBuilderExceptionItem, index: number) => void;
-}
-
-export const ExceptionListItemComponent = React.memo<ExceptionListItemProps>(
-  ({
-    exceptionItem,
-    exceptionId,
-    exceptionItemIndex,
-    indexPattern,
-    isLoading,
-    andLogicIncluded,
-    onCheckAndLogic,
-    onDeleteExceptionItem,
-    onExceptionItemChange,
-  }) => {
-    const handleEntryChange = (entry: BuilderEntry, entryIndex: number): void => {
-      const updatedEntries: BuilderEntry[] = [
-        ...exceptionItem.entries.slice(0, entryIndex),
-        { ...entry },
-        ...exceptionItem.entries.slice(entryIndex + 1),
-      ];
-      const updatedExceptionItem: ExceptionsBuilderExceptionItem = {
-        ...exceptionItem,
-        entries: updatedEntries,
-      };
-      onExceptionItemChange(updatedExceptionItem, exceptionItemIndex);
-    };
-
-    const handleDeleteEntry = (entryIndex: number): void => {
-      const updatedEntries: BuilderEntry[] = [
-        ...exceptionItem.entries.slice(0, entryIndex),
-        ...exceptionItem.entries.slice(entryIndex + 1),
-      ];
-      const updatedExceptionItem: ExceptionsBuilderExceptionItem = {
-        ...exceptionItem,
-        entries: updatedEntries,
-      };
-
-      onDeleteExceptionItem(updatedExceptionItem, exceptionItemIndex);
-    };
-
-    const entries = useMemo((): FormattedBuilderEntry[] => {
-      onCheckAndLogic([exceptionItem]);
-      return indexPattern != null
-        ? getFormattedBuilderEntries(indexPattern, exceptionItem.entries)
-        : [];
-    }, [indexPattern, exceptionItem, onCheckAndLogic]);
-
-    const andBadge = useMemo((): JSX.Element => {
-      const badge = <AndOrBadge includeAntennas type="and" />;
-      if (entries.length > 1 && exceptionItemIndex === 0) {
-        return <MyFirstRowContainer grow={false}>{badge}</MyFirstRowContainer>;
-      } else if (entries.length > 1) {
-        return <EuiFlexItem grow={false}>{badge}</EuiFlexItem>;
-      } else {
-        return <MyInvisibleAndBadge grow={false}>{badge}</MyInvisibleAndBadge>;
-      }
-    }, [entries.length, exceptionItemIndex]);
-
-    const getDeleteButton = (index: number): JSX.Element => {
-      const button = (
-        <EuiButtonIcon
-          color="danger"
-          iconType="trash"
-          onClick={() => handleDeleteEntry(index)}
-          aria-label="entryDeleteButton"
-          className="exceptionItemEntryDeleteButton"
-          data-test-subj="exceptionItemEntryDeleteButton"
-        />
-      );
-      if (index === 0 && exceptionItemIndex === 0) {
-        return <MyFirstRowContainer grow={false}>{button}</MyFirstRowContainer>;
-      } else {
-        return <EuiFlexItem grow={false}>{button}</EuiFlexItem>;
-      }
-    };
-
-    return (
-      <EuiFlexGroup gutterSize="s" data-test-subj="exceptionEntriesContainer">
-        {andLogicIncluded && andBadge}
-        <EuiFlexItem grow={6}>
-          <EuiFlexGroup gutterSize="s" direction="column">
-            {entries.map((item, index) => (
-              <EuiFlexItem key={`${exceptionId}-${index}`} grow={1}>
-                <EuiFlexGroup gutterSize="xs" alignItems="center" direction="row">
-                  <EuiFlexItem grow={1}>
-                    <EntryItemComponent
-                      entry={item}
-                      entryIndex={index}
-                      indexPattern={indexPattern}
-                      showLabel={exceptionItemIndex === 0 && index === 0}
-                      isLoading={isLoading}
-                      onChange={handleEntryChange}
-                    />
-                  </EuiFlexItem>
-                  {getDeleteButton(index)}
-                </EuiFlexGroup>
-              </EuiFlexItem>
-            ))}
-          </EuiFlexGroup>
-        </EuiFlexItem>
-      </EuiFlexGroup>
-    );
-  }
-);
-
-ExceptionListItemComponent.displayName = 'ExceptionListItem';
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/builder/index.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/builder/index.tsx
index 6bff33afaf70c..08e5b49073ecf 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/builder/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/builder/index.tsx
@@ -3,11 +3,11 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import React, { useMemo, useCallback, useEffect, useState } from 'react';
+import React, { useCallback, useEffect, useState } from 'react';
 import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
 import styled from 'styled-components';
 
-import { ExceptionListItemComponent } from './exception_item';
+import { ExceptionListItemComponent } from './builder_exception_item';
 import { useFetchIndexPatterns } from '../../../../detections/containers/detection_engine/rules/fetch_index_patterns';
 import {
   ExceptionListItemSchema,
@@ -80,20 +80,9 @@ export const ExceptionBuilder = ({
   );
 
   const handleCheckAndLogic = (items: ExceptionsBuilderExceptionItem[]): void => {
-    setAndLogicIncluded((includesAnd: boolean): boolean => {
-      if (includesAnd) {
-        return true;
-      } else {
-        return items.filter(({ entries }) => entries.length > 1).length > 0;
-      }
-    });
+    setAndLogicIncluded(items.filter(({ entries }) => entries.length > 1).length > 0);
   };
 
-  // Bubble up changes to parent
-  useEffect(() => {
-    onChange({ exceptionItems: filterExceptionItems(exceptions), exceptionsToDelete });
-  }, [onChange, exceptionsToDelete, exceptions]);
-
   const handleDeleteExceptionItem = (
     item: ExceptionsBuilderExceptionItem,
     itemIndex: number
@@ -164,16 +153,6 @@ export const ExceptionBuilder = ({
     setExceptions((existingExceptions) => [...existingExceptions, { ...newException }]);
   }, [setExceptions, listType, listId, listNamespaceType, ruleName]);
 
-  // An exception item can have an empty array for `entries`
-  const displayInitialAddExceptionButton = useMemo((): boolean => {
-    return (
-      exceptions.length === 0 ||
-      (exceptions.length === 1 &&
-        exceptions[0].entries != null &&
-        exceptions[0].entries.length === 0)
-    );
-  }, [exceptions]);
-
   // Filters index pattern fields by exceptionable fields if list type is endpoint
   const filterIndexPatterns = useCallback(() => {
     if (listType === 'endpoint') {
@@ -199,6 +178,22 @@ export const ExceptionBuilder = ({
     }
   };
 
+  // Bubble up changes to parent
+  useEffect(() => {
+    onChange({ exceptionItems: filterExceptionItems(exceptions), exceptionsToDelete });
+  }, [onChange, exceptionsToDelete, exceptions]);
+
+  useEffect(() => {
+    if (
+      exceptions.length === 0 ||
+      (exceptions.length === 1 &&
+        exceptions[0].entries != null &&
+        exceptions[0].entries.length === 0)
+    ) {
+      handleAddNewExceptionItem();
+    }
+  }, [exceptions, handleAddNewExceptionItem]);
+
   return (
     <EuiFlexGroup gutterSize="s" direction="column">
       {(isLoading || indexPatternLoading) && (
@@ -233,9 +228,9 @@ export const ExceptionBuilder = ({
                 isLoading={indexPatternLoading}
                 exceptionItemIndex={index}
                 andLogicIncluded={andLogicIncluded}
-                onCheckAndLogic={handleCheckAndLogic}
+                isOnlyItem={exceptions.length === 1}
                 onDeleteExceptionItem={handleDeleteExceptionItem}
-                onExceptionItemChange={handleExceptionItemChange}
+                onChangeExceptionItem={handleExceptionItemChange}
               />
             </EuiFlexItem>
           </EuiFlexGroup>
@@ -253,7 +248,6 @@ export const ExceptionBuilder = ({
             <BuilderButtonOptions
               isOrDisabled={isOrDisabled}
               isAndDisabled={isAndDisabled}
-              displayInitButton={displayInitialAddExceptionButton}
               showNestedButton={false}
               onOrClicked={handleAddNewExceptionItem}
               onAndClicked={handleAddNewExceptionItemEntry}
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/edit_exception_modal/index.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/edit_exception_modal/index.tsx
index 73933d483e2cb..dbc70dfe21dd0 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/edit_exception_modal/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/edit_exception_modal/index.tsx
@@ -30,7 +30,7 @@ import {
 } from '../../../../../public/lists_plugin_deps';
 import * as i18n from './translations';
 import { useKibana } from '../../../lib/kibana';
-import { errorToToaster, displaySuccessToast, useStateToaster } from '../../toasters';
+import { useAppToasts } from '../../../hooks/use_app_toasts';
 import { ExceptionBuilder } from '../builder';
 import { useAddOrUpdateException } from '../use_add_exception';
 import { AddExceptionComments } from '../add_exception_comments';
@@ -93,7 +93,7 @@ export const EditExceptionModal = memo(function EditExceptionModal({
   const [exceptionItemsToAdd, setExceptionItemsToAdd] = useState<
     Array<ExceptionListItemSchema | CreateExceptionListItemSchema>
   >([]);
-  const [, dispatchToaster] = useStateToaster();
+  const { addError, addSuccess } = useAppToasts();
   const { loading: isSignalIndexLoading, signalIndexName } = useSignalIndex();
 
   const [{ isLoading: indexPatternLoading, indexPatterns }] = useFetchIndexPatterns(
@@ -102,15 +102,15 @@ export const EditExceptionModal = memo(function EditExceptionModal({
 
   const onError = useCallback(
     (error) => {
-      errorToToaster({ title: i18n.EDIT_EXCEPTION_ERROR, error, dispatchToaster });
+      addError(error, { title: i18n.EDIT_EXCEPTION_ERROR });
       onCancel();
     },
-    [dispatchToaster, onCancel]
+    [addError, onCancel]
   );
   const onSuccess = useCallback(() => {
-    displaySuccessToast(i18n.EDIT_EXCEPTION_SUCCESS, dispatchToaster);
+    addSuccess(i18n.EDIT_EXCEPTION_SUCCESS);
     onConfirm();
-  }, [dispatchToaster, onConfirm]);
+  }, [addSuccess, onConfirm]);
 
   const [{ isLoading: addExceptionIsLoading }, addOrUpdateExceptionItems] = useAddOrUpdateException(
     {
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/translations.ts b/x-pack/plugins/security_solution/public/common/components/exceptions/translations.ts
index ee3255446b334..870f98f63ee2c 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/translations.ts
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/translations.ts
@@ -179,13 +179,6 @@ export const EXCEPTION_FIELD_LISTS_PLACEHOLDER = i18n.translate(
   }
 );
 
-export const ADD_EXCEPTION_TITLE = i18n.translate(
-  'xpack.securitySolution.exceptions.addExceptionTitle',
-  {
-    defaultMessage: 'Add exception',
-  }
-);
-
 export const AND = i18n.translate('xpack.securitySolution.exceptions.andDescription', {
   defaultMessage: 'AND',
 });
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exception_item/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exception_item/index.test.tsx
index 0e2908fc34232..90752f9450e4c 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exception_item/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exception_item/index.test.tsx
@@ -13,6 +13,8 @@ import { ExceptionItem } from './';
 import { getExceptionListItemSchemaMock } from '../../../../../../../lists/common/schemas/response/exception_list_item_schema.mock';
 import { getCommentsArrayMock } from '../../../../../../../lists/common/schemas/types/comments.mock';
 
+jest.mock('../../../../lib/kibana');
+
 describe('ExceptionItem', () => {
   it('it renders ExceptionDetails and ExceptionEntries', () => {
     const exceptionItem = getExceptionListItemSchemaMock();
diff --git a/x-pack/plugins/security_solution/public/common/components/help_menu/index.tsx b/x-pack/plugins/security_solution/public/common/components/help_menu/index.tsx
index 56f0c825aa59e..f4477740f7b58 100644
--- a/x-pack/plugins/security_solution/public/common/components/help_menu/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/help_menu/index.tsx
@@ -14,12 +14,12 @@ export const HelpMenu = React.memo(() => {
   useEffect(() => {
     chrome.setHelpExtension({
       appName: i18n.translate('xpack.securitySolution.chrome.help.appName', {
-        defaultMessage: 'SIEM',
+        defaultMessage: 'Security',
       }),
       links: [
         {
           content: i18n.translate('xpack.securitySolution.chrome.helpMenu.documentation', {
-            defaultMessage: 'SIEM documentation',
+            defaultMessage: 'Security documentation',
           }),
           href: docLinks.links.siem.guide,
           iconType: 'documents',
diff --git a/x-pack/plugins/security_solution/public/common/components/links/index.tsx b/x-pack/plugins/security_solution/public/common/components/links/index.tsx
index 3b92faff91517..4a9ad94d8f36d 100644
--- a/x-pack/plugins/security_solution/public/common/components/links/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/links/index.tsx
@@ -78,7 +78,7 @@ const HostDetailsLinkComponent: React.FC<{ children?: React.ReactNode; hostName:
 };
 export const HostDetailsLink = React.memo(HostDetailsLinkComponent);
 
-const whitelistUrlSchemes = ['http://', 'https://'];
+const allowedUrlSchemes = ['http://', 'https://'];
 export const ExternalLink = React.memo<{
   url: string;
   children?: React.ReactNode;
@@ -96,8 +96,8 @@ export const ExternalLink = React.memo<{
     const lastVisibleItemIndex = overflowIndexStart - 1;
     const lastItemIndex = allItemsLimit - 1;
     const lastIndexToShow = Math.max(0, Math.min(lastVisibleItemIndex, lastItemIndex));
-    const inWhitelist = whitelistUrlSchemes.some((scheme) => url.indexOf(scheme) === 0);
-    return url && inWhitelist && !isUrlInvalid(url) && children ? (
+    const inAllowlist = allowedUrlSchemes.some((scheme) => url.indexOf(scheme) === 0);
+    return url && inAllowlist && !isUrlInvalid(url) && children ? (
       <EuiToolTip content={url} position="top" data-test-subj="externalLinkTooltip">
         <EuiLink href={url} target="_blank" rel="noopener" data-test-subj="externalLink">
           {children}
diff --git a/x-pack/plugins/security_solution/public/common/components/ml/anomaly/use_anomalies_table_data.ts b/x-pack/plugins/security_solution/public/common/components/ml/anomaly/use_anomalies_table_data.ts
index a6bbdee79cf04..6fbb308672e5d 100644
--- a/x-pack/plugins/security_solution/public/common/components/ml/anomaly/use_anomalies_table_data.ts
+++ b/x-pack/plugins/security_solution/public/common/components/ml/anomaly/use_anomalies_table_data.ts
@@ -129,8 +129,8 @@ export const useAnomaliesTableData = ({
     influencersOrCriteriaToString(influencers),
     // eslint-disable-next-line react-hooks/exhaustive-deps
     influencersOrCriteriaToString(criteriaFields),
-    startDate,
-    endDate,
+    startDateMs,
+    endDateMs,
     skip,
     userPermissions,
     // eslint-disable-next-line react-hooks/exhaustive-deps
diff --git a/x-pack/plugins/security_solution/public/common/components/ml/tables/anomalies_host_table.tsx b/x-pack/plugins/security_solution/public/common/components/ml/tables/anomalies_host_table.tsx
index d6e343265b6e7..78cd23e6647c0 100644
--- a/x-pack/plugins/security_solution/public/common/components/ml/tables/anomalies_host_table.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/ml/tables/anomalies_host_table.tsx
@@ -79,7 +79,6 @@ const AnomaliesHostTableComponent: React.FC<AnomaliesHostTableProps> = ({
         <BasicTable
           // @ts-ignore the Columns<T, U> type is not as specific as EUI's...
           columns={columns}
-          compressed
           // @ts-ignore ...which leads to `networks` not "matching" the columns
           items={hosts}
           pagination={pagination}
diff --git a/x-pack/plugins/security_solution/public/common/components/ml/tables/anomalies_network_table.tsx b/x-pack/plugins/security_solution/public/common/components/ml/tables/anomalies_network_table.tsx
index c7a49202bf239..73fe7b1ea5f6e 100644
--- a/x-pack/plugins/security_solution/public/common/components/ml/tables/anomalies_network_table.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/ml/tables/anomalies_network_table.tsx
@@ -69,7 +69,6 @@ const AnomaliesNetworkTableComponent: React.FC<AnomaliesNetworkTableProps> = ({
         <BasicTable
           // @ts-ignore the Columns<T, U> type is not as specific as EUI's...
           columns={columns}
-          compressed
           // @ts-ignore ...which leads to `networks` not "matching" the columns
           items={networks}
           pagination={pagination}
diff --git a/x-pack/plugins/security_solution/public/common/components/ml_popover/jobs_table/__snapshots__/jobs_table.test.tsx.snap b/x-pack/plugins/security_solution/public/common/components/ml_popover/jobs_table/__snapshots__/jobs_table.test.tsx.snap
index d8b8ae63cf41f..60088a77878ad 100644
--- a/x-pack/plugins/security_solution/public/common/components/ml_popover/jobs_table/__snapshots__/jobs_table.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/common/components/ml_popover/jobs_table/__snapshots__/jobs_table.test.tsx.snap
@@ -21,7 +21,6 @@ exports[`JobsTableComponent renders correctly against snapshot 1`] = `
       },
     ]
   }
-  compressed={true}
   data-test-subj="jobs-table"
   items={
     Array [
diff --git a/x-pack/plugins/security_solution/public/common/components/ml_popover/jobs_table/jobs_table.tsx b/x-pack/plugins/security_solution/public/common/components/ml_popover/jobs_table/jobs_table.tsx
index 40097ed68684f..f28a99c9947d5 100644
--- a/x-pack/plugins/security_solution/public/common/components/ml_popover/jobs_table/jobs_table.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/ml_popover/jobs_table/jobs_table.tsx
@@ -115,7 +115,6 @@ export const JobsTableComponent = ({ isLoading, jobs, onJobStateChange }: JobTab
   return (
     <EuiBasicTable
       data-test-subj="jobs-table"
-      compressed={true}
       columns={getJobsTableColumns(isLoading, onJobStateChange, basePath)}
       items={getPaginatedItems(jobs, pageIndex, pageSize)}
       loading={isLoading}
diff --git a/x-pack/plugins/security_solution/public/common/components/ml_popover/ml_popover.tsx b/x-pack/plugins/security_solution/public/common/components/ml_popover/ml_popover.tsx
index a34dfb5753d92..0ebf367471848 100644
--- a/x-pack/plugins/security_solution/public/common/components/ml_popover/ml_popover.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/ml_popover/ml_popover.tsx
@@ -177,7 +177,7 @@ export const MlPopover = React.memo(() => {
                     values={{
                       mlDocs: (
                         <a
-                          href={`${docLinks.ELASTIC_WEBSITE_URL}guide/en/siem/guide/${docLinks.DOC_LINK_VERSION}/machine-learning.html`}
+                          href={`${docLinks.ELASTIC_WEBSITE_URL}guide/en/security/${docLinks.DOC_LINK_VERSION}/machine-learning.html`}
                           rel="noopener noreferrer"
                           target="_blank"
                         >
diff --git a/x-pack/plugins/security_solution/public/common/components/paginated_table/index.tsx b/x-pack/plugins/security_solution/public/common/components/paginated_table/index.tsx
index 9f95284d989a9..448fa58443407 100644
--- a/x-pack/plugins/security_solution/public/common/components/paginated_table/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/paginated_table/index.tsx
@@ -249,7 +249,6 @@ const PaginatedTableComponent: FC<SiemTables> = ({
           <>
             <BasicTable
               columns={columns}
-              compressed
               items={pageOfItems}
               onChange={onChange}
               sorting={
diff --git a/x-pack/plugins/security_solution/public/common/components/toasters/utils.ts b/x-pack/plugins/security_solution/public/common/components/toasters/utils.ts
index e7cc389d4c06b..47c5588a12830 100644
--- a/x-pack/plugins/security_solution/public/common/components/toasters/utils.ts
+++ b/x-pack/plugins/security_solution/public/common/components/toasters/utils.ts
@@ -9,7 +9,7 @@ import { isError } from 'lodash/fp';
 
 import { AppToast, ActionToaster } from './';
 import { isToasterError } from './errors';
-import { isApiError } from '../../utils/api';
+import { isAppError } from '../../utils/api';
 
 /**
  * Displays an error toast for the provided title and message
@@ -114,7 +114,7 @@ export const errorToToaster = ({
       iconType,
       errors: error.messages,
     };
-  } else if (isApiError(error)) {
+  } else if (isAppError(error)) {
     toast = {
       id,
       title,
diff --git a/x-pack/plugins/security_solution/public/common/components/with_hover_actions/index.tsx b/x-pack/plugins/security_solution/public/common/components/with_hover_actions/index.tsx
index 97705533689e9..e6577bd040e25 100644
--- a/x-pack/plugins/security_solution/public/common/components/with_hover_actions/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/with_hover_actions/index.tsx
@@ -17,10 +17,6 @@ const WithHoverActionsPopover = (styled(EuiPopover as any)`
   }
 ` as unknown) as typeof EuiPopover;
 
-const Container = styled.div`
-  width: fit-content;
-`;
-
 interface Props {
   /**
    * Always show the hover menu contents (default: false)
@@ -68,7 +64,14 @@ export const WithHoverActions = React.memo<Props>(
       setShowHoverContent(false);
     }, []);
 
-    const content = useMemo(() => <>{render(showHoverContent)}</>, [render, showHoverContent]);
+    const content = useMemo(
+      () => (
+        <div data-test-subj="withHoverActionsButton" onMouseEnter={onMouseEnter}>
+          {render(showHoverContent)}
+        </div>
+      ),
+      [onMouseEnter, render, showHoverContent]
+    );
 
     useEffect(() => {
       setIsOpen(hoverContent != null && (showHoverContent || alwaysShow));
@@ -79,7 +82,7 @@ export const WithHoverActions = React.memo<Props>(
     }, [closePopOverTrigger]);
 
     return (
-      <Container onMouseEnter={onMouseEnter} onMouseLeave={onMouseLeave}>
+      <div onMouseLeave={onMouseLeave}>
         <WithHoverActionsPopover
           anchorPosition={'downCenter'}
           button={content}
@@ -90,7 +93,7 @@ export const WithHoverActions = React.memo<Props>(
         >
           {isOpen ? <>{hoverContent}</> : null}
         </WithHoverActionsPopover>
-      </Container>
+      </div>
     );
   }
 );
diff --git a/x-pack/plugins/security_solution/public/common/containers/source/index.tsx b/x-pack/plugins/security_solution/public/common/containers/source/index.tsx
index 8c03ab7b9f508..cc43dd6f42772 100644
--- a/x-pack/plugins/security_solution/public/common/containers/source/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/containers/source/index.tsx
@@ -81,7 +81,7 @@ export const getBrowserFields = memoizeOne(
   (newArgs, lastArgs) => newArgs[0] === lastArgs[0]
 );
 
-export const getdocValueFields = memoizeOne(
+export const getDocValueFields = memoizeOne(
   (_title: string, fields: IndexField[]): DocValueFields[] =>
     fields && fields.length > 0
       ? fields.reduce<DocValueFields[]>((accumulator: DocValueFields[], field: IndexField) => {
@@ -177,7 +177,7 @@ export const useWithSource = (
               defaultIndex.join(),
               get('data.source.status.indexFields', result)
             ),
-            docValueFields: getdocValueFields(
+            docValueFields: getDocValueFields(
               defaultIndex.join(),
               get('data.source.status.indexFields', result)
             ),
diff --git a/x-pack/plugins/security_solution/public/common/hooks/use_app_toasts.test.ts b/x-pack/plugins/security_solution/public/common/hooks/use_app_toasts.test.ts
new file mode 100644
index 0000000000000..e0e629793952a
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/hooks/use_app_toasts.test.ts
@@ -0,0 +1,63 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { renderHook } from '@testing-library/react-hooks';
+
+import { useToasts } from '../lib/kibana';
+import { useAppToasts } from './use_app_toasts';
+
+jest.mock('../lib/kibana');
+
+describe('useDeleteList', () => {
+  let addErrorMock: jest.Mock;
+  let addSuccessMock: jest.Mock;
+
+  beforeEach(() => {
+    addErrorMock = jest.fn();
+    addSuccessMock = jest.fn();
+    (useToasts as jest.Mock).mockImplementation(() => ({
+      addError: addErrorMock,
+      addSuccess: addSuccessMock,
+    }));
+  });
+
+  it('works normally with a regular error', async () => {
+    const error = new Error('regular error');
+    const { result } = renderHook(() => useAppToasts());
+
+    result.current.addError(error, { title: 'title' });
+
+    expect(addErrorMock).toHaveBeenCalledWith(error, { title: 'title' });
+  });
+
+  it("uses a AppError's body.message as the toastMessage", async () => {
+    const kibanaApiError = {
+      message: 'Not Found',
+      body: { status_code: 404, message: 'Detailed Message' },
+    };
+
+    const { result } = renderHook(() => useAppToasts());
+
+    result.current.addError(kibanaApiError, { title: 'title' });
+
+    expect(addErrorMock).toHaveBeenCalledWith(kibanaApiError, {
+      title: 'title',
+      toastMessage: 'Detailed Message',
+    });
+  });
+
+  it('converts an unknown error to an Error', () => {
+    const unknownError = undefined;
+
+    const { result } = renderHook(() => useAppToasts());
+
+    result.current.addError(unknownError, { title: 'title' });
+
+    expect(addErrorMock).toHaveBeenCalledWith(Error(`${undefined}`), {
+      title: 'title',
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/common/hooks/use_app_toasts.ts b/x-pack/plugins/security_solution/public/common/hooks/use_app_toasts.ts
new file mode 100644
index 0000000000000..bc59d87100058
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/hooks/use_app_toasts.ts
@@ -0,0 +1,48 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { useCallback, useRef } from 'react';
+
+import { ErrorToastOptions, ToastsStart, Toast } from '../../../../../../src/core/public';
+import { useToasts } from '../lib/kibana';
+import { isAppError, AppError } from '../utils/api';
+
+export type UseAppToasts = Pick<ToastsStart, 'addSuccess'> & {
+  api: ToastsStart;
+  addError: (error: unknown, options: ErrorToastOptions) => Toast;
+};
+
+export const useAppToasts = (): UseAppToasts => {
+  const toasts = useToasts();
+  const addError = useRef(toasts.addError.bind(toasts)).current;
+  const addSuccess = useRef(toasts.addSuccess.bind(toasts)).current;
+
+  const addAppError = useCallback(
+    (error: AppError, options: ErrorToastOptions) =>
+      addError(error, {
+        ...options,
+        toastMessage: error.body.message,
+      }),
+    [addError]
+  );
+
+  const _addError = useCallback(
+    (error: unknown, options: ErrorToastOptions) => {
+      if (isAppError(error)) {
+        return addAppError(error, options);
+      } else {
+        if (error instanceof Error) {
+          return addError(error, options);
+        } else {
+          return addError(new Error(String(error)), options);
+        }
+      }
+    },
+    [addAppError, addError]
+  );
+
+  return { api: toasts, addError: _addError, addSuccess };
+};
diff --git a/x-pack/plugins/security_solution/public/common/lib/clipboard/clipboard.tsx b/x-pack/plugins/security_solution/public/common/lib/clipboard/clipboard.tsx
index fdb6ed130a525..75b7308ab61f1 100644
--- a/x-pack/plugins/security_solution/public/common/lib/clipboard/clipboard.tsx
+++ b/x-pack/plugins/security_solution/public/common/lib/clipboard/clipboard.tsx
@@ -4,13 +4,12 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { EuiGlobalToastListToast as Toast, EuiButtonIcon } from '@elastic/eui';
+import { EuiButtonIcon } from '@elastic/eui';
 import copy from 'copy-to-clipboard';
 import React from 'react';
-import uuid from 'uuid';
 
 import * as i18n from './translations';
-import { useStateToaster } from '../../components/toasters';
+import { useAppToasts } from '../../hooks/use_app_toasts';
 
 export type OnCopy = ({
   content,
@@ -20,17 +19,6 @@ export type OnCopy = ({
   isSuccess: boolean;
 }) => void;
 
-interface GetSuccessToastParams {
-  titleSummary?: string;
-}
-
-const getSuccessToast = ({ titleSummary }: GetSuccessToastParams): Toast => ({
-  id: `copy-success-${uuid.v4()}`,
-  color: 'success',
-  iconType: 'copyClipboard',
-  title: `${i18n.COPIED} ${titleSummary} ${i18n.TO_THE_CLIPBOARD}`,
-});
-
 interface Props {
   children?: JSX.Element;
   content: string | number;
@@ -40,7 +28,7 @@ interface Props {
 }
 
 export const Clipboard = ({ children, content, onCopy, titleSummary, toastLifeTimeMs }: Props) => {
-  const dispatchToaster = useStateToaster()[1];
+  const { addSuccess } = useAppToasts();
   const onClick = (event: React.MouseEvent<HTMLButtonElement>) => {
     event.preventDefault();
     event.stopPropagation();
@@ -52,10 +40,7 @@ export const Clipboard = ({ children, content, onCopy, titleSummary, toastLifeTi
     }
 
     if (isSuccess) {
-      dispatchToaster({
-        type: 'addToaster',
-        toast: { toastLifeTimeMs, ...getSuccessToast({ titleSummary }) },
-      });
+      addSuccess(`${i18n.COPIED} ${titleSummary} ${i18n.TO_THE_CLIPBOARD}`, { toastLifeTimeMs });
     }
   };
 
diff --git a/x-pack/plugins/security_solution/public/common/lib/kibana/__mocks__/index.ts b/x-pack/plugins/security_solution/public/common/lib/kibana/__mocks__/index.ts
index c3e1f35f37356..6ada887ece175 100644
--- a/x-pack/plugins/security_solution/public/common/lib/kibana/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/public/common/lib/kibana/__mocks__/index.ts
@@ -4,6 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { notificationServiceMock } from '../../../../../../../../src/core/public/mocks';
 import {
   createKibanaContextProviderMock,
   createUseUiSettingMock,
@@ -19,6 +20,7 @@ export const useUiSetting$ = jest.fn(createUseUiSetting$Mock());
 export const useTimeZone = jest.fn();
 export const useDateFormat = jest.fn();
 export const useBasePath = jest.fn(() => '/test/base/path');
+export const useToasts = jest.fn(() => notificationServiceMock.createStartContract().toasts);
 export const useCurrentUser = jest.fn();
 export const withKibana = jest.fn(createWithKibanaMock());
 export const KibanaContextProvider = jest.fn(createKibanaContextProviderMock());
diff --git a/x-pack/plugins/security_solution/public/common/utils/api/index.ts b/x-pack/plugins/security_solution/public/common/utils/api/index.ts
index ab442d0d09cf9..e8934259fe43e 100644
--- a/x-pack/plugins/security_solution/public/common/utils/api/index.ts
+++ b/x-pack/plugins/security_solution/public/common/utils/api/index.ts
@@ -6,14 +6,33 @@
 
 import { has } from 'lodash/fp';
 
-export interface KibanaApiError {
+export interface AppError {
   name: string;
   message: string;
+  body: {
+    message: string;
+  };
+}
+
+export interface KibanaError extends AppError {
+  body: {
+    message: string;
+    statusCode: number;
+  };
+}
+
+export interface SecurityAppError extends AppError {
   body: {
     message: string;
     status_code: number;
   };
 }
 
-export const isApiError = (error: unknown): error is KibanaApiError =>
+export const isKibanaError = (error: unknown): error is KibanaError =>
+  has('message', error) && has('body.message', error) && has('body.statusCode', error);
+
+export const isSecurityAppError = (error: unknown): error is SecurityAppError =>
   has('message', error) && has('body.message', error) && has('body.status_code', error);
+
+export const isAppError = (error: unknown): error is AppError =>
+  isKibanaError(error) || isSecurityAppError(error);
diff --git a/x-pack/plugins/security_solution/public/common/utils/test_utils.ts b/x-pack/plugins/security_solution/public/common/utils/test_utils.ts
deleted file mode 100644
index 5a3cddb74657d..0000000000000
--- a/x-pack/plugins/security_solution/public/common/utils/test_utils.ts
+++ /dev/null
@@ -1,16 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { ReactWrapper } from 'enzyme';
-import { act } from 'react-dom/test-utils';
-
-// Temporary fix for https://github.com/enzymejs/enzyme/issues/2073
-export const waitForUpdates = async <P>(wrapper: ReactWrapper<P>) => {
-  await act(async () => {
-    await new Promise((resolve) => setTimeout(resolve, 0));
-    wrapper.update();
-  });
-};
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_histogram_panel/index.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_histogram_panel/index.tsx
index 560c092d12076..3bc84bb7c32ee 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_histogram_panel/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_histogram_panel/index.tsx
@@ -80,10 +80,14 @@ const getHistogramOption = (fieldName: string): MatrixHistogramOption => ({
 
 const NO_LEGEND_DATA: LegendItem[] = [];
 
+const DEFAULT_STACK_BY = 'signal.rule.name';
+const getDefaultStackByOption = (): AlertsHistogramOption =>
+  alertsHistogramOptions.find(({ text }) => text === DEFAULT_STACK_BY) ?? alertsHistogramOptions[0];
+
 export const AlertsHistogramPanel = memo<AlertsHistogramPanelProps>(
   ({
     chartHeight,
-    defaultStackByOption = alertsHistogramOptions[8], // signal.rule.name
+    defaultStackByOption = getDefaultStackByOption(),
     deleteQuery,
     filters,
     headerChildren,
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/pre_packaged_rules/update_callout.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/pre_packaged_rules/update_callout.tsx
index 3be2b853925f6..4b454a9ed4d4a 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/pre_packaged_rules/update_callout.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/pre_packaged_rules/update_callout.tsx
@@ -56,7 +56,7 @@ const UpdatePrePackagedRulesCallOutComponent: React.FC<UpdatePrePackagedRulesCal
         {prepackagedRulesOrTimelines?.callOutMessage}
         <br />
         <EuiLink
-          href={`${services.docLinks.ELASTIC_WEBSITE_URL}guide/en/siem/guide/${services.docLinks.DOC_LINK_VERSION}/prebuilt-rules-changelog.html`}
+          href={`${services.docLinks.ELASTIC_WEBSITE_URL}guide/en/security/${services.docLinks.DOC_LINK_VERSION}/prebuilt-rules-changelog.html`}
           target="_blank"
         >
           {i18n.RELEASE_NOTES_HELP}
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/select_rule_type/index.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/select_rule_type/index.tsx
index 6546c1ba59d84..c6ea269e1a355 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/select_rule_type/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/select_rule_type/index.tsx
@@ -8,14 +8,13 @@ import React, { useCallback, useMemo } from 'react';
 import { EuiCard, EuiFlexGrid, EuiFlexItem, EuiFormRow, EuiIcon } from '@elastic/eui';
 
 import { isMlRule } from '../../../../../common/machine_learning/helpers';
+import { isThresholdRule } from '../../../../../common/detection_engine/utils';
 import { RuleType } from '../../../../../common/detection_engine/types';
 import { FieldHook } from '../../../../shared_imports';
 import { useKibana } from '../../../../common/lib/kibana';
 import * as i18n from './translations';
 import { MlCardDescription } from './ml_card_description';
 
-const isThresholdRule = (ruleType: RuleType) => ruleType === 'threshold';
-
 interface SelectRuleTypeProps {
   describedByIds?: string[];
   field: FieldHook;
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/index.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/index.tsx
index 4d91460bfd2c8..ec812fa63eadf 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/index.tsx
@@ -4,11 +4,12 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { EuiAccordion, EuiFlexItem, EuiSpacer, EuiButtonEmpty, EuiFormRow } from '@elastic/eui';
+import { EuiAccordion, EuiFlexItem, EuiSpacer, EuiFormRow } from '@elastic/eui';
 import React, { FC, memo, useCallback, useEffect, useState } from 'react';
 import styled from 'styled-components';
-import deepEqual from 'fast-deep-equal';
 
+import { isMlRule } from '../../../../../common/machine_learning/helpers';
+import { isThresholdRule } from '../../../../../common/detection_engine/utils';
 import {
   RuleStepProps,
   RuleStep,
@@ -35,7 +36,6 @@ import * as I18n from './translations';
 import { StepContentWrapper } from '../step_content_wrapper';
 import { NextStep } from '../next_step';
 import { MarkdownEditorForm } from '../../../../common/components/markdown_editor/form';
-import { setFieldValue } from '../../../pages/detection_engine/rules/helpers';
 import { SeverityField } from '../severity_mapping';
 import { RiskScoreField } from '../risk_score_mapping';
 import { useFetchIndexPatterns } from '../../../containers/detection_engine/rules';
@@ -44,8 +44,8 @@ import { AutocompleteField } from '../autocomplete_field';
 const CommonUseField = getUseField({ component: Field });
 
 interface StepAboutRuleProps extends RuleStepProps {
-  defaultValues?: AboutStepRule | null;
-  defineRuleData?: DefineStepRule | null;
+  defaultValues?: AboutStepRule;
+  defineRuleData?: DefineStepRule;
 }
 
 const ThreeQuartersContainer = styled.div`
@@ -60,26 +60,6 @@ const TagContainer = styled.div`
 
 TagContainer.displayName = 'TagContainer';
 
-const AdvancedSettingsAccordion = styled(EuiAccordion)`
-  .euiAccordion__iconWrapper {
-    display: none;
-  }
-
-  .euiAccordion__childWrapper {
-    transition-duration: 1ms; /* hack to fire Step accordion to set proper content's height */
-  }
-
-  &.euiAccordion-isOpen .euiButtonEmpty__content > svg {
-    transform: rotate(90deg);
-  }
-`;
-
-const AdvancedSettingsAccordionButton = (
-  <EuiButtonEmpty flush="left" size="s" iconType="arrowRight">
-    {I18n.ADVANCED_SETTINGS}
-  </EuiButtonEmpty>
-);
-
 const StepAboutRuleComponent: FC<StepAboutRuleProps> = ({
   addPadding = false,
   defaultValues,
@@ -91,48 +71,39 @@ const StepAboutRuleComponent: FC<StepAboutRuleProps> = ({
   setForm,
   setStepData,
 }) => {
-  const [myStepData, setMyStepData] = useState<AboutStepRule>(stepAboutDefaultValue);
+  const initialState = defaultValues ?? stepAboutDefaultValue;
+  const [myStepData, setMyStepData] = useState<AboutStepRule>(initialState);
   const [{ isLoading: indexPatternLoading, indexPatterns }] = useFetchIndexPatterns(
     defineRuleData?.index ?? []
   );
+  const canUseExceptions =
+    defineRuleData?.ruleType &&
+    !isMlRule(defineRuleData.ruleType) &&
+    !isThresholdRule(defineRuleData.ruleType);
 
   const { form } = useForm({
-    defaultValue: myStepData,
+    defaultValue: initialState,
     options: { stripEmptyFields: false },
     schema,
   });
+  const { getFields, submit } = form;
 
   const onSubmit = useCallback(async () => {
     if (setStepData) {
       setStepData(RuleStep.aboutRule, null, false);
-      const { isValid, data } = await form.submit();
+      const { isValid, data } = await submit();
       if (isValid) {
         setStepData(RuleStep.aboutRule, data, isValid);
         setMyStepData({ ...data, isNew: false } as AboutStepRule);
       }
     }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [form]);
-
-  useEffect(() => {
-    const { isNew, ...initDefaultValue } = myStepData;
-    if (defaultValues != null && !deepEqual(initDefaultValue, defaultValues)) {
-      const myDefaultValues = {
-        ...defaultValues,
-        isNew: false,
-      };
-      setMyStepData(myDefaultValues);
-      setFieldValue(form, schema, myDefaultValues);
-    }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [defaultValues]);
+  }, [setStepData, submit]);
 
   useEffect(() => {
-    if (setForm != null) {
+    if (setForm) {
       setForm(RuleStep.aboutRule, form);
     }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [form]);
+  }, [setForm, form]);
 
   return isReadOnlyView && myStepData.name != null ? (
     <StepContentWrapper data-test-subj="aboutStep" addPadding={addPadding}>
@@ -208,10 +179,10 @@ const StepAboutRuleComponent: FC<StepAboutRuleProps> = ({
             />
           </TagContainer>
           <EuiSpacer size="l" />
-          <AdvancedSettingsAccordion
+          <EuiAccordion
             data-test-subj="advancedSettings"
             id="advancedSettingsAccordion"
-            buttonContent={AdvancedSettingsAccordionButton}
+            buttonContent={I18n.ADVANCED_SETTINGS}
           >
             <EuiSpacer size="l" />
             <UseField
@@ -289,8 +260,7 @@ const StepAboutRuleComponent: FC<StepAboutRuleProps> = ({
                   idAria: 'detectionEngineStepAboutRuleAssociatedToEndpointList',
                   'data-test-subj': 'detectionEngineStepAboutRuleAssociatedToEndpointList',
                   euiFieldProps: {
-                    fullWidth: true,
-                    isDisabled: isLoading,
+                    disabled: isLoading || !canUseExceptions,
                   },
                 }}
               />
@@ -302,8 +272,7 @@ const StepAboutRuleComponent: FC<StepAboutRuleProps> = ({
                   idAria: 'detectionEngineStepAboutRuleBuildingBlock',
                   'data-test-subj': 'detectionEngineStepAboutRuleBuildingBlock',
                   euiFieldProps: {
-                    fullWidth: true,
-                    isDisabled: isLoading,
+                    disabled: isLoading,
                   },
                 }}
               />
@@ -334,12 +303,12 @@ const StepAboutRuleComponent: FC<StepAboutRuleProps> = ({
                 placeholder: '',
               }}
             />
-          </AdvancedSettingsAccordion>
+          </EuiAccordion>
           <FormDataProvider pathsToWatch="severity">
             {({ severity }) => {
               const newRiskScore = defaultRiskScoreBySeverity[severity as SeverityValue];
-              const severityField = form.getFields().severity;
-              const riskScoreField = form.getFields().riskScore;
+              const severityField = getFields().severity;
+              const riskScoreField = getFields().riskScore;
               if (
                 severityField.value !== severity &&
                 newRiskScore != null &&
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/schema.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/schema.tsx
index f178923df5915..fbd03850eee75 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/schema.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/schema.tsx
@@ -34,7 +34,7 @@ export const schema: FormSchema = {
       'xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldAuthorHelpText',
       {
         defaultMessage:
-          'Type one or more author for this rule. Press enter after each author to add a new one.',
+          'Type one or more authors for this rule. Press enter after each author to add a new one.',
       }
     ),
     labelAppend: OptionalFieldLabel,
@@ -280,7 +280,7 @@ export const schema: FormSchema = {
       'xpack.securitySolution.detectionEngine.createRule.stepAboutRule.guideHelpText',
       {
         defaultMessage:
-          'Provide helpful information for analysts that are performing a signal investigation. This guide will appear on both the rule details page and in timelines created from alerts generated by this rule.',
+          'Provide helpful information for analysts that are investigating detection alerts. This guide will appear on the rule details page and in timelines (as notes) created from detection alerts generated by this rule.',
       }
     ),
     labelAppend: OptionalFieldLabel,
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/step_define_rule/index.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/step_define_rule/index.tsx
index c7d70684b34cf..51e9291f31941 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/step_define_rule/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/step_define_rule/index.tsx
@@ -17,7 +17,6 @@ import { useFetchIndexPatterns } from '../../../containers/detection_engine/rule
 import { DEFAULT_TIMELINE_TITLE } from '../../../../timelines/components/timeline/translations';
 import { useMlCapabilities } from '../../../../common/components/ml_popover/hooks/use_ml_capabilities';
 import { useUiSetting$ } from '../../../../common/lib/kibana';
-import { setFieldValue } from '../../../pages/detection_engine/rules/helpers';
 import {
   filterRuleFieldsForType,
   RuleFields,
@@ -109,58 +108,46 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
   const mlCapabilities = useMlCapabilities();
   const [openTimelineSearch, setOpenTimelineSearch] = useState(false);
   const [indexModified, setIndexModified] = useState(false);
-  const [localRuleType, setLocalRuleType] = useState(
-    defaultValues?.ruleType || stepDefineDefaultValue.ruleType
-  );
   const [indicesConfig] = useUiSetting$<string[]>(DEFAULT_INDEX_KEY);
-  const [myStepData, setMyStepData] = useState<DefineStepRule>({
+  const initialState = defaultValues ?? {
     ...stepDefineDefaultValue,
     index: indicesConfig ?? [],
-  });
+  };
+  const [localRuleType, setLocalRuleType] = useState(initialState.ruleType);
+  const [myStepData, setMyStepData] = useState<DefineStepRule>(initialState);
   const [
     { browserFields, indexPatterns: indexPatternQueryBar, isLoading: indexPatternLoadingQueryBar },
   ] = useFetchIndexPatterns(myStepData.index);
 
   const { form } = useForm({
-    defaultValue: myStepData,
+    defaultValue: initialState,
     options: { stripEmptyFields: false },
     schema,
   });
-  const clearErrors = useCallback(() => form.reset({ resetValues: false }), [form]);
+  const { getFields, reset, submit } = form;
+  const clearErrors = useCallback(() => reset({ resetValues: false }), [reset]);
 
   const onSubmit = useCallback(async () => {
     if (setStepData) {
       setStepData(RuleStep.defineRule, null, false);
-      const { isValid, data } = await form.submit();
+      const { isValid, data } = await submit();
       if (isValid && setStepData) {
         setStepData(RuleStep.defineRule, data, isValid);
         setMyStepData({ ...data, isNew: false } as DefineStepRule);
       }
     }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [form]);
-
-  useEffect(() => {
-    const { isNew, ...values } = myStepData;
-    if (defaultValues != null && !deepEqual(values, defaultValues)) {
-      const newValues = { ...values, ...defaultValues, isNew: false };
-      setMyStepData(newValues);
-      setFieldValue(form, schema, newValues);
-    }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [defaultValues, setMyStepData, setFieldValue]);
+  }, [setStepData, submit]);
 
   useEffect(() => {
-    if (setForm != null) {
+    if (setForm) {
       setForm(RuleStep.defineRule, form);
     }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [form]);
+  }, [form, setForm]);
 
   const handleResetIndices = useCallback(() => {
-    const indexField = form.getFields().index;
+    const indexField = getFields().index;
     indexField.setValue(indicesConfig);
-  }, [form, indicesConfig]);
+  }, [getFields, indicesConfig]);
 
   const handleOpenTimelineSearch = useCallback(() => {
     setOpenTimelineSearch(true);
@@ -281,11 +268,11 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
                 fields={{
                   thresholdField: {
                     path: 'threshold.field',
-                    defaultValue: defaultValues?.threshold?.field,
+                    defaultValue: initialState.threshold.field,
                   },
                   thresholdValue: {
                     path: 'threshold.value',
-                    defaultValue: defaultValues?.threshold?.value,
+                    defaultValue: initialState.threshold.value,
                   },
                 }}
               >
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/step_rule_actions/index.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/step_rule_actions/index.tsx
index 7005bfb25f4a6..7bf151adde5cc 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/step_rule_actions/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/step_rule_actions/index.tsx
@@ -14,9 +14,7 @@ import {
 } from '@elastic/eui';
 import { findIndex } from 'lodash/fp';
 import React, { FC, memo, useCallback, useEffect, useMemo, useState } from 'react';
-import deepEqual from 'fast-deep-equal';
 
-import { setFieldValue } from '../../../pages/detection_engine/rules/helpers';
 import {
   RuleStep,
   RuleStepProps,
@@ -71,7 +69,8 @@ const StepRuleActionsComponent: FC<StepRuleActionsProps> = ({
   setForm,
   actionMessageParams,
 }) => {
-  const [myStepData, setMyStepData] = useState<ActionsStepRule>(stepActionsDefaultValue);
+  const initialState = defaultValues ?? stepActionsDefaultValue;
+  const [myStepData, setMyStepData] = useState<ActionsStepRule>(initialState);
   const {
     services: {
       application,
@@ -81,10 +80,11 @@ const StepRuleActionsComponent: FC<StepRuleActionsProps> = ({
   const schema = useMemo(() => getSchema({ actionTypeRegistry }), [actionTypeRegistry]);
 
   const { form } = useForm({
-    defaultValue: myStepData,
+    defaultValue: initialState,
     options: { stripEmptyFields: false },
     schema,
   });
+  const { submit } = form;
 
   // TO DO need to make sure that logic is still valid
   const kibanaAbsoluteUrl = useMemo(() => {
@@ -101,36 +101,21 @@ const StepRuleActionsComponent: FC<StepRuleActionsProps> = ({
     async (enabled: boolean) => {
       if (setStepData) {
         setStepData(RuleStep.ruleActions, null, false);
-        const { isValid: newIsValid, data } = await form.submit();
+        const { isValid: newIsValid, data } = await submit();
         if (newIsValid) {
           setStepData(RuleStep.ruleActions, { ...data, enabled }, newIsValid);
           setMyStepData({ ...data, isNew: false } as ActionsStepRule);
         }
       }
     },
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-    [form]
+    [setStepData, submit]
   );
 
   useEffect(() => {
-    const { isNew, ...initDefaultValue } = myStepData;
-    if (defaultValues != null && !deepEqual(initDefaultValue, defaultValues)) {
-      const myDefaultValues = {
-        ...defaultValues,
-        isNew: false,
-      };
-      setMyStepData(myDefaultValues);
-      setFieldValue(form, schema, myDefaultValues);
-    }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [defaultValues]);
-
-  useEffect(() => {
-    if (setForm != null) {
+    if (setForm) {
       setForm(RuleStep.ruleActions, form);
     }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [form]);
+  }, [form, setForm]);
 
   const updateThrottle = useCallback((throttle) => setMyStepData({ ...myStepData, throttle }), [
     myStepData,
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/step_schedule_rule/index.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/step_schedule_rule/index.tsx
index fa0f4dbd3668c..52f04f8423bec 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/step_schedule_rule/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/step_schedule_rule/index.tsx
@@ -5,9 +5,7 @@
  */
 
 import React, { FC, memo, useCallback, useEffect, useState } from 'react';
-import deepEqual from 'fast-deep-equal';
 
-import { setFieldValue } from '../../../pages/detection_engine/rules/helpers';
 import {
   RuleStep,
   RuleStepProps,
@@ -40,45 +38,32 @@ const StepScheduleRuleComponent: FC<StepScheduleRuleProps> = ({
   setStepData,
   setForm,
 }) => {
-  const [myStepData, setMyStepData] = useState<ScheduleStepRule>(stepScheduleDefaultValue);
+  const initialState = defaultValues ?? stepScheduleDefaultValue;
+  const [myStepData, setMyStepData] = useState<ScheduleStepRule>(initialState);
 
   const { form } = useForm({
-    defaultValue: myStepData,
+    defaultValue: initialState,
     options: { stripEmptyFields: false },
     schema,
   });
+  const { submit } = form;
 
   const onSubmit = useCallback(async () => {
     if (setStepData) {
       setStepData(RuleStep.scheduleRule, null, false);
-      const { isValid: newIsValid, data } = await form.submit();
+      const { isValid: newIsValid, data } = await submit();
       if (newIsValid) {
         setStepData(RuleStep.scheduleRule, { ...data }, newIsValid);
         setMyStepData({ ...data, isNew: false } as ScheduleStepRule);
       }
     }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [form]);
+  }, [setStepData, submit]);
 
   useEffect(() => {
-    const { isNew, ...initDefaultValue } = myStepData;
-    if (defaultValues != null && !deepEqual(initDefaultValue, defaultValues)) {
-      const myDefaultValues = {
-        ...defaultValues,
-        isNew: false,
-      };
-      setMyStepData(myDefaultValues);
-      setFieldValue(form, schema, myDefaultValues);
-    }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [defaultValues]);
-
-  useEffect(() => {
-    if (setForm != null) {
+    if (setForm) {
       setForm(RuleStep.scheduleRule, form);
     }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [form]);
+  }, [form, setForm]);
 
   return isReadOnlyView && myStepData != null ? (
     <StepContentWrapper addPadding={addPadding}>
diff --git a/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/form.test.tsx b/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/form.test.tsx
index ce5d19259e9ee..e2e793b34eaf9 100644
--- a/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/form.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/form.test.tsx
@@ -7,7 +7,6 @@ import React, { FormEvent } from 'react';
 import { mount, ReactWrapper } from 'enzyme';
 import { act } from 'react-dom/test-utils';
 
-import { waitForUpdates } from '../../../common/utils/test_utils';
 import { TestProviders } from '../../../common/mock';
 import { ValueListsForm } from './form';
 import { useImportList } from '../../../shared_imports';
@@ -30,10 +29,6 @@ const mockSelectFile: <P>(container: ReactWrapper<P>, file: File) => Promise<voi
       fileChange(([file] as unknown) as FormEvent);
     }
   });
-  await waitForUpdates(container);
-  expect(
-    container.find('button[data-test-subj="value-lists-form-import-action"]').prop('disabled')
-  ).not.toEqual(true);
 };
 
 describe('ValueListsForm', () => {
@@ -68,7 +63,6 @@ describe('ValueListsForm', () => {
     await mockSelectFile(container, mockFile);
 
     container.find('button[data-test-subj="value-lists-form-import-action"]').simulate('click');
-    await waitForUpdates(container);
 
     expect(mockImportList).toHaveBeenCalledWith(expect.objectContaining({ file: mockFile }));
   });
@@ -80,12 +74,11 @@ describe('ValueListsForm', () => {
     }));
 
     const onError = jest.fn();
-    const container = mount(
+    mount(
       <TestProviders>
         <ValueListsForm onError={onError} onSuccess={jest.fn()} />
       </TestProviders>
     );
-    await waitForUpdates(container);
 
     expect(onError).toHaveBeenCalledWith('whoops');
   });
@@ -97,12 +90,11 @@ describe('ValueListsForm', () => {
     }));
 
     const onSuccess = jest.fn();
-    const container = mount(
+    mount(
       <TestProviders>
         <ValueListsForm onSuccess={onSuccess} onError={jest.fn()} />
       </TestProviders>
     );
-    await waitForUpdates(container);
 
     expect(onSuccess).toHaveBeenCalledWith({ mockResult: true });
   });
diff --git a/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/modal.test.tsx b/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/modal.test.tsx
index ab2bc9b2e90e1..175882de551cb 100644
--- a/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/modal.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/modal.test.tsx
@@ -9,10 +9,8 @@ import { mount } from 'enzyme';
 
 import { TestProviders } from '../../../common/mock';
 import { ValueListsModal } from './modal';
-import { waitForUpdates } from '../../../common/utils/test_utils';
 
-// TODO: These are occasionally timing out
-describe.skip('ValueListsModal', () => {
+describe('ValueListsModal', () => {
   it('renders nothing if showModal is false', () => {
     const container = mount(
       <TestProviders>
@@ -21,20 +19,21 @@ describe.skip('ValueListsModal', () => {
     );
 
     expect(container.find('EuiModal')).toHaveLength(0);
+    container.unmount();
   });
 
-  it('renders modal if showModal is true', async () => {
+  it('renders modal if showModal is true', () => {
     const container = mount(
       <TestProviders>
         <ValueListsModal showModal={true} onClose={jest.fn()} />
       </TestProviders>
     );
-    await waitForUpdates(container);
 
     expect(container.find('EuiModal')).toHaveLength(1);
+    container.unmount();
   });
 
-  it('calls onClose when modal is closed', async () => {
+  it('calls onClose when modal is closed', () => {
     const onClose = jest.fn();
     const container = mount(
       <TestProviders>
@@ -44,21 +43,19 @@ describe.skip('ValueListsModal', () => {
 
     container.find('button[data-test-subj="value-lists-modal-close-action"]').simulate('click');
 
-    await waitForUpdates(container);
-
     expect(onClose).toHaveBeenCalled();
+    container.unmount();
   });
 
-  it('renders ValueListsForm and ValueListsTable', async () => {
+  it('renders ValueListsForm and ValueListsTable', () => {
     const container = mount(
       <TestProviders>
         <ValueListsModal showModal={true} onClose={jest.fn()} />
       </TestProviders>
     );
 
-    await waitForUpdates(container);
-
     expect(container.find('ValueListsForm')).toHaveLength(1);
     expect(container.find('ValueListsTable')).toHaveLength(1);
+    container.unmount();
   });
 });
diff --git a/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/modal.tsx b/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/modal.tsx
index 0a935a9cdb1c4..d7d4be6d951b8 100644
--- a/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/modal.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/modal.tsx
@@ -23,7 +23,8 @@ import {
   useDeleteList,
   useCursor,
 } from '../../../shared_imports';
-import { useToasts, useKibana } from '../../../common/lib/kibana';
+import { useKibana } from '../../../common/lib/kibana';
+import { useAppToasts } from '../../../common/hooks/use_app_toasts';
 import { GenericDownloader } from '../../../common/components/generic_downloader';
 import * as i18n from './translations';
 import { ValueListsTable } from './table';
@@ -45,7 +46,7 @@ export const ValueListsModalComponent: React.FC<ValueListsModalProps> = ({
   const { start: findLists, ...lists } = useFindLists();
   const { start: deleteList, result: deleteResult } = useDeleteList();
   const [exportListId, setExportListId] = useState<string>();
-  const toasts = useToasts();
+  const { addError, addSuccess } = useAppToasts();
 
   const fetchLists = useCallback(() => {
     findLists({ cursor, http, pageIndex: pageIndex + 1, pageSize });
@@ -82,21 +83,21 @@ export const ValueListsModalComponent: React.FC<ValueListsModalProps> = ({
   const handleUploadError = useCallback(
     (error: Error) => {
       if (error.name !== 'AbortError') {
-        toasts.addError(error, { title: i18n.UPLOAD_ERROR });
+        addError(error, { title: i18n.UPLOAD_ERROR });
       }
     },
-    [toasts]
+    [addError]
   );
   const handleUploadSuccess = useCallback(
     (response: ListSchema) => {
-      toasts.addSuccess({
+      addSuccess({
         text: i18n.uploadSuccessMessage(response.name),
         title: i18n.UPLOAD_SUCCESS_TITLE,
       });
       fetchLists();
     },
     // eslint-disable-next-line react-hooks/exhaustive-deps
-    [toasts]
+    [addSuccess]
   );
 
   useEffect(() => {
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_signal_index.tsx b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_signal_index.tsx
index 65a2721013b5e..14fd9ffa50843 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_signal_index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_signal_index.tsx
@@ -9,7 +9,7 @@ import { useEffect, useState } from 'react';
 import { errorToToaster, useStateToaster } from '../../../../common/components/toasters';
 import { createSignalIndex, getSignalIndex } from './api';
 import * as i18n from './translations';
-import { isApiError } from '../../../../common/utils/api';
+import { isSecurityAppError } from '../../../../common/utils/api';
 
 type Func = () => void;
 
@@ -59,7 +59,7 @@ export const useSignalIndex = (): ReturnSignalIndex => {
             signalIndexName: null,
             createDeSignalIndex: createIndex,
           });
-          if (isApiError(error) && error.body.status_code !== 404) {
+          if (isSecurityAppError(error) && error.body.status_code !== 404) {
             errorToToaster({ title: i18n.SIGNAL_GET_NAME_FAILURE, error, dispatchToaster });
           }
         }
@@ -81,7 +81,7 @@ export const useSignalIndex = (): ReturnSignalIndex => {
         }
       } catch (error) {
         if (isSubscribed) {
-          if (isApiError(error) && error.body.status_code === 409) {
+          if (isSecurityAppError(error) && error.body.status_code === 409) {
             fetchData();
           } else {
             setSignalIndex({
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/lists/use_lists_config.tsx b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/lists/use_lists_config.tsx
index e21cbceeaef27..71847e7b7d8cb 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/lists/use_lists_config.tsx
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/lists/use_lists_config.tsx
@@ -19,16 +19,16 @@ export interface UseListsConfigReturn {
 }
 
 export const useListsConfig = (): UseListsConfigReturn => {
-  const { createIndex, createIndexError, indexExists, loading: indexLoading } = useListsIndex();
+  const { createIndex, indexExists, loading: indexLoading, error: indexError } = useListsIndex();
   const { canManageIndex, canWriteIndex, loading: privilegesLoading } = useListsPrivileges();
   const { lists } = useKibana().services;
 
   const enabled = lists != null;
   const loading = indexLoading || privilegesLoading;
   const needsIndex = indexExists === false;
-  const indexCreationFailed = createIndexError != null;
+  const hasIndexError = indexError != null;
   const needsIndexConfiguration =
-    needsIndex && (canManageIndex === false || (canManageIndex === true && indexCreationFailed));
+    needsIndex && (canManageIndex === false || (canManageIndex === true && hasIndexError));
   const needsConfiguration = !enabled || canWriteIndex === false || needsIndexConfiguration;
 
   useEffect(() => {
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/lists/use_lists_index.tsx b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/lists/use_lists_index.tsx
index 75f12bd07d3ae..ee1316eb8a1fd 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/lists/use_lists_index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/lists/use_lists_index.tsx
@@ -7,28 +7,24 @@
 import { useEffect, useState, useCallback } from 'react';
 
 import { useReadListIndex, useCreateListIndex } from '../../../../shared_imports';
-import { useHttp, useToasts, useKibana } from '../../../../common/lib/kibana';
-import { isApiError } from '../../../../common/utils/api';
+import { useHttp, useKibana } from '../../../../common/lib/kibana';
+import { isSecurityAppError } from '../../../../common/utils/api';
 import * as i18n from './translations';
+import { useAppToasts } from '../../../../common/hooks/use_app_toasts';
 
-export interface UseListsIndexState {
+export interface UseListsIndexReturn {
+  createIndex: () => void;
   indexExists: boolean | null;
-}
-
-export interface UseListsIndexReturn extends UseListsIndexState {
+  error: unknown;
   loading: boolean;
-  createIndex: () => void;
-  createIndexError: unknown;
-  createIndexResult: { acknowledged: boolean } | undefined;
 }
 
 export const useListsIndex = (): UseListsIndexReturn => {
-  const [state, setState] = useState<UseListsIndexState>({
-    indexExists: null,
-  });
+  const [indexExists, setIndexExists] = useState<boolean | null>(null);
+  const [error, setError] = useState<unknown>(null);
   const { lists } = useKibana().services;
   const http = useHttp();
-  const toasts = useToasts();
+  const { addError } = useAppToasts();
   const { loading: readLoading, start: readListIndex, ...readListIndexState } = useReadListIndex();
   const {
     loading: createLoading,
@@ -51,18 +47,17 @@ export const useListsIndex = (): UseListsIndexReturn => {
 
   // initial read list
   useEffect(() => {
-    if (!readLoading && state.indexExists === null) {
+    if (!readLoading && !error && indexExists === null) {
       readIndex();
     }
-  }, [readIndex, readLoading, state.indexExists]);
+  }, [error, indexExists, readIndex, readLoading]);
 
   // handle read result
   useEffect(() => {
     if (readListIndexState.result != null) {
-      setState({
-        indexExists:
-          readListIndexState.result.list_index && readListIndexState.result.list_item_index,
-      });
+      setIndexExists(
+        readListIndexState.result.list_index && readListIndexState.result.list_item_index
+      );
     }
   }, [readListIndexState.result]);
 
@@ -75,34 +70,30 @@ export const useListsIndex = (): UseListsIndexReturn => {
 
   // handle read error
   useEffect(() => {
-    const error = readListIndexState.error;
-    if (isApiError(error)) {
-      setState({ indexExists: false });
-      if (error.body.status_code !== 404) {
-        toasts.addError(error, {
-          title: i18n.LISTS_INDEX_FETCH_FAILURE,
-          toastMessage: error.body.message,
-        });
+    const err = readListIndexState.error;
+    if (err != null) {
+      if (isSecurityAppError(err) && err.body.status_code === 404) {
+        setIndexExists(false);
+      } else {
+        setError(err);
+        addError(err, { title: i18n.LISTS_INDEX_FETCH_FAILURE });
       }
     }
-  }, [readListIndexState.error, toasts]);
+  }, [addError, readListIndexState.error]);
 
   // handle create error
   useEffect(() => {
-    const error = createListIndexState.error;
-    if (isApiError(error)) {
-      toasts.addError(error, {
-        title: i18n.LISTS_INDEX_CREATE_FAILURE,
-        toastMessage: error.body.message,
-      });
+    const err = createListIndexState.error;
+    if (err != null) {
+      setError(err);
+      addError(err, { title: i18n.LISTS_INDEX_CREATE_FAILURE });
     }
-  }, [createListIndexState.error, toasts]);
+  }, [addError, createListIndexState.error]);
 
   return {
-    loading,
     createIndex,
-    createIndexError: createListIndexState.error,
-    createIndexResult: createListIndexState.result,
-    ...state,
+    error,
+    indexExists,
+    loading,
   };
 };
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/lists/use_lists_privileges.tsx b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/lists/use_lists_privileges.tsx
index fbbcff33402c3..f99f62b1948e6 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/lists/use_lists_privileges.tsx
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/lists/use_lists_privileges.tsx
@@ -7,8 +7,8 @@
 import { useEffect, useState, useCallback } from 'react';
 
 import { useReadListPrivileges } from '../../../../shared_imports';
-import { useHttp, useToasts, useKibana } from '../../../../common/lib/kibana';
-import { isApiError } from '../../../../common/utils/api';
+import { useHttp, useKibana } from '../../../../common/lib/kibana';
+import { useAppToasts } from '../../../../common/hooks/use_app_toasts';
 import * as i18n from './translations';
 
 export interface UseListsPrivilegesState {
@@ -79,8 +79,8 @@ export const useListsPrivileges = (): UseListsPrivilegesReturn => {
   });
   const { lists } = useKibana().services;
   const http = useHttp();
-  const toasts = useToasts();
-  const { loading, start: readListPrivileges, ...privilegesState } = useReadListPrivileges();
+  const { addError } = useAppToasts();
+  const { loading, start: readListPrivileges, ...readState } = useReadListPrivileges();
 
   const readPrivileges = useCallback(() => {
     if (lists) {
@@ -90,20 +90,20 @@ export const useListsPrivileges = (): UseListsPrivilegesReturn => {
 
   // initRead
   useEffect(() => {
-    if (!loading && state.isAuthenticated === null) {
+    if (!loading && !readState.error && state.isAuthenticated === null) {
       readPrivileges();
     }
-  }, [loading, readPrivileges, state.isAuthenticated]);
+  }, [loading, readState.error, readPrivileges, state.isAuthenticated]);
 
   // handleReadResult
   useEffect(() => {
-    if (privilegesState.result != null) {
+    if (readState.result != null) {
       try {
         const {
           is_authenticated: isAuthenticated,
           lists: { index: listsPrivileges },
           listItems: { index: listItemsPrivileges },
-        } = privilegesState.result as ListPrivileges;
+        } = readState.result as ListPrivileges;
 
         setState({
           isAuthenticated,
@@ -114,19 +114,18 @@ export const useListsPrivileges = (): UseListsPrivilegesReturn => {
         setState({ isAuthenticated: null, canManageIndex: false, canWriteIndex: false });
       }
     }
-  }, [privilegesState.result]);
+  }, [readState.result]);
 
   // handleReadError
   useEffect(() => {
-    const error = privilegesState.error;
-    if (isApiError(error)) {
-      setState({ isAuthenticated: null, canManageIndex: false, canWriteIndex: false });
-      toasts.addError(error, {
+    const error = readState.error;
+    if (error != null) {
+      setState({ isAuthenticated: false, canManageIndex: false, canWriteIndex: false });
+      addError(error, {
         title: i18n.LISTS_PRIVILEGES_READ_FAILURE,
-        toastMessage: error.body.message,
       });
     }
-  }, [privilegesState.error, toasts]);
+  }, [addError, readState.error]);
 
   return { loading, ...state };
 };
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/fetch_index_patterns.tsx b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/fetch_index_patterns.tsx
index ab12f045cddbc..9a2f43bb475b1 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/fetch_index_patterns.tsx
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/fetch_index_patterns.tsx
@@ -12,7 +12,7 @@ import { IIndexPattern } from '../../../../../../../../src/plugins/data/public';
 import {
   BrowserFields,
   getBrowserFields,
-  getdocValueFields,
+  getDocValueFields,
   getIndexFields,
   sourceQuery,
   DocValueFields,
@@ -89,7 +89,7 @@ export const useFetchIndexPatterns = (defaultIndices: string[] = []): Return =>
                     indices.join(),
                     get('data.source.status.indexFields', result)
                   ),
-                  docValueFields: getdocValueFields(
+                  docValueFields: getDocValueFields(
                     indices.join(),
                     get('data.source.status.indexFields', result)
                   ),
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_no_signal_index.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_no_signal_index.tsx
index 59267b5d62a26..32ae585aec191 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_no_signal_index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_no_signal_index.tsx
@@ -16,7 +16,7 @@ export const DetectionEngineNoIndex = React.memo(() => {
     <EmptyPage
       actionPrimaryIcon="documents"
       actionPrimaryLabel={i18n.GO_TO_DOCUMENTATION}
-      actionPrimaryUrl={`${docLinks.ELASTIC_WEBSITE_URL}guide/en/siem/guide/${docLinks.DOC_LINK_VERSION}/detection-engine-overview.html#detections-permissions`}
+      actionPrimaryUrl={`${docLinks.ELASTIC_WEBSITE_URL}guide/en/security/${docLinks.DOC_LINK_VERSION}/detection-engine-overview.html#detections-permissions`}
       actionPrimaryTarget="_blank"
       message={i18n.NO_INDEX_MSG_BODY}
       data-test-subj="no_index"
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_user_unauthenticated.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_user_unauthenticated.tsx
index a353be80c7239..6123e3740e306 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_user_unauthenticated.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_user_unauthenticated.tsx
@@ -17,7 +17,7 @@ export const DetectionEngineUserUnauthenticated = React.memo(() => {
     <EmptyPage
       actionPrimaryIcon="documents"
       actionPrimaryLabel={i18n.GO_TO_DOCUMENTATION}
-      actionPrimaryUrl={`${docLinks.ELASTIC_WEBSITE_URL}guide/en/security/guide/${docLinks.DOC_LINK_VERSION}/detection-engine-overview.html#detections-permissions`}
+      actionPrimaryUrl={`${docLinks.ELASTIC_WEBSITE_URL}guide/en/security/${docLinks.DOC_LINK_VERSION}/detection-engine-overview.html#detections-permissions`}
       actionPrimaryTarget="_blank"
       message={i18n.USER_UNAUTHENTICATED_MSG_BODY}
       data-test-subj="no_index"
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/helpers.ts b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/helpers.ts
index 226fa5313e34f..38f7836f678f9 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/helpers.ts
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/helpers.ts
@@ -12,6 +12,7 @@ import { NOTIFICATION_THROTTLE_NO_ACTIONS } from '../../../../../../common/const
 import { transformAlertToRuleAction } from '../../../../../../common/detection_engine/transform_actions';
 import { RuleType } from '../../../../../../common/detection_engine/types';
 import { isMlRule } from '../../../../../../common/machine_learning/helpers';
+import { ENDPOINT_LIST_ID } from '../../../../../shared_imports';
 import { NewRule } from '../../../../containers/detection_engine/rules';
 
 import {
@@ -167,7 +168,7 @@ export const formatAboutStepData = (aboutStepData: AboutStepRule): AboutStepRule
     ...(isAssociatedToEndpointList
       ? {
           exceptions_list: [
-            { id: 'endpoint_list', namespace_type: 'agnostic', type: 'endpoint' },
+            { id: ENDPOINT_LIST_ID, namespace_type: 'agnostic', type: 'endpoint' },
           ] as AboutStepRuleJson['exceptions_list'],
         }
       : {}),
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/index.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/index.tsx
index f6e13786e98d0..6ba65ceca8fe9 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/index.tsx
@@ -109,10 +109,10 @@ const CreateRulePageComponent: React.FC = () => {
     [RuleStep.ruleActions]: null,
   });
   const stepsData = useRef<Record<RuleStep, RuleStepData>>({
-    [RuleStep.defineRule]: { isValid: false, data: {} },
-    [RuleStep.aboutRule]: { isValid: false, data: {} },
-    [RuleStep.scheduleRule]: { isValid: false, data: {} },
-    [RuleStep.ruleActions]: { isValid: false, data: {} },
+    [RuleStep.defineRule]: { isValid: false, data: undefined },
+    [RuleStep.aboutRule]: { isValid: false, data: undefined },
+    [RuleStep.scheduleRule]: { isValid: false, data: undefined },
+    [RuleStep.ruleActions]: { isValid: false, data: undefined },
   });
   const [isStepRuleInReadOnlyView, setIsStepRuleInEditView] = useState<Record<RuleStep, boolean>>({
     [RuleStep.defineRule]: false,
@@ -123,7 +123,7 @@ const CreateRulePageComponent: React.FC = () => {
   const [{ isLoading, isSaved }, setRule] = usePersistRule();
   const actionMessageParams = useMemo(
     () =>
-      getActionMessageParams((stepsData.current['define-rule'].data as DefineStepRule).ruleType),
+      getActionMessageParams((stepsData.current['define-rule'].data as DefineStepRule)?.ruleType),
     // eslint-disable-next-line react-hooks/exhaustive-deps
     [stepsData.current['define-rule'].data]
   );
@@ -335,9 +335,7 @@ const CreateRulePageComponent: React.FC = () => {
             <EuiHorizontalRule margin="m" />
             <StepDefineRule
               addPadding={true}
-              defaultValues={
-                (stepsData.current[RuleStep.defineRule].data as DefineStepRule) ?? null
-              }
+              defaultValues={stepsData.current[RuleStep.defineRule].data as DefineStepRule}
               isReadOnlyView={isStepRuleInReadOnlyView[RuleStep.defineRule]}
               isLoading={isLoading || loading}
               setForm={setStepsForm}
@@ -370,10 +368,8 @@ const CreateRulePageComponent: React.FC = () => {
             <EuiHorizontalRule margin="m" />
             <StepAboutRule
               addPadding={true}
-              defaultValues={(stepsData.current[RuleStep.aboutRule].data as AboutStepRule) ?? null}
-              defineRuleData={
-                (stepsData.current[RuleStep.defineRule].data as DefineStepRule) ?? null
-              }
+              defaultValues={stepsData.current[RuleStep.aboutRule].data as AboutStepRule}
+              defineRuleData={stepsData.current[RuleStep.defineRule].data as DefineStepRule}
               descriptionColumns="singleSplit"
               isReadOnlyView={isStepRuleInReadOnlyView[RuleStep.aboutRule]}
               isLoading={isLoading || loading}
@@ -406,9 +402,7 @@ const CreateRulePageComponent: React.FC = () => {
             <EuiHorizontalRule margin="m" />
             <StepScheduleRule
               addPadding={true}
-              defaultValues={
-                (stepsData.current[RuleStep.scheduleRule].data as ScheduleStepRule) ?? null
-              }
+              defaultValues={stepsData.current[RuleStep.scheduleRule].data as ScheduleStepRule}
               descriptionColumns="singleSplit"
               isReadOnlyView={isStepRuleInReadOnlyView[RuleStep.scheduleRule]}
               isLoading={isLoading || loading}
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx
index 7eb5c3a535377..484c28b4b428c 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx
@@ -37,7 +37,7 @@ import {
 } from '../../../../../common/components/link_to/redirect_to_detection_engine';
 import { SiemSearchBar } from '../../../../../common/components/search_bar';
 import { WrapperPage } from '../../../../../common/components/wrapper_page';
-import { useRule } from '../../../../containers/detection_engine/rules';
+import { useRule, Rule } from '../../../../containers/detection_engine/rules';
 import { useListsConfig } from '../../../../containers/detection_engine/lists/use_lists_config';
 
 import { useWithSource } from '../../../../../common/containers/source';
@@ -90,6 +90,8 @@ import {
   MIN_EVENTS_VIEWER_BODY_HEIGHT,
 } from '../../../../../timelines/components/timeline/body/helpers';
 import { footerHeight } from '../../../../../timelines/components/timeline/footer';
+import { isMlRule } from '../../../../../../common/machine_learning/helpers';
+import { isThresholdRule } from '../../../../../../common/detection_engine/utils';
 
 enum RuleDetailTabs {
   alerts = 'alerts',
@@ -97,23 +99,26 @@ enum RuleDetailTabs {
   exceptions = 'exceptions',
 }
 
-const ruleDetailTabs = [
-  {
-    id: RuleDetailTabs.alerts,
-    name: detectionI18n.ALERT,
-    disabled: false,
-  },
-  {
-    id: RuleDetailTabs.exceptions,
-    name: i18n.EXCEPTIONS_TAB,
-    disabled: false,
-  },
-  {
-    id: RuleDetailTabs.failures,
-    name: i18n.FAILURE_HISTORY_TAB,
-    disabled: false,
-  },
-];
+const getRuleDetailsTabs = (rule: Rule | null) => {
+  const canUseExceptions = rule && !isMlRule(rule.type) && !isThresholdRule(rule.type);
+  return [
+    {
+      id: RuleDetailTabs.alerts,
+      name: detectionI18n.ALERT,
+      disabled: false,
+    },
+    {
+      id: RuleDetailTabs.exceptions,
+      name: i18n.EXCEPTIONS_TAB,
+      disabled: !canUseExceptions,
+    },
+    {
+      id: RuleDetailTabs.failures,
+      name: i18n.FAILURE_HISTORY_TAB,
+      disabled: false,
+    },
+  ];
+};
 
 export const RuleDetailsPageComponent: FC<PropsFromRedux> = ({
   filters,
@@ -160,6 +165,7 @@ export const RuleDetailsPageComponent: FC<PropsFromRedux> = ({
   // TODO: Refactor license check + hasMlAdminPermissions to common check
   const hasMlPermissions =
     mlCapabilities.isPlatinumOrTrialLicense && hasMlAdminPermissions(mlCapabilities);
+  const ruleDetailTabs = getRuleDetailsTabs(rule);
 
   const title = isLoading === true || rule === null ? <EuiLoadingSpinner size="m" /> : rule.name;
   const subTitle = useMemo(
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/helpers.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/helpers.tsx
index 5df711ea7cd8e..11b779e71b9b2 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/helpers.tsx
@@ -5,7 +5,6 @@
  */
 
 import dateMath from '@elastic/datemath';
-import { get } from 'lodash/fp';
 import moment from 'moment';
 import memoizeOne from 'memoize-one';
 import { useLocation } from 'react-router-dom';
@@ -14,8 +13,8 @@ import { RuleAlertAction, RuleType } from '../../../../../common/detection_engin
 import { isMlRule } from '../../../../../common/machine_learning/helpers';
 import { transformRuleToAlertAction } from '../../../../../common/detection_engine/transform_actions';
 import { Filter } from '../../../../../../../../src/plugins/data/public';
+import { ENDPOINT_LIST_ID } from '../../../../shared_imports';
 import { Rule } from '../../../containers/detection_engine/rules';
-import { FormData, FormHook, FormSchema } from '../../../../shared_imports';
 import {
   AboutStepRule,
   AboutStepRuleDetails,
@@ -139,7 +138,7 @@ export const getAboutStepsData = (rule: Rule, detailsView: boolean): AboutStepRu
   return {
     isNew: false,
     author,
-    isAssociatedToEndpointList: exceptionsList?.some(({ id }) => id === 'endpoint_list') ?? false,
+    isAssociatedToEndpointList: exceptionsList?.some(({ id }) => id === ENDPOINT_LIST_ID) ?? false,
     isBuildingBlock: buildingBlockType !== undefined,
     license: license ?? '',
     ruleNameOverride: ruleNameOverride ?? '',
@@ -273,17 +272,6 @@ export const getPrePackagedTimelineStatus = (
   }
   return 'unknown';
 };
-export const setFieldValue = (
-  form: FormHook<FormData>,
-  schema: FormSchema<FormData>,
-  defaultValues: unknown
-) =>
-  Object.keys(schema).forEach((key) => {
-    const val = get(key, defaultValues);
-    if (val != null) {
-      form.setFieldValue(key, val);
-    }
-  });
 
 export const redirectToDetections = (
   isSignalIndexExists: boolean | null,
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/translations.ts b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/translations.ts
index bfe5dfc012530..92dc02ac8478c 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/translations.ts
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/translations.ts
@@ -29,7 +29,7 @@ export const SIGNAL = i18n.translate('xpack.securitySolution.detectionEngine.sig
 });
 
 export const ALERT = i18n.translate('xpack.securitySolution.detectionEngine.alertTitle', {
-  defaultMessage: 'External alerts',
+  defaultMessage: 'Detection alerts',
 });
 
 export const BUTTON_MANAGE_RULES = i18n.translate(
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/reducer.ts b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/reducer.ts
index b3b74c2ca9dae..e7aa2c8893f8e 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/reducer.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/reducer.ts
@@ -21,6 +21,7 @@ export const initialPolicyDetailsState: () => Immutable<PolicyDetailsState> = ()
     offline: 0,
     online: 0,
     total: 0,
+    other: 0,
   },
 });
 
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/index.test.ts b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/index.test.ts
index 0a24c9eea71eb..8203aae244f24 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/index.test.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/index.test.ts
@@ -152,6 +152,7 @@ describe('policy list store concerns', () => {
         offline: 0,
         online: 0,
         total: 0,
+        other: 0,
       },
     });
   });
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/reducer.ts b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/reducer.ts
index 52bed8d850ef4..53954449ab9c3 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/reducer.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/reducer.ts
@@ -31,6 +31,7 @@ export const initialPolicyListState: () => Immutable<PolicyListState> = () => ({
     offline: 0,
     online: 0,
     total: 0,
+    other: 0,
   },
 });
 
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/agents_summary.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/agents_summary.tsx
index fca3408b79c54..921493e239c0f 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/agents_summary.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/agents_summary.tsx
@@ -73,7 +73,7 @@ export const AgentsSummary = memo<AgentsSummaryProps>((props) => {
   }, []);
 
   return (
-    <EuiFlexGroup gutterSize="xl" data-test-subj="policyAgentsSummary">
+    <EuiFlexGroup gutterSize="xl" responsive={false} data-test-subj="policyAgentsSummary">
       {stats.map(({ key, title, health }) => {
         return (
           <EuiFlexItem grow={false} key={key}>
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_details.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_details.tsx
index 8fbc167670b41..9576e1aedcaf1 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_details.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_details.tsx
@@ -16,6 +16,7 @@ import {
   EuiConfirmModal,
   EuiCallOut,
   EuiLoadingSpinner,
+  EuiHideFor,
 } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { i18n } from '@kbn/i18n';
@@ -182,9 +183,11 @@ export const PolicyDetails = React.memo(() => {
           error={policyAgentStatusSummary?.error ?? 0}
         />
       </EuiFlexItem>
-      <EuiFlexItem>
-        <VerticalDivider spacing="l" />
-      </EuiFlexItem>
+      <EuiHideFor sizes={['xs', 's']}>
+        <EuiFlexItem>
+          <VerticalDivider spacing="l" />
+        </EuiFlexItem>
+      </EuiHideFor>
       <EuiFlexItem grow={false}>
         <EuiButtonEmpty onClick={handleCancelOnClick} data-test-subj="policyDetailsCancelButton">
           <FormattedMessage
diff --git a/x-pack/plugins/security_solution/public/network/components/embeddables/__snapshots__/embedded_map.test.tsx.snap b/x-pack/plugins/security_solution/public/network/components/embeddables/__snapshots__/embedded_map.test.tsx.snap
index d5de7ab508a73..456e07cf9cd15 100644
--- a/x-pack/plugins/security_solution/public/network/components/embeddables/__snapshots__/embedded_map.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/network/components/embeddables/__snapshots__/embedded_map.test.tsx.snap
@@ -9,7 +9,7 @@ exports[`EmbeddedMapComponent renders correctly against snapshot 1`] = `
       size="xs"
     >
       <EuiLink
-        href="https://www.elastic.co/guide/en/siem/guide/mocked-test-branch/conf-map-ui.html"
+        href="https://www.elastic.co/guide/en/security/mocked-test-branch/conf-map-ui.html"
         target="_blank"
       >
         Map configuration help
diff --git a/x-pack/plugins/security_solution/public/network/components/embeddables/embedded_map.tsx b/x-pack/plugins/security_solution/public/network/components/embeddables/embedded_map.tsx
index 828e4d3eaaaa0..4d96c213818aa 100644
--- a/x-pack/plugins/security_solution/public/network/components/embeddables/embedded_map.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/embeddables/embedded_map.tsx
@@ -185,7 +185,7 @@ export const EmbeddedMapComponent = ({
       <EmbeddableHeader title={i18n.EMBEDDABLE_HEADER_TITLE}>
         <EuiText size="xs">
           <EuiLink
-            href={`${services.docLinks.ELASTIC_WEBSITE_URL}guide/en/siem/guide/${services.docLinks.DOC_LINK_VERSION}/conf-map-ui.html`}
+            href={`${services.docLinks.ELASTIC_WEBSITE_URL}guide/en/security/${services.docLinks.DOC_LINK_VERSION}/conf-map-ui.html`}
             target="_blank"
           >
             {i18n.EMBEDDABLE_HEADER_HELP}
diff --git a/x-pack/plugins/security_solution/public/overview/components/signals_by_category/index.tsx b/x-pack/plugins/security_solution/public/overview/components/signals_by_category/index.tsx
index fbfdefa13d738..0ac136044c06d 100644
--- a/x-pack/plugins/security_solution/public/overview/components/signals_by_category/index.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/signals_by_category/index.tsx
@@ -17,7 +17,6 @@ import { UpdateDateRange } from '../../../common/components/charts/common';
 import { GlobalTimeArgs } from '../../../common/containers/use_global_time';
 
 const DEFAULT_QUERY: Query = { query: '', language: 'kuery' };
-const DEFAULT_STACK_BY = 'signal.rule.threat.tactic.name';
 const NO_FILTERS: Filter[] = [];
 
 interface Props extends Pick<GlobalTimeArgs, 'from' | 'to' | 'deleteQuery' | 'setQuery'> {
@@ -62,13 +61,9 @@ const SignalsByCategoryComponent: React.FC<Props> = ({
     [setAbsoluteRangeDatePicker]
   );
 
-  const defaultStackByOption =
-    alertsHistogramOptions.find((o) => o.text === DEFAULT_STACK_BY) ?? alertsHistogramOptions[0];
-
   return (
     <AlertsHistogramPanel
       deleteQuery={deleteQuery}
-      defaultStackByOption={defaultStackByOption}
       filters={filters}
       from={from}
       headerChildren={headerChildren}
diff --git a/x-pack/plugins/security_solution/public/overview/pages/overview.test.tsx b/x-pack/plugins/security_solution/public/overview/pages/overview.test.tsx
index f7c77bc2dfdf8..286cc870378e1 100644
--- a/x-pack/plugins/security_solution/public/overview/pages/overview.test.tsx
+++ b/x-pack/plugins/security_solution/public/overview/pages/overview.test.tsx
@@ -9,7 +9,6 @@ import React from 'react';
 import { MemoryRouter } from 'react-router-dom';
 
 import '../../common/mock/match_media';
-import { waitForUpdates } from '../../common/utils/test_utils';
 import { TestProviders } from '../../common/mock';
 import { useWithSource } from '../../common/containers/source';
 import {
@@ -65,7 +64,7 @@ describe('Overview', () => {
         mockuseMessagesStorage.mockImplementation(() => endpointNoticeMessage(false));
       });
 
-      it('renders the Setup Instructions text', async () => {
+      it('renders the Setup Instructions text', () => {
         const wrapper = mount(
           <TestProviders>
             <MemoryRouter>
@@ -73,11 +72,10 @@ describe('Overview', () => {
             </MemoryRouter>
           </TestProviders>
         );
-        await waitForUpdates(wrapper);
         expect(wrapper.find('[data-test-subj="empty-page"]').exists()).toBe(true);
       });
 
-      it('does not show Endpoint get ready button when ingest is not enabled', async () => {
+      it('does not show Endpoint get ready button when ingest is not enabled', () => {
         const wrapper = mount(
           <TestProviders>
             <MemoryRouter>
@@ -85,11 +83,10 @@ describe('Overview', () => {
             </MemoryRouter>
           </TestProviders>
         );
-        await waitForUpdates(wrapper);
         expect(wrapper.find('[data-test-subj="empty-page-secondary-action"]').exists()).toBe(false);
       });
 
-      it('shows Endpoint get ready button when ingest is enabled', async () => {
+      it('shows Endpoint get ready button when ingest is enabled', () => {
         (useIngestEnabledCheck as jest.Mock).mockReturnValue({ allEnabled: true });
         const wrapper = mount(
           <TestProviders>
@@ -98,12 +95,11 @@ describe('Overview', () => {
             </MemoryRouter>
           </TestProviders>
         );
-        await waitForUpdates(wrapper);
         expect(wrapper.find('[data-test-subj="empty-page-secondary-action"]').exists()).toBe(true);
       });
     });
 
-    it('it DOES NOT render the Getting started text when an index is available', async () => {
+    it('it DOES NOT render the Getting started text when an index is available', () => {
       (useWithSource as jest.Mock).mockReturnValue({
         indicesExist: true,
         indexPattern: {},
@@ -120,12 +116,12 @@ describe('Overview', () => {
           </MemoryRouter>
         </TestProviders>
       );
-      await waitForUpdates(wrapper);
 
       expect(wrapper.find('[data-test-subj="empty-page"]').exists()).toBe(false);
+      wrapper.unmount();
     });
 
-    test('it DOES render the Endpoint banner when the endpoint index is NOT available AND storage is NOT set', async () => {
+    test('it DOES render the Endpoint banner when the endpoint index is NOT available AND storage is NOT set', () => {
       (useWithSource as jest.Mock).mockReturnValueOnce({
         indicesExist: true,
         indexPattern: {},
@@ -147,12 +143,12 @@ describe('Overview', () => {
           </MemoryRouter>
         </TestProviders>
       );
-      await waitForUpdates(wrapper);
 
       expect(wrapper.find('[data-test-subj="endpoint-prompt-banner"]').exists()).toBe(true);
+      wrapper.unmount();
     });
 
-    test('it does NOT render the Endpoint banner when the endpoint index is NOT available but storage is set', async () => {
+    test('it does NOT render the Endpoint banner when the endpoint index is NOT available but storage is set', () => {
       (useWithSource as jest.Mock).mockReturnValueOnce({
         indicesExist: true,
         indexPattern: {},
@@ -174,12 +170,12 @@ describe('Overview', () => {
           </MemoryRouter>
         </TestProviders>
       );
-      await waitForUpdates(wrapper);
 
       expect(wrapper.find('[data-test-subj="endpoint-prompt-banner"]').exists()).toBe(false);
+      wrapper.unmount();
     });
 
-    test('it does NOT render the Endpoint banner when the endpoint index is available AND storage is set', async () => {
+    test('it does NOT render the Endpoint banner when the endpoint index is available AND storage is set', () => {
       (useWithSource as jest.Mock).mockReturnValue({
         indicesExist: true,
         indexPattern: {},
@@ -196,12 +192,12 @@ describe('Overview', () => {
           </MemoryRouter>
         </TestProviders>
       );
-      await waitForUpdates(wrapper);
 
       expect(wrapper.find('[data-test-subj="endpoint-prompt-banner"]').exists()).toBe(false);
+      wrapper.unmount();
     });
 
-    test('it does NOT render the Endpoint banner when an index IS available but storage is NOT set', async () => {
+    test('it does NOT render the Endpoint banner when an index IS available but storage is NOT set', () => {
       (useWithSource as jest.Mock).mockReturnValue({
         indicesExist: true,
         indexPattern: {},
@@ -219,9 +215,10 @@ describe('Overview', () => {
         </TestProviders>
       );
       expect(wrapper.find('[data-test-subj="endpoint-prompt-banner"]').exists()).toBe(false);
+      wrapper.unmount();
     });
 
-    test('it does NOT render the Endpoint banner when Ingest is NOT available', async () => {
+    test('it does NOT render the Endpoint banner when Ingest is NOT available', () => {
       (useWithSource as jest.Mock).mockReturnValue({
         indicesExist: true,
         indexPattern: {},
@@ -238,9 +235,9 @@ describe('Overview', () => {
           </MemoryRouter>
         </TestProviders>
       );
-      await waitForUpdates(wrapper);
 
       expect(wrapper.find('[data-test-subj="endpoint-prompt-banner"]').exists()).toBe(false);
+      wrapper.unmount();
     });
   });
 });
diff --git a/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/__snapshots__/isometric_taxi_layout.test.ts.snap b/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/__snapshots__/isometric_taxi_layout.test.ts.snap
index 74efb41c4c595..6f26bfe063c05 100644
--- a/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/__snapshots__/isometric_taxi_layout.test.ts.snap
+++ b/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/__snapshots__/isometric_taxi_layout.test.ts.snap
@@ -2,6 +2,7 @@
 
 exports[`resolver graph layout when rendering no nodes renders right 1`] = `
 Object {
+  "ariaLevels": Map {},
   "edgeLineSegments": Array [],
   "processNodePositions": Map {},
 }
@@ -9,6 +10,22 @@ Object {
 
 exports[`resolver graph layout when rendering one node renders right 1`] = `
 Object {
+  "ariaLevels": Map {
+    Object {
+      "@timestamp": 1582233383000,
+      "agent": Object {
+        "id": "",
+        "type": "",
+        "version": "",
+      },
+      "endgame": Object {
+        "event_subtype_full": "creation_event",
+        "event_type_full": "process_event",
+        "process_name": "",
+        "unique_pid": 0,
+      },
+    } => 1,
+  },
   "edgeLineSegments": Array [],
   "processNodePositions": Map {
     Object {
@@ -34,6 +51,134 @@ Object {
 
 exports[`resolver graph layout when rendering two forks, and one fork has an extra long tine renders right 1`] = `
 Object {
+  "ariaLevels": Map {
+    Object {
+      "@timestamp": 1582233383000,
+      "agent": Object {
+        "id": "",
+        "type": "",
+        "version": "",
+      },
+      "endgame": Object {
+        "event_subtype_full": "creation_event",
+        "event_type_full": "process_event",
+        "process_name": "",
+        "unique_pid": 0,
+      },
+    } => 1,
+    Object {
+      "@timestamp": 1582233383000,
+      "agent": Object {
+        "id": "",
+        "type": "",
+        "version": "",
+      },
+      "endgame": Object {
+        "event_subtype_full": "already_running",
+        "event_type_full": "process_event",
+        "unique_pid": 1,
+        "unique_ppid": 0,
+      },
+    } => 2,
+    Object {
+      "@timestamp": 1582233383000,
+      "agent": Object {
+        "id": "",
+        "type": "",
+        "version": "",
+      },
+      "endgame": Object {
+        "event_subtype_full": "creation_event",
+        "event_type_full": "process_event",
+        "unique_pid": 2,
+        "unique_ppid": 0,
+      },
+    } => 2,
+    Object {
+      "@timestamp": 1582233383000,
+      "agent": Object {
+        "id": "",
+        "type": "",
+        "version": "",
+      },
+      "endgame": Object {
+        "event_subtype_full": "termination_event",
+        "event_type_full": "process_event",
+        "unique_pid": 8,
+        "unique_ppid": 0,
+      },
+    } => 2,
+    Object {
+      "@timestamp": 1582233383000,
+      "agent": Object {
+        "id": "",
+        "type": "",
+        "version": "",
+      },
+      "endgame": Object {
+        "event_subtype_full": "creation_event",
+        "event_type_full": "process_event",
+        "unique_pid": 3,
+        "unique_ppid": 1,
+      },
+    } => 3,
+    Object {
+      "@timestamp": 1582233383000,
+      "agent": Object {
+        "id": "",
+        "type": "",
+        "version": "",
+      },
+      "endgame": Object {
+        "event_subtype_full": "creation_event",
+        "event_type_full": "process_event",
+        "unique_pid": 4,
+        "unique_ppid": 1,
+      },
+    } => 3,
+    Object {
+      "@timestamp": 1582233383000,
+      "agent": Object {
+        "id": "",
+        "type": "",
+        "version": "",
+      },
+      "endgame": Object {
+        "event_subtype_full": "creation_event",
+        "event_type_full": "process_event",
+        "unique_pid": 5,
+        "unique_ppid": 2,
+      },
+    } => 3,
+    Object {
+      "@timestamp": 1582233383000,
+      "agent": Object {
+        "id": "",
+        "type": "",
+        "version": "",
+      },
+      "endgame": Object {
+        "event_subtype_full": "creation_event",
+        "event_type_full": "process_event",
+        "unique_pid": 6,
+        "unique_ppid": 2,
+      },
+    } => 3,
+    Object {
+      "@timestamp": 1582233383000,
+      "agent": Object {
+        "id": "",
+        "type": "",
+        "version": "",
+      },
+      "endgame": Object {
+        "event_subtype_full": "creation_event",
+        "event_type_full": "process_event",
+        "unique_pid": 7,
+        "unique_ppid": 6,
+      },
+    } => 4,
+  },
   "edgeLineSegments": Array [
     Object {
       "metadata": Object {
@@ -406,6 +551,36 @@ Object {
 
 exports[`resolver graph layout when rendering two nodes, one being the parent of the other renders right 1`] = `
 Object {
+  "ariaLevels": Map {
+    Object {
+      "@timestamp": 1582233383000,
+      "agent": Object {
+        "id": "",
+        "type": "",
+        "version": "",
+      },
+      "endgame": Object {
+        "event_subtype_full": "creation_event",
+        "event_type_full": "process_event",
+        "process_name": "",
+        "unique_pid": 0,
+      },
+    } => 1,
+    Object {
+      "@timestamp": 1582233383000,
+      "agent": Object {
+        "id": "",
+        "type": "",
+        "version": "",
+      },
+      "endgame": Object {
+        "event_subtype_full": "already_running",
+        "event_type_full": "process_event",
+        "unique_pid": 1,
+        "unique_ppid": 0,
+      },
+    } => 2,
+  },
   "edgeLineSegments": Array [
     Object {
       "metadata": Object {
diff --git a/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/index.ts b/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/index.ts
index b322de0f34526..35a32d91d8a02 100644
--- a/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/index.ts
+++ b/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/index.ts
@@ -4,99 +4,46 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { uniquePidForProcess, uniqueParentPidForProcess } from '../process_event';
-import { IndexedProcessTree, AdjacentProcessMap } from '../../types';
+import { uniquePidForProcess, uniqueParentPidForProcess, orderByTime } from '../process_event';
+import { IndexedProcessTree } from '../../types';
 import { ResolverEvent } from '../../../../common/endpoint/types';
 import { levelOrder as baseLevelOrder } from '../../lib/tree_sequencers';
 
 /**
- * Create a new IndexedProcessTree from an array of ProcessEvents
+ * Create a new IndexedProcessTree from an array of ProcessEvents.
+ * siblings will be ordered by timestamp
  */
-export function factory(processes: ResolverEvent[]): IndexedProcessTree {
+export function factory(
+  // Array of processes to index as a tree
+  processes: ResolverEvent[]
+): IndexedProcessTree {
   const idToChildren = new Map<string | undefined, ResolverEvent[]>();
   const idToValue = new Map<string, ResolverEvent>();
-  const idToAdjacent = new Map<string, AdjacentProcessMap>();
-
-  function emptyAdjacencyMap(id: string): AdjacentProcessMap {
-    return {
-      self: id,
-      parent: null,
-      firstChild: null,
-      previousSibling: null,
-      nextSibling: null,
-      level: 1,
-    };
-  }
-
-  const roots: ResolverEvent[] = [];
 
   for (const process of processes) {
     const uniqueProcessPid = uniquePidForProcess(process);
     idToValue.set(uniqueProcessPid, process);
 
-    const currentProcessAdjacencyMap: AdjacentProcessMap =
-      idToAdjacent.get(uniqueProcessPid) || emptyAdjacencyMap(uniqueProcessPid);
-    idToAdjacent.set(uniqueProcessPid, currentProcessAdjacencyMap);
-
     const uniqueParentPid = uniqueParentPidForProcess(process);
-    const currentProcessSiblings = idToChildren.get(uniqueParentPid);
-
-    if (currentProcessSiblings) {
-      const previousProcessId = uniquePidForProcess(
-        currentProcessSiblings[currentProcessSiblings.length - 1]
-      );
-      currentProcessSiblings.push(process);
-      /**
-       * Update adjacency maps for current and previous entries
-       */
-      idToAdjacent.get(previousProcessId)!.nextSibling = uniqueProcessPid;
-      currentProcessAdjacencyMap.previousSibling = previousProcessId;
-      if (uniqueParentPid) {
-        currentProcessAdjacencyMap.parent = uniqueParentPid;
+    // if its defined and not ''
+    if (uniqueParentPid) {
+      let siblings = idToChildren.get(uniqueParentPid);
+      if (!siblings) {
+        siblings = [];
+        idToChildren.set(uniqueParentPid, siblings);
       }
-    } else {
-      if (uniqueParentPid) {
-        idToChildren.set(uniqueParentPid, [process]);
-        /**
-         * Get the parent's map, otherwise set an empty one
-         */
-        const parentAdjacencyMap =
-          idToAdjacent.get(uniqueParentPid) ||
-          (idToAdjacent.set(uniqueParentPid, emptyAdjacencyMap(uniqueParentPid)),
-          idToAdjacent.get(uniqueParentPid))!;
-        // set firstChild for parent
-        parentAdjacencyMap.firstChild = uniqueProcessPid;
-        // set parent for current
-        currentProcessAdjacencyMap.parent = uniqueParentPid || null;
-      } else {
-        // In this case (no unique parent id), it must be a root
-        roots.push(process);
-      }
-    }
-  }
-
-  /**
-   * Scan adjacency maps from the top down and assign levels
-   */
-  function traverseLevels(currentProcessMap: AdjacentProcessMap, level: number = 1): void {
-    const nextLevel = level + 1;
-    if (currentProcessMap.nextSibling) {
-      traverseLevels(idToAdjacent.get(currentProcessMap.nextSibling)!, level);
-    }
-    if (currentProcessMap.firstChild) {
-      traverseLevels(idToAdjacent.get(currentProcessMap.firstChild)!, nextLevel);
+      siblings.push(process);
     }
-    currentProcessMap.level = level;
   }
 
-  for (const treeRoot of roots) {
-    traverseLevels(idToAdjacent.get(uniquePidForProcess(treeRoot))!);
+  // sort the children of each node
+  for (const siblings of idToChildren.values()) {
+    siblings.sort(orderByTime);
   }
 
   return {
     idToChildren,
     idToProcess: idToValue,
-    idToAdjacent,
   };
 }
 
@@ -109,6 +56,13 @@ export function children(tree: IndexedProcessTree, process: ResolverEvent): Reso
   return currentProcessSiblings === undefined ? [] : currentProcessSiblings;
 }
 
+/**
+ * Get the indexed process event for the ID
+ */
+export function processEvent(tree: IndexedProcessTree, entityID: string): ResolverEvent | null {
+  return tree.idToProcess.get(entityID) ?? null;
+}
+
 /**
  * Returns the parent ProcessEvent, if any, for the passed in `childProcess`
  */
@@ -124,6 +78,31 @@ export function parent(
   }
 }
 
+/**
+ * Returns the following sibling
+ */
+export function nextSibling(
+  tree: IndexedProcessTree,
+  sibling: ResolverEvent
+): ResolverEvent | undefined {
+  const parentNode = parent(tree, sibling);
+  if (parentNode) {
+    // The siblings of `sibling` are the children of its parent.
+    const siblings = children(tree, parentNode);
+
+    // Find the sibling
+    const index = siblings.indexOf(sibling);
+
+    // if the sibling wasn't found, or if it was the last element in the array, return undefined
+    if (index === -1 || index === siblings.length - 1) {
+      return undefined;
+    }
+
+    // return the next sibling
+    return siblings[index + 1];
+  }
+}
+
 /**
  * Number of processes in the tree
  */
@@ -138,7 +117,10 @@ export function root(tree: IndexedProcessTree) {
   if (size(tree) === 0) {
     return null;
   }
+  // any node will do
   let current: ResolverEvent = tree.idToProcess.values().next().value;
+
+  // iteratively swap current w/ its parent
   while (parent(tree, current) !== undefined) {
     current = parent(tree, current)!;
   }
diff --git a/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/isometric_taxi_layout.test.ts b/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/isometric_taxi_layout.test.ts
index 72d8e878465f7..bd534dcb989e3 100644
--- a/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/isometric_taxi_layout.test.ts
+++ b/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/isometric_taxi_layout.test.ts
@@ -148,5 +148,24 @@ describe('resolver graph layout', () => {
     it('renders right', () => {
       expect(layout()).toMatchSnapshot();
     });
+    it('should have node a at level 1', () => {
+      expect(layout().ariaLevels.get(processA)).toBe(1);
+    });
+    it('should have nodes b and c at level 2', () => {
+      expect(layout().ariaLevels.get(processB)).toBe(2);
+      expect(layout().ariaLevels.get(processC)).toBe(2);
+    });
+    it('should have nodes d, e, f, and g at level 3', () => {
+      expect(layout().ariaLevels.get(processD)).toBe(3);
+      expect(layout().ariaLevels.get(processE)).toBe(3);
+      expect(layout().ariaLevels.get(processF)).toBe(3);
+      expect(layout().ariaLevels.get(processG)).toBe(3);
+    });
+    it('should have node h at level 4', () => {
+      expect(layout().ariaLevels.get(processH)).toBe(4);
+    });
+    it('should have 9 items in the map of aria levels', () => {
+      expect(layout().ariaLevels.size).toBe(9);
+    });
   });
 });
diff --git a/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/isometric_taxi_layout.ts b/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/isometric_taxi_layout.ts
index 61363ffa05d94..6058a40037ad2 100644
--- a/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/isometric_taxi_layout.ts
+++ b/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/isometric_taxi_layout.ts
@@ -73,9 +73,34 @@ export function isometricTaxiLayout(indexedProcessTree: IndexedProcessTree): Iso
   return {
     processNodePositions: transformedPositions,
     edgeLineSegments: transformedEdgeLineSegments,
+    ariaLevels: ariaLevels(indexedProcessTree),
   };
 }
 
+/**
+ * Calculate a level (starting at 1) for each node.
+ */
+function ariaLevels(indexedProcessTree: IndexedProcessTree): Map<ResolverEvent, number> {
+  const map: Map<ResolverEvent, number> = new Map();
+  for (const node of model.levelOrder(indexedProcessTree)) {
+    const parentNode = model.parent(indexedProcessTree, node);
+    if (parentNode === undefined) {
+      // nodes at the root have a level of 1
+      map.set(node, 1);
+    } else {
+      const parentLevel: number | undefined = map.get(parentNode);
+
+      // because we're iterating in level order, we should have processed the parent of any node that has one.
+      if (parentLevel === undefined) {
+        throw new Error('failed to calculate aria levels');
+      }
+
+      map.set(node, parentLevel + 1);
+    }
+  }
+  return map;
+}
+
 /**
  * In laying out the graph, we precalculate the 'width' of each subtree. The 'width' of the subtree is determined by its
  * descedants and the rule that each process node must be at least 1 unit apart. Enforcing that all nodes are at least
diff --git a/x-pack/plugins/security_solution/public/resolver/models/process_event.test.ts b/x-pack/plugins/security_solution/public/resolver/models/process_event.test.ts
index 04a3f9ccff772..7eb692851bc9b 100644
--- a/x-pack/plugins/security_solution/public/resolver/models/process_event.test.ts
+++ b/x-pack/plugins/security_solution/public/resolver/models/process_event.test.ts
@@ -3,10 +3,10 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import { eventType } from './process_event';
+import { eventType, orderByTime } from './process_event';
 
 import { mockProcessEvent } from './process_event_test_helpers';
-import { LegacyEndpointEvent } from '../../../common/endpoint/types';
+import { LegacyEndpointEvent, ResolverEvent } from '../../../common/endpoint/types';
 
 describe('process event', () => {
   describe('eventType', () => {
@@ -24,4 +24,86 @@ describe('process event', () => {
       expect(eventType(event)).toEqual('processCreated');
     });
   });
+  describe('orderByTime', () => {
+    let mock: (time: number, eventID: string) => ResolverEvent;
+    let events: ResolverEvent[];
+    beforeEach(() => {
+      mock = (time, eventID) => {
+        return {
+          '@timestamp': time,
+          event: {
+            id: eventID,
+          },
+        } as ResolverEvent;
+      };
+      // 2 events each for numbers -1, 0, 1, and NaN
+      // each event has a unique id, a through h
+      // order is arbitrary
+      events = [
+        mock(-1, 'a'),
+        mock(0, 'c'),
+        mock(1, 'e'),
+        mock(NaN, 'g'),
+        mock(-1, 'b'),
+        mock(0, 'd'),
+        mock(1, 'f'),
+        mock(NaN, 'h'),
+      ];
+    });
+    it('sorts events as expected', () => {
+      events.sort(orderByTime);
+      expect(events).toMatchInlineSnapshot(`
+        Array [
+          Object {
+            "@timestamp": -1,
+            "event": Object {
+              "id": "a",
+            },
+          },
+          Object {
+            "@timestamp": -1,
+            "event": Object {
+              "id": "b",
+            },
+          },
+          Object {
+            "@timestamp": 0,
+            "event": Object {
+              "id": "c",
+            },
+          },
+          Object {
+            "@timestamp": 0,
+            "event": Object {
+              "id": "d",
+            },
+          },
+          Object {
+            "@timestamp": 1,
+            "event": Object {
+              "id": "e",
+            },
+          },
+          Object {
+            "@timestamp": 1,
+            "event": Object {
+              "id": "f",
+            },
+          },
+          Object {
+            "@timestamp": NaN,
+            "event": Object {
+              "id": "g",
+            },
+          },
+          Object {
+            "@timestamp": NaN,
+            "event": Object {
+              "id": "h",
+            },
+          },
+        ]
+      `);
+    });
+  });
 });
diff --git a/x-pack/plugins/security_solution/public/resolver/models/process_event.ts b/x-pack/plugins/security_solution/public/resolver/models/process_event.ts
index 0286cca93b43f..4f8df87b3ac0b 100644
--- a/x-pack/plugins/security_solution/public/resolver/models/process_event.ts
+++ b/x-pack/plugins/security_solution/public/resolver/models/process_event.ts
@@ -28,6 +28,19 @@ export function isTerminatedProcess(passedEvent: ResolverEvent) {
   return eventType(passedEvent) === 'processTerminated';
 }
 
+/**
+ * ms since unix epoc, based on timestamp.
+ * may return NaN if the timestamp wasn't present or was invalid.
+ */
+export function datetime(passedEvent: ResolverEvent): number | null {
+  const timestamp = event.eventTimestamp(passedEvent);
+
+  const time = timestamp === undefined ? 0 : new Date(timestamp).getTime();
+
+  // if the date could not be parsed, return null
+  return isNaN(time) ? null : time;
+}
+
 /**
  * Returns a custom event type for a process event based on the event's metadata.
  */
@@ -161,3 +174,22 @@ export function argsForProcess(passedEvent: ResolverEvent): string | undefined {
   }
   return passedEvent?.process?.args;
 }
+
+/**
+ * used to sort events
+ */
+export function orderByTime(first: ResolverEvent, second: ResolverEvent): number {
+  const firstDatetime: number | null = datetime(first);
+  const secondDatetime: number | null = datetime(second);
+
+  if (firstDatetime === secondDatetime) {
+    // break ties using an arbitrary (stable) comparison of `eventId` (which should be unique)
+    return String(event.eventId(first)).localeCompare(String(event.eventId(second)));
+  } else if (firstDatetime === null || secondDatetime === null) {
+    // sort `null`'s as higher than numbers
+    return (firstDatetime === null ? 1 : 0) - (secondDatetime === null ? 1 : 0);
+  } else {
+    // sort in ascending order.
+    return firstDatetime - secondDatetime;
+  }
+}
diff --git a/x-pack/plugins/security_solution/public/resolver/store/data/selectors.ts b/x-pack/plugins/security_solution/public/resolver/store/data/selectors.ts
index 475546cfc3966..dc17fc70ef8af 100644
--- a/x-pack/plugins/security_solution/public/resolver/store/data/selectors.ts
+++ b/x-pack/plugins/security_solution/public/resolver/store/data/selectors.ts
@@ -8,7 +8,6 @@ import rbush from 'rbush';
 import { createSelector, defaultMemoize } from 'reselect';
 import {
   DataState,
-  AdjacentProcessMap,
   Vector2,
   IndexedEntity,
   IndexedEdgeLineSegment,
@@ -21,7 +20,7 @@ import {
   isTerminatedProcess,
   uniquePidForProcess,
 } from '../../models/process_event';
-import { factory as indexedProcessTreeFactory } from '../../models/indexed_process_tree';
+import * as indexedProcessTreeModel from '../../models/indexed_process_tree';
 import { isEqual } from '../../models/aabb';
 
 import {
@@ -107,7 +106,7 @@ export const indexedProcessTree = createSelector(graphableProcesses, function in
   graphableProcesses
   /* eslint-enable no-shadow */
 ) {
-  return indexedProcessTreeFactory(graphableProcesses);
+  return indexedProcessTreeModel.factory(graphableProcesses);
 });
 
 /**
@@ -170,27 +169,6 @@ export function relatedEventsReady(data: DataState): Map<string, boolean> {
   return data.relatedEventsReady;
 }
 
-export const processAdjacencies = createSelector(
-  indexedProcessTree,
-  graphableProcesses,
-  function selectProcessAdjacencies(
-    /* eslint-disable no-shadow */
-    indexedProcessTree,
-    graphableProcesses
-    /* eslint-enable no-shadow */
-  ) {
-    const processToAdjacencyMap = new Map<ResolverEvent, AdjacentProcessMap>();
-    const { idToAdjacent } = indexedProcessTree;
-
-    for (const graphableProcess of graphableProcesses) {
-      const processPid = uniquePidForProcess(graphableProcess);
-      const adjacencyMap = idToAdjacent.get(processPid)!;
-      processToAdjacencyMap.set(graphableProcess, adjacencyMap);
-    }
-    return { processToAdjacencyMap };
-  }
-);
-
 /**
  * `true` if there were more children than we got in the last request.
  */
@@ -230,7 +208,7 @@ export const relatedEventInfoByEntityId: (
   ) {
     if (!relatedEventsStats) {
       // If there are no related event stats, there are no related event info objects
-      return (entityId: string) => null;
+      return () => null;
     }
     return (entityId) => {
       const stats = relatedEventsStats.get(entityId);
@@ -334,7 +312,8 @@ export function databaseDocumentIDToFetch(state: DataState): string | null {
     return null;
   }
 }
-export const processNodePositionsAndEdgeLineSegments = createSelector(
+
+export const layout = createSelector(
   indexedProcessTree,
   function processNodePositionsAndEdgeLineSegments(
     /* eslint-disable no-shadow */
@@ -345,9 +324,62 @@ export const processNodePositionsAndEdgeLineSegments = createSelector(
   }
 );
 
-const indexedProcessNodePositionsAndEdgeLineSegments = createSelector(
-  processNodePositionsAndEdgeLineSegments,
-  function visibleProcessNodePositionsAndEdgeLineSegments({
+/**
+ * Given a nodeID (aka entity_id) get the indexed process event.
+ * Legacy functions take process events instead of nodeID, use this to get
+ * process events for them.
+ */
+export const processEventForID: (
+  state: DataState
+) => (nodeID: string) => ResolverEvent | null = createSelector(
+  indexedProcessTree,
+  (tree) => (nodeID: string) => indexedProcessTreeModel.processEvent(tree, nodeID)
+);
+
+/**
+ * Takes a nodeID (aka entity_id) and returns the associated aria level as a number or null if the node ID isn't in the tree.
+ */
+export const ariaLevel: (state: DataState) => (nodeID: string) => number | null = createSelector(
+  layout,
+  processEventForID,
+  ({ ariaLevels }, processEventGetter) => (nodeID: string) => {
+    const node = processEventGetter(nodeID);
+    return node ? ariaLevels.get(node) ?? null : null;
+  }
+);
+
+/**
+ * Returns the following sibling if there is one, or `null`.
+ */
+export const followingSibling: (
+  state: DataState
+) => (nodeID: string) => string | null = createSelector(
+  indexedProcessTree,
+  processEventForID,
+  (tree, eventGetter) => {
+    return (nodeID: string) => {
+      const event = eventGetter(nodeID);
+
+      // event not found
+      if (event === null) {
+        return null;
+      }
+      const nextSibling = indexedProcessTreeModel.nextSibling(tree, event);
+
+      // next sibling not found
+      if (nextSibling === undefined) {
+        return null;
+      }
+
+      // return the node ID
+      return uniquePidForProcess(nextSibling);
+    };
+  }
+);
+
+const spatiallyIndexedLayout: (state: DataState) => rbush<IndexedEntity> = createSelector(
+  layout,
+  function ({
     /* eslint-disable no-shadow */
     processNodePositions,
     edgeLineSegments,
@@ -394,47 +426,46 @@ const indexedProcessNodePositionsAndEdgeLineSegments = createSelector(
   }
 );
 
-export const visibleProcessNodePositionsAndEdgeLineSegments = createSelector(
-  indexedProcessNodePositionsAndEdgeLineSegments,
-  function visibleProcessNodePositionsAndEdgeLineSegments(tree) {
-    // memoize the results of this call to avoid unnecessarily rerunning
-    let lastBoundingBox: AABB | null = null;
-    let currentlyVisible: VisibleEntites = {
-      processNodePositions: new Map<ResolverEvent, Vector2>(),
-      connectingEdgeLineSegments: [],
-    };
-    return (boundingBox: AABB) => {
-      if (lastBoundingBox !== null && isEqual(lastBoundingBox, boundingBox)) {
-        return currentlyVisible;
-      } else {
-        const {
-          minimum: [minX, minY],
-          maximum: [maxX, maxY],
-        } = boundingBox;
-        const entities = tree.search({
-          minX,
-          minY,
-          maxX,
-          maxY,
-        });
-        const visibleProcessNodePositions = new Map<ResolverEvent, Vector2>(
-          entities
-            .filter((entity): entity is IndexedProcessNode => entity.type === 'processNode')
-            .map((node) => [node.entity, node.position])
-        );
-        const connectingEdgeLineSegments = entities
-          .filter((entity): entity is IndexedEdgeLineSegment => entity.type === 'edgeLine')
-          .map((node) => node.entity);
-        currentlyVisible = {
-          processNodePositions: visibleProcessNodePositions,
-          connectingEdgeLineSegments,
-        };
-        lastBoundingBox = boundingBox;
-        return currentlyVisible;
-      }
-    };
-  }
-);
+export const nodesAndEdgelines: (
+  state: DataState
+) => (query: AABB) => VisibleEntites = createSelector(spatiallyIndexedLayout, function (tree) {
+  // memoize the results of this call to avoid unnecessarily rerunning
+  let lastBoundingBox: AABB | null = null;
+  let currentlyVisible: VisibleEntites = {
+    processNodePositions: new Map<ResolverEvent, Vector2>(),
+    connectingEdgeLineSegments: [],
+  };
+  return (boundingBox: AABB) => {
+    if (lastBoundingBox !== null && isEqual(lastBoundingBox, boundingBox)) {
+      return currentlyVisible;
+    } else {
+      const {
+        minimum: [minX, minY],
+        maximum: [maxX, maxY],
+      } = boundingBox;
+      const entities = tree.search({
+        minX,
+        minY,
+        maxX,
+        maxY,
+      });
+      const visibleProcessNodePositions = new Map<ResolverEvent, Vector2>(
+        entities
+          .filter((entity): entity is IndexedProcessNode => entity.type === 'processNode')
+          .map((node) => [node.entity, node.position])
+      );
+      const connectingEdgeLineSegments = entities
+        .filter((entity): entity is IndexedEdgeLineSegment => entity.type === 'edgeLine')
+        .map((node) => node.entity);
+      currentlyVisible = {
+        processNodePositions: visibleProcessNodePositions,
+        connectingEdgeLineSegments,
+      };
+      lastBoundingBox = boundingBox;
+      return currentlyVisible;
+    }
+  };
+});
 
 /**
  * If there is a pending request that's for a entity ID that doesn't matche the `entityID`, then we should cancel it.
diff --git a/x-pack/plugins/security_solution/public/resolver/store/data/visible_entities.test.ts b/x-pack/plugins/security_solution/public/resolver/store/data/visible_entities.test.ts
index eb2b402a694a5..e91c455c9445f 100644
--- a/x-pack/plugins/security_solution/public/resolver/store/data/visible_entities.test.ts
+++ b/x-pack/plugins/security_solution/public/resolver/store/data/visible_entities.test.ts
@@ -9,7 +9,7 @@ import { ResolverAction } from '../actions';
 import { resolverReducer } from '../reducer';
 import { ResolverState } from '../../types';
 import { LegacyEndpointEvent, ResolverEvent } from '../../../../common/endpoint/types';
-import { visibleProcessNodePositionsAndEdgeLineSegments } from '../selectors';
+import { visibleNodesAndEdgeLines } from '../selectors';
 import { mockProcessEvent } from '../../models/process_event_test_helpers';
 import { mock as mockResolverTree } from '../../models/resolver_tree';
 
@@ -119,15 +119,11 @@ describe('resolver visible entities', () => {
       store.dispatch(cameraAction);
     });
     it('the visibleProcessNodePositions list should only include 2 nodes', () => {
-      const { processNodePositions } = visibleProcessNodePositionsAndEdgeLineSegments(
-        store.getState()
-      )(0);
+      const { processNodePositions } = visibleNodesAndEdgeLines(store.getState())(0);
       expect([...processNodePositions.keys()].length).toEqual(2);
     });
     it('the visibleEdgeLineSegments list should only include one edge line', () => {
-      const { connectingEdgeLineSegments } = visibleProcessNodePositionsAndEdgeLineSegments(
-        store.getState()
-      )(0);
+      const { connectingEdgeLineSegments } = visibleNodesAndEdgeLines(store.getState())(0);
       expect(connectingEdgeLineSegments.length).toEqual(1);
     });
   });
@@ -151,15 +147,11 @@ describe('resolver visible entities', () => {
       store.dispatch(cameraAction);
     });
     it('the visibleProcessNodePositions list should include all process nodes', () => {
-      const { processNodePositions } = visibleProcessNodePositionsAndEdgeLineSegments(
-        store.getState()
-      )(0);
+      const { processNodePositions } = visibleNodesAndEdgeLines(store.getState())(0);
       expect([...processNodePositions.keys()].length).toEqual(5);
     });
     it('the visibleEdgeLineSegments list include all lines', () => {
-      const { connectingEdgeLineSegments } = visibleProcessNodePositionsAndEdgeLineSegments(
-        store.getState()
-      )(0);
+      const { connectingEdgeLineSegments } = visibleNodesAndEdgeLines(store.getState())(0);
       expect(connectingEdgeLineSegments.length).toEqual(4);
     });
   });
diff --git a/x-pack/plugins/security_solution/public/resolver/store/index.ts b/x-pack/plugins/security_solution/public/resolver/store/index.ts
index 9809e443d2d13..d9e750241ced1 100644
--- a/x-pack/plugins/security_solution/public/resolver/store/index.ts
+++ b/x-pack/plugins/security_solution/public/resolver/store/index.ts
@@ -16,10 +16,10 @@ import { ResolverAction } from './actions';
 export const storeFactory = (
   context?: KibanaReactContextValue<StartServices>
 ): Store<ResolverState, ResolverAction> => {
-  const actionsBlacklist: Array<ResolverAction['type']> = ['userMovedPointer'];
+  const actionsDenylist: Array<ResolverAction['type']> = ['userMovedPointer'];
   const composeEnhancers = composeWithDevTools({
     name: 'Resolver',
-    actionsBlacklist,
+    actionsBlacklist: actionsDenylist,
   });
   const middlewareEnhancer = applyMiddleware(resolverMiddlewareFactory(context));
 
diff --git a/x-pack/plugins/security_solution/public/resolver/store/methods.ts b/x-pack/plugins/security_solution/public/resolver/store/methods.ts
index 3890770259156..ad06ddf36161a 100644
--- a/x-pack/plugins/security_solution/public/resolver/store/methods.ts
+++ b/x-pack/plugins/security_solution/public/resolver/store/methods.ts
@@ -5,7 +5,7 @@
  */
 
 import { animatePanning } from './camera/methods';
-import { processNodePositionsAndEdgeLineSegments } from './selectors';
+import { layout } from './selectors';
 import { ResolverState } from '../types';
 import { ResolverEvent } from '../../../common/endpoint/types';
 
@@ -19,7 +19,7 @@ export function animateProcessIntoView(
   startTime: number,
   process: ResolverEvent
 ): ResolverState {
-  const { processNodePositions } = processNodePositionsAndEdgeLineSegments(state);
+  const { processNodePositions } = layout(state);
   const position = processNodePositions.get(process);
   if (position) {
     return {
diff --git a/x-pack/plugins/security_solution/public/resolver/store/selectors.test.ts b/x-pack/plugins/security_solution/public/resolver/store/selectors.test.ts
new file mode 100644
index 0000000000000..ba4a5a169c549
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/resolver/store/selectors.test.ts
@@ -0,0 +1,259 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { ResolverState } from '../types';
+import { createStore } from 'redux';
+import { ResolverAction } from './actions';
+import { resolverReducer } from './reducer';
+import * as selectors from './selectors';
+import { EndpointEvent, ResolverEvent, ResolverTree } from '../../../common/endpoint/types';
+
+describe('resolver selectors', () => {
+  const actions: ResolverAction[] = [];
+
+  /**
+   * Get state, given an ordered collection of actions.
+   */
+  const state: () => ResolverState = () => {
+    const store = createStore(resolverReducer);
+    for (const action of actions) {
+      store.dispatch(action);
+    }
+    return store.getState();
+  };
+  describe('ariaFlowtoNodeID', () => {
+    describe('with a tree with no descendants and 2 ancestors', () => {
+      const originID = 'c';
+      const firstAncestorID = 'b';
+      const secondAncestorID = 'a';
+      beforeEach(() => {
+        actions.push({
+          type: 'serverReturnedResolverData',
+          payload: {
+            result: treeWith2AncestorsAndNoChildren({
+              originID,
+              firstAncestorID,
+              secondAncestorID,
+            }),
+            // this value doesn't matter
+            databaseDocumentID: '',
+          },
+        });
+      });
+      describe('when all nodes are in view', () => {
+        beforeEach(() => {
+          const size = 1000000;
+          actions.push({
+            // set the size of the camera
+            type: 'userSetRasterSize',
+            payload: [size, size],
+          });
+        });
+        it('should return no flowto for the second ancestor', () => {
+          expect(selectors.ariaFlowtoNodeID(state())(0)(secondAncestorID)).toBe(null);
+        });
+        it('should return no flowto for the first ancestor', () => {
+          expect(selectors.ariaFlowtoNodeID(state())(0)(firstAncestorID)).toBe(null);
+        });
+        it('should return no flowto for the origin', () => {
+          expect(selectors.ariaFlowtoNodeID(state())(0)(originID)).toBe(null);
+        });
+      });
+    });
+    describe('with a tree with 2 children and no ancestors', () => {
+      const originID = 'c';
+      const firstChildID = 'd';
+      const secondChildID = 'e';
+      beforeEach(() => {
+        actions.push({
+          type: 'serverReturnedResolverData',
+          payload: {
+            result: treeWithNoAncestorsAnd2Children({ originID, firstChildID, secondChildID }),
+            // this value doesn't matter
+            databaseDocumentID: '',
+          },
+        });
+      });
+      describe('when all nodes are in view', () => {
+        beforeEach(() => {
+          const rasterSize = 1000000;
+          actions.push({
+            // set the size of the camera
+            type: 'userSetRasterSize',
+            payload: [rasterSize, rasterSize],
+          });
+        });
+        it('should return no flowto for the origin', () => {
+          expect(selectors.ariaFlowtoNodeID(state())(0)(originID)).toBe(null);
+        });
+        it('should return the second child as the flowto for the first child', () => {
+          expect(selectors.ariaFlowtoNodeID(state())(0)(firstChildID)).toBe(secondChildID);
+        });
+        it('should return no flowto for second child', () => {
+          expect(selectors.ariaFlowtoNodeID(state())(0)(secondChildID)).toBe(null);
+        });
+      });
+      describe('when only the origin and first child are in view', () => {
+        beforeEach(() => {
+          // set the raster size
+          const rasterSize = 1000000;
+          actions.push({
+            // set the size of the camera
+            type: 'userSetRasterSize',
+            payload: [rasterSize, rasterSize],
+          });
+
+          // get the layout
+          const layout = selectors.layout(state());
+
+          // find the position of the second child
+          const secondChild = selectors.processEventForID(state())(secondChildID);
+          const positionOfSecondChild = layout.processNodePositions.get(secondChild!)!;
+
+          // the child is indexed by an AABB that extends -720/2 to the left
+          const leftSideOfSecondChildAABB = positionOfSecondChild[0] - 720 / 2;
+
+          // adjust the camera so that it doesn't quite see the second child
+          actions.push({
+            // set the position of the camera so that the left edge of the second child is at the right edge
+            // of the viewable area
+            type: 'userSetPositionOfCamera',
+            payload: [rasterSize / -2 + leftSideOfSecondChildAABB, 0],
+          });
+        });
+        it('the origin should be in view', () => {
+          const origin = selectors.processEventForID(state())(originID)!;
+          expect(
+            selectors.visibleNodesAndEdgeLines(state())(0).processNodePositions.has(origin)
+          ).toBe(true);
+        });
+        it('the first child should be in view', () => {
+          const firstChild = selectors.processEventForID(state())(firstChildID)!;
+          expect(
+            selectors.visibleNodesAndEdgeLines(state())(0).processNodePositions.has(firstChild)
+          ).toBe(true);
+        });
+        it('the second child should not be in view', () => {
+          const secondChild = selectors.processEventForID(state())(secondChildID)!;
+          expect(
+            selectors.visibleNodesAndEdgeLines(state())(0).processNodePositions.has(secondChild)
+          ).toBe(false);
+        });
+        it('should return nothing as the flowto for the first child', () => {
+          expect(selectors.ariaFlowtoNodeID(state())(0)(firstChildID)).toBe(null);
+        });
+      });
+    });
+  });
+});
+/**
+ * Simple mock endpoint event that works for tree layouts.
+ */
+function mockEndpointEvent({
+  entityID,
+  name,
+  parentEntityId,
+  timestamp,
+}: {
+  entityID: string;
+  name: string;
+  parentEntityId: string;
+  timestamp: number;
+}): EndpointEvent {
+  return {
+    '@timestamp': timestamp,
+    event: {
+      type: 'start',
+      category: 'process',
+    },
+    process: {
+      entity_id: entityID,
+      name,
+      parent: {
+        entity_id: parentEntityId,
+      },
+    },
+  } as EndpointEvent;
+}
+
+function treeWith2AncestorsAndNoChildren({
+  originID,
+  firstAncestorID,
+  secondAncestorID,
+}: {
+  secondAncestorID: string;
+  firstAncestorID: string;
+  originID: string;
+}): ResolverTree {
+  const secondAncestor: ResolverEvent = mockEndpointEvent({
+    entityID: secondAncestorID,
+    name: 'a',
+    parentEntityId: 'none',
+    timestamp: 0,
+  });
+  const firstAncestor: ResolverEvent = mockEndpointEvent({
+    entityID: firstAncestorID,
+    name: 'b',
+    parentEntityId: secondAncestorID,
+    timestamp: 1,
+  });
+  const originEvent: ResolverEvent = mockEndpointEvent({
+    entityID: originID,
+    name: 'c',
+    parentEntityId: firstAncestorID,
+    timestamp: 2,
+  });
+  return ({
+    entityID: originID,
+    children: {
+      childNodes: [],
+    },
+    ancestry: {
+      ancestors: [{ lifecycle: [secondAncestor] }, { lifecycle: [firstAncestor] }],
+    },
+    lifecycle: [originEvent],
+  } as unknown) as ResolverTree;
+}
+
+function treeWithNoAncestorsAnd2Children({
+  originID,
+  firstChildID,
+  secondChildID,
+}: {
+  originID: string;
+  firstChildID: string;
+  secondChildID: string;
+}): ResolverTree {
+  const origin: ResolverEvent = mockEndpointEvent({
+    entityID: originID,
+    name: 'c',
+    parentEntityId: 'none',
+    timestamp: 0,
+  });
+  const firstChild: ResolverEvent = mockEndpointEvent({
+    entityID: firstChildID,
+    name: 'd',
+    parentEntityId: originID,
+    timestamp: 1,
+  });
+  const secondChild: ResolverEvent = mockEndpointEvent({
+    entityID: secondChildID,
+    name: 'e',
+    parentEntityId: originID,
+    timestamp: 2,
+  });
+
+  return ({
+    entityID: originID,
+    children: {
+      childNodes: [{ lifecycle: [firstChild] }, { lifecycle: [secondChild] }],
+    },
+    ancestry: {
+      ancestors: [],
+    },
+    lifecycle: [origin],
+  } as unknown) as ResolverTree;
+}
diff --git a/x-pack/plugins/security_solution/public/resolver/store/selectors.ts b/x-pack/plugins/security_solution/public/resolver/store/selectors.ts
index 945b2bfed3cfb..ff2179dc3a2ae 100644
--- a/x-pack/plugins/security_solution/public/resolver/store/selectors.ts
+++ b/x-pack/plugins/security_solution/public/resolver/store/selectors.ts
@@ -4,11 +4,13 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { createSelector } from 'reselect';
+import { createSelector, defaultMemoize } from 'reselect';
 import * as cameraSelectors from './camera/selectors';
 import * as dataSelectors from './data/selectors';
 import * as uiSelectors from './ui/selectors';
-import { ResolverState } from '../types';
+import { ResolverState, IsometricTaxiLayout } from '../types';
+import { uniquePidForProcess } from '../models/process_event';
+import { ResolverEvent } from '../../../common/endpoint/types';
 
 /**
  * A matrix that when applied to a Vector2 will convert it from world coordinates to screen coordinates.
@@ -51,9 +53,24 @@ export const userIsPanning = composeSelectors(cameraStateSelector, cameraSelecto
  */
 export const isAnimating = composeSelectors(cameraStateSelector, cameraSelectors.isAnimating);
 
-export const processNodePositionsAndEdgeLineSegments = composeSelectors(
+/**
+ * Given a nodeID (aka entity_id) get the indexed process event.
+ * Legacy functions take process events instead of nodeID, use this to get
+ * process events for them.
+ */
+export const processEventForID: (
+  state: ResolverState
+) => (nodeID: string) => ResolverEvent | null = composeSelectors(
   dataStateSelector,
-  dataSelectors.processNodePositionsAndEdgeLineSegments
+  dataSelectors.processEventForID
+);
+
+/**
+ * The position of nodes and edges.
+ */
+export const layout: (state: ResolverState) => IsometricTaxiLayout = composeSelectors(
+  dataStateSelector,
+  dataSelectors.layout
 );
 
 /**
@@ -74,11 +91,6 @@ export const resolverComponentInstanceID = composeSelectors(
   dataSelectors.resolverComponentInstanceID
 );
 
-export const processAdjacencies = composeSelectors(
-  dataStateSelector,
-  dataSelectors.processAdjacencies
-);
-
 export const terminatedProcesses = composeSelectors(
   dataStateSelector,
   dataSelectors.terminatedProcesses
@@ -212,10 +224,8 @@ function composeSelectors<OuterState, InnerState, ReturnValue>(
 }
 
 const boundingBox = composeSelectors(cameraStateSelector, cameraSelectors.viewableBoundingBox);
-const indexedProcessNodesAndEdgeLineSegments = composeSelectors(
-  dataStateSelector,
-  dataSelectors.visibleProcessNodePositionsAndEdgeLineSegments
-);
+
+const nodesAndEdgelines = composeSelectors(dataStateSelector, dataSelectors.nodesAndEdgelines);
 
 /**
  * Total count of related events for a process.
@@ -230,15 +240,50 @@ export const relatedEventTotalForProcess = composeSelectors(
  * The bounding box represents what the camera can see. The camera position is a function of time because it can be
  * animated. So in order to get the currently visible entities, we need to pass in time.
  */
-export const visibleProcessNodePositionsAndEdgeLineSegments = createSelector(
-  indexedProcessNodesAndEdgeLineSegments,
-  boundingBox,
-  function (
-    /* eslint-disable no-shadow */
-    indexedProcessNodesAndEdgeLineSegments,
-    boundingBox
-    /* eslint-enable no-shadow */
-  ) {
-    return (time: number) => indexedProcessNodesAndEdgeLineSegments(boundingBox(time));
+export const visibleNodesAndEdgeLines = createSelector(nodesAndEdgelines, boundingBox, function (
+  /* eslint-disable no-shadow */
+  nodesAndEdgelines,
+  boundingBox
+  /* eslint-enable no-shadow */
+) {
+  return (time: number) => nodesAndEdgelines(boundingBox(time));
+});
+
+/**
+ * Takes a nodeID (aka entity_id) and returns the associated aria level as a number or null if the node ID isn't in the tree.
+ */
+export const ariaLevel: (
+  state: ResolverState
+) => (nodeID: string) => number | null = composeSelectors(
+  dataStateSelector,
+  dataSelectors.ariaLevel
+);
+
+/**
+ * Takes a nodeID (aka entity_id) and returns the node ID of the node that aria should 'flowto' or null
+ * If the node has a following sibling that is currently visible, that will be returned, otherwise null.
+ */
+export const ariaFlowtoNodeID: (
+  state: ResolverState
+) => (time: number) => (nodeID: string) => string | null = createSelector(
+  visibleNodesAndEdgeLines,
+  composeSelectors(dataStateSelector, dataSelectors.followingSibling),
+  (visibleNodesAndEdgeLinesAtTime, followingSibling) => {
+    return defaultMemoize((time: number) => {
+      // get the visible nodes at `time`
+      const { processNodePositions } = visibleNodesAndEdgeLinesAtTime(time);
+
+      // get a `Set` containing their node IDs
+      const nodesVisibleAtTime: Set<string> = new Set(
+        [...processNodePositions.keys()].map(uniquePidForProcess)
+      );
+
+      // return the ID of `nodeID`'s following sibling, if it is visible
+      return (nodeID: string): string | null => {
+        const sibling: string | null = followingSibling(nodeID);
+
+        return sibling === null || nodesVisibleAtTime.has(sibling) === false ? null : sibling;
+      };
+    });
   }
 );
diff --git a/x-pack/plugins/security_solution/public/resolver/types.ts b/x-pack/plugins/security_solution/public/resolver/types.ts
index 064634472bbbe..0272de0d8fd2a 100644
--- a/x-pack/plugins/security_solution/public/resolver/types.ts
+++ b/x-pack/plugins/security_solution/public/resolver/types.ts
@@ -269,38 +269,18 @@ export interface ProcessEvent {
   };
 }
 
-/**
- * A map of Process Ids that indicate which processes are adjacent to a given process along
- * directions in two axes: up/down and previous/next.
- */
-export interface AdjacentProcessMap {
-  readonly self: string;
-  parent: string | null;
-  firstChild: string | null;
-  previousSibling: string | null;
-  nextSibling: string | null;
-  /**
-   * To support aria-level, this must be >= 1
-   */
-  level: number;
-}
-
 /**
  * A represention of a process tree with indices for O(1) access to children and values by id.
  */
 export interface IndexedProcessTree {
   /**
-   * Map of ID to a process's children
+   * Map of ID to a process's ordered children
    */
   idToChildren: Map<string | undefined, ResolverEvent[]>;
   /**
    * Map of ID to process
    */
   idToProcess: Map<string, ResolverEvent>;
-  /**
-   * Map of ID to adjacent processes
-   */
-  idToAdjacent: Map<string, AdjacentProcessMap>;
 }
 
 /**
@@ -454,4 +434,9 @@ export interface IsometricTaxiLayout {
    * A map of edgline segments, which graphically connect nodes.
    */
   edgeLineSegments: EdgeLineSegment[];
+
+  /**
+   * defines the aria levels for nodes.
+   */
+  ariaLevels: Map<ResolverEvent, number>;
 }
diff --git a/x-pack/plugins/security_solution/public/resolver/view/map.tsx b/x-pack/plugins/security_solution/public/resolver/view/map.tsx
index 000bf23c5f49d..b366e2f220652 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/map.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/map.tsx
@@ -53,10 +53,13 @@ export const ResolverMap = React.memo(function ({
   useStateSyncingActions({ databaseDocumentID, resolverComponentInstanceID });
 
   const { timestamp } = useContext(SideEffectContext);
+
+  // use this for the entire render in order to keep things in sync
+  const timeAtRender = timestamp();
+
   const { processNodePositions, connectingEdgeLineSegments } = useSelector(
-    selectors.visibleProcessNodePositionsAndEdgeLineSegments
-  )(timestamp());
-  const { processToAdjacencyMap } = useSelector(selectors.processAdjacencies);
+    selectors.visibleNodesAndEdgeLines
+  )(timeAtRender);
   const relatedEventsStats = useSelector(selectors.relatedEventsStats);
   const terminatedProcesses = useSelector(selectors.terminatedProcesses);
   const { projectionMatrix, ref, onMouseDown } = useCamera();
@@ -100,24 +103,19 @@ export const ResolverMap = React.memo(function ({
             />
           ))}
           {[...processNodePositions].map(([processEvent, position]) => {
-            const adjacentNodeMap = processToAdjacencyMap.get(processEvent);
             const processEntityId = entityId(processEvent);
-            if (!adjacentNodeMap) {
-              // This should never happen
-              throw new Error('Issue calculating adjacency node map.');
-            }
             return (
               <ProcessEventDot
                 key={processEntityId}
                 position={position}
                 projectionMatrix={projectionMatrix}
                 event={processEvent}
-                adjacentNodeMap={adjacentNodeMap}
                 relatedEventsStatsForProcess={
                   relatedEventsStats ? relatedEventsStats.get(entityId(processEvent)) : undefined
                 }
                 isProcessTerminated={terminatedProcesses.has(processEntityId)}
                 isProcessOrigin={false}
+                timeAtRender={timeAtRender}
               />
             );
           })}
diff --git a/x-pack/plugins/security_solution/public/resolver/view/panels/panel_content_process_list.tsx b/x-pack/plugins/security_solution/public/resolver/view/panels/panel_content_process_list.tsx
index 0ed677885775f..6f9bfad8c08c2 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/panels/panel_content_process_list.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/panels/panel_content_process_list.tsx
@@ -146,7 +146,7 @@ export const ProcessListWithCounts = memo(function ProcessListWithCounts({
     [pushToQueryParams, handleBringIntoViewClick, isProcessOrigin, isProcessTerminated]
   );
 
-  const { processNodePositions } = useSelector(selectors.processNodePositionsAndEdgeLineSegments);
+  const { processNodePositions } = useSelector(selectors.layout);
   const processTableView: ProcessTableView[] = useMemo(
     () =>
       [...processNodePositions.keys()].map((processEvent) => {
diff --git a/x-pack/plugins/security_solution/public/resolver/view/panels/panel_content_related_list.tsx b/x-pack/plugins/security_solution/public/resolver/view/panels/panel_content_related_list.tsx
index 0878ead72b2a4..9a477fd998bb3 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/panels/panel_content_related_list.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/panels/panel_content_related_list.tsx
@@ -38,7 +38,6 @@ interface MatchingEventEntry {
   eventType: string;
   eventCategory: string;
   name: { subject: string; descriptor?: string };
-  entityId: string;
   setQueryParams: () => void;
 }
 
@@ -202,9 +201,11 @@ export const ProcessEventListNarrowedByType = memo(function ProcessEventListNarr
         eventCategory: `${eventType}`,
         eventType: `${event.ecsEventType(resolverEvent)}`,
         name: event.descriptiveName(resolverEvent),
-        entityId,
         setQueryParams: () => {
-          pushToQueryParams({ crumbId: entityId, crumbEvent: processEntityId });
+          pushToQueryParams({
+            crumbId: entityId === undefined ? '' : String(entityId),
+            crumbEvent: processEntityId,
+          });
         },
       };
     });
diff --git a/x-pack/plugins/security_solution/public/resolver/view/process_event_dot.tsx b/x-pack/plugins/security_solution/public/resolver/view/process_event_dot.tsx
index e20f06ccf0f72..7666d1ac7c88a 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/process_event_dot.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/process_event_dot.tsx
@@ -12,11 +12,12 @@ import { htmlIdGenerator, EuiButton, EuiI18nNumber, EuiFlexGroup, EuiFlexItem }
 import { useSelector } from 'react-redux';
 import { NodeSubMenu, subMenuAssets } from './submenu';
 import { applyMatrix3 } from '../models/vector2';
-import { Vector2, Matrix3, AdjacentProcessMap } from '../types';
+import { Vector2, Matrix3 } from '../types';
 import { SymbolIds, useResolverTheme, calculateResolverFontSize } from './assets';
 import { ResolverEvent, ResolverNodeStats } from '../../../common/endpoint/types';
 import { useResolverDispatch } from './use_resolver_dispatch';
 import * as eventModel from '../../../common/endpoint/models/event';
+import * as processEventModel from '../models/process_event';
 import * as selectors from '../store/selectors';
 import { useResolverQueryParams } from './use_resolver_query_params';
 
@@ -70,10 +71,10 @@ const UnstyledProcessEventDot = React.memo(
     position,
     event,
     projectionMatrix,
-    adjacentNodeMap,
     isProcessTerminated,
     isProcessOrigin,
     relatedEventsStatsForProcess,
+    timeAtRender,
   }: {
     /**
      * A `className` string provided by `styled`
@@ -91,10 +92,6 @@ const UnstyledProcessEventDot = React.memo(
      * projectionMatrix which can be used to convert `position` to screen coordinates.
      */
     projectionMatrix: Matrix3;
-    /**
-     * map of what nodes are "adjacent" to this one in "up, down, previous, next" directions
-     */
-    adjacentNodeMap: AdjacentProcessMap;
     /**
      * Whether or not to show the process as terminated.
      */
@@ -109,7 +106,16 @@ const UnstyledProcessEventDot = React.memo(
      * Statistics for the number of related events and alerts for this process node
      */
     relatedEventsStatsForProcess?: ResolverNodeStats;
+
+    /**
+     * The time (unix epoch) at render.
+     */
+    timeAtRender: number;
   }) => {
+    const resolverComponentInstanceID = useSelector(selectors.resolverComponentInstanceID);
+    // This should be unique to each instance of Resolver
+    const htmlIDPrefix = `resolver:${resolverComponentInstanceID}`;
+
     /**
      * Convert the position, which is in 'world' coordinates, to screen coordinates.
      */
@@ -118,12 +124,22 @@ const UnstyledProcessEventDot = React.memo(
     const [xScale] = projectionMatrix;
 
     // Node (html id=) IDs
-    const selfId = adjacentNodeMap.self;
     const activeDescendantId = useSelector(selectors.uiActiveDescendantId);
     const selectedDescendantId = useSelector(selectors.uiSelectedDescendantId);
+    const nodeID = processEventModel.uniquePidForProcess(event);
 
-    // Entity ID of self
-    const selfEntityId = eventModel.entityId(event);
+    // define a standard way of giving HTML IDs to nodes based on their entity_id/nodeID.
+    // this is used to link nodes via aria attributes
+    const nodeHTMLID = useCallback((id: string) => htmlIdGenerator(htmlIDPrefix)(`${id}:node`), [
+      htmlIDPrefix,
+    ]);
+
+    const ariaLevel: number | null = useSelector(selectors.ariaLevel)(nodeID);
+
+    // the node ID to 'flowto'
+    const ariaFlowtoNodeID: string | null = useSelector(selectors.ariaFlowtoNodeID)(timeAtRender)(
+      nodeID
+    );
 
     const isShowingEventActions = xScale > 0.8;
     const isShowingDescriptionText = xScale >= 0.55;
@@ -204,16 +220,10 @@ const UnstyledProcessEventDot = React.memo(
       strokeColor,
     } = cubeAssetsForNode(isProcessTerminated, isProcessOrigin);
 
-    const resolverNodeIdGenerator = useMemo(() => htmlIdGenerator('resolverNode'), []);
+    const labelHTMLID = htmlIdGenerator('resolver')(`${nodeID}:label`);
 
-    const nodeId = useMemo(() => resolverNodeIdGenerator(selfId), [
-      resolverNodeIdGenerator,
-      selfId,
-    ]);
-    const labelId = useMemo(() => resolverNodeIdGenerator(), [resolverNodeIdGenerator]);
-    const descriptionId = useMemo(() => resolverNodeIdGenerator(), [resolverNodeIdGenerator]);
-    const isActiveDescendant = nodeId === activeDescendantId;
-    const isSelectedDescendant = nodeId === selectedDescendantId;
+    const isAriaCurrent = nodeID === activeDescendantId;
+    const isAriaSelected = nodeID === selectedDescendantId;
 
     const dispatch = useResolverDispatch();
 
@@ -221,34 +231,35 @@ const UnstyledProcessEventDot = React.memo(
       dispatch({
         type: 'userFocusedOnResolverNode',
         payload: {
-          nodeId,
+          nodeId: nodeHTMLID(nodeID),
         },
       });
-    }, [dispatch, nodeId]);
+    }, [dispatch, nodeHTMLID, nodeID]);
 
     const handleRelatedEventRequest = useCallback(() => {
       dispatch({
         type: 'userRequestedRelatedEventData',
-        payload: selfId,
+        payload: nodeID,
       });
-    }, [dispatch, selfId]);
+    }, [dispatch, nodeID]);
 
     const { pushToQueryParams } = useResolverQueryParams();
 
     const handleClick = useCallback(() => {
       if (animationTarget.current !== null) {
+        // This works but the types are missing in the typescript DOM lib
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
         (animationTarget.current as any).beginElement();
       }
       dispatch({
         type: 'userSelectedResolverNode',
         payload: {
-          nodeId,
-          selectedProcessId: selfId,
+          nodeId: nodeHTMLID(nodeID),
+          selectedProcessId: nodeID,
         },
       });
-      pushToQueryParams({ crumbId: selfEntityId, crumbEvent: 'all' });
-    }, [animationTarget, dispatch, nodeId, selfEntityId, pushToQueryParams, selfId]);
+      pushToQueryParams({ crumbId: nodeID, crumbEvent: 'all' });
+    }, [animationTarget, dispatch, pushToQueryParams, nodeID, nodeHTMLID]);
 
     /**
      * Enumerates the stats for related events to display with the node as options,
@@ -280,12 +291,12 @@ const UnstyledProcessEventDot = React.memo(
               },
             });
 
-            pushToQueryParams({ crumbId: selfEntityId, crumbEvent: category });
+            pushToQueryParams({ crumbId: nodeID, crumbEvent: category });
           },
         });
       }
       return relatedStatsList;
-    }, [relatedEventsStatsForProcess, dispatch, event, pushToQueryParams, selfEntityId]);
+    }, [relatedEventsStatsForProcess, dispatch, event, pushToQueryParams, nodeID]);
 
     const relatedEventStatusOrOptions = !relatedEventsStatsForProcess
       ? subMenuAssets.initialMenuStatus
@@ -302,15 +313,14 @@ const UnstyledProcessEventDot = React.memo(
         data-test-subj={'resolverNode'}
         className={`${className} kbn-resetFocusState`}
         role="treeitem"
-        aria-level={adjacentNodeMap.level}
-        aria-flowto={adjacentNodeMap.nextSibling === null ? undefined : adjacentNodeMap.nextSibling}
-        aria-labelledby={labelId}
-        aria-describedby={descriptionId}
-        aria-haspopup={'true'}
-        aria-current={isActiveDescendant ? 'true' : undefined}
-        aria-selected={isSelectedDescendant ? 'true' : undefined}
+        aria-level={ariaLevel === null ? undefined : ariaLevel}
+        aria-flowto={ariaFlowtoNodeID === null ? undefined : nodeHTMLID(ariaFlowtoNodeID)}
+        aria-labelledby={labelHTMLID}
+        aria-haspopup="true"
+        aria-current={isAriaCurrent ? 'true' : undefined}
+        aria-selected={isAriaSelected ? 'true' : undefined}
         style={nodeViewportStyle}
-        id={nodeId}
+        id={nodeHTMLID(nodeID)}
         tabIndex={-1}
       >
         <svg
@@ -373,8 +383,7 @@ const UnstyledProcessEventDot = React.memo(
           </StyledDescriptionText>
           <div
             className={xScale >= 2 ? 'euiButton' : 'euiButton euiButton--small'}
-            data-test-subject="nodeLabel"
-            id={labelId}
+            id={labelHTMLID}
             onClick={handleClick}
             onFocus={handleFocus}
             tabIndex={-1}
@@ -386,9 +395,7 @@ const UnstyledProcessEventDot = React.memo(
           >
             <EuiButton
               color={labelButtonFill}
-              data-test-subject="nodeLabel"
               fill={isLabelFilled}
-              id={labelId}
               size="s"
               style={{
                 maxHeight: `${Math.min(26 + xScale * 3, 32)}px`,
diff --git a/x-pack/plugins/security_solution/public/resolver/view/use_camera.test.tsx b/x-pack/plugins/security_solution/public/resolver/view/use_camera.test.tsx
index 3476764a88733..a27f157bc9364 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/use_camera.test.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/use_camera.test.tsx
@@ -189,9 +189,7 @@ describe('useCamera on an unpainted element', () => {
           throw new Error('failed to create tree');
         }
         const processes: ResolverEvent[] = [
-          ...selectors
-            .processNodePositionsAndEdgeLineSegments(store.getState())
-            .processNodePositions.keys(),
+          ...selectors.layout(store.getState()).processNodePositions.keys(),
         ];
         process = processes[processes.length - 1];
         if (!process) {
diff --git a/x-pack/plugins/security_solution/public/resolver/view/use_resolver_query_params.ts b/x-pack/plugins/security_solution/public/resolver/view/use_resolver_query_params.ts
index 70baef5fa88ea..3c342ae575aa0 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/use_resolver_query_params.ts
+++ b/x-pack/plugins/security_solution/public/resolver/view/use_resolver_query_params.ts
@@ -20,8 +20,8 @@ export function useResolverQueryParams() {
   const history = useHistory();
   const urlSearch = useLocation().search;
   const resolverComponentInstanceID = useSelector(selectors.resolverComponentInstanceID);
-  const uniqueCrumbIdKey: string = `${resolverComponentInstanceID}CrumbId`;
-  const uniqueCrumbEventKey: string = `${resolverComponentInstanceID}CrumbEvent`;
+  const uniqueCrumbIdKey: string = `resolver-id:${resolverComponentInstanceID}`;
+  const uniqueCrumbEventKey: string = `resolver-event:${resolverComponentInstanceID}`;
   const pushToQueryParams = useCallback(
     (newCrumbs: CrumbInfo) => {
       // Construct a new set of params from the current set (minus empty params)
@@ -51,9 +51,15 @@ export function useResolverQueryParams() {
     const parsed = querystring.parse(urlSearch.slice(1));
     const crumbEvent = parsed[uniqueCrumbEventKey];
     const crumbId = parsed[uniqueCrumbIdKey];
+    function valueForParam(param: string | string[]): string {
+      if (Array.isArray(param)) {
+        return param[0] || '';
+      }
+      return param || '';
+    }
     return {
-      crumbEvent: Array.isArray(crumbEvent) ? crumbEvent[0] : crumbEvent,
-      crumbId: Array.isArray(crumbId) ? crumbId[0] : crumbId,
+      crumbEvent: valueForParam(crumbEvent),
+      crumbId: valueForParam(crumbId),
     };
   }, [urlSearch, uniqueCrumbIdKey, uniqueCrumbEventKey]);
 
diff --git a/x-pack/plugins/security_solution/public/timelines/components/fields_browser/field_name.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/fields_browser/field_name.test.tsx
index 44e4818830acd..ddd5c6f07e8b5 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/fields_browser/field_name.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/fields_browser/field_name.test.tsx
@@ -46,7 +46,7 @@ describe('FieldName', () => {
         <FieldName {...defaultProps} />
       </TestProviders>
     );
-    wrapper.find('div').at(1).simulate('mouseenter');
+    wrapper.find('[data-test-subj="withHoverActionsButton"]').at(0).simulate('mouseenter');
     wrapper.update();
     expect(wrapper.find('[data-test-subj="copy-to-clipboard"]').exists()).toBe(true);
   });
diff --git a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/timelines_table/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/timelines_table/index.tsx
index 2c55edb9034b5..2d3672b15dd10 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/timelines_table/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/timelines_table/index.tsx
@@ -197,7 +197,6 @@ export const TimelinesTable = React.memo<TimelinesTableProps>(
     return (
       <BasicTable
         columns={columns}
-        compressed
         data-test-subj="timelines-table"
         isExpandable={true}
         isSelectable={actionTimelineToShow.includes('selectable')}
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/generic_file_details.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/generic_file_details.test.tsx
index 52c232f377f79..dd5b182c8c124 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/generic_file_details.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/generic_file_details.test.tsx
@@ -11,6 +11,7 @@ import { BrowserFields } from '../../../../../../common/containers/source';
 import { mockBrowserFields } from '../../../../../../common/containers/source/mock';
 import '../../../../../../common/mock/match_media';
 import { mockTimelineData, TestProviders } from '../../../../../../common/mock';
+import { mockEndgameCreationEvent } from '../../../../../../common/mock/mock_endgame_ecs_data';
 import { SystemGenericFileDetails, SystemGenericFileLine } from './generic_file_details';
 import { useMountAppended } from '../../../../../../common/utils/use_mount_appended';
 
@@ -61,6 +62,23 @@ describe('SystemGenericFileDetails', () => {
         'Evan@zeek-london[generic-text-123](6278)with resultfailureSource128.199.212.120'
       );
     });
+
+    test('it passes string value for processHashSha256', () => {
+      const wrapper = mount(
+        <TestProviders>
+          <SystemGenericFileDetails
+            contextId="[contextid-123]"
+            text="[generic-text-123]"
+            browserFields={mockBrowserFields}
+            data={mockEndgameCreationEvent}
+            timelineId="test"
+          />
+        </TestProviders>
+      );
+      expect(wrapper.find('SystemGenericFileLine').prop('processHashSha256')).toEqual(
+        'd4c97ed46046893141652e2ec0056a698f6445109949d7fcabbce331146889ee'
+      );
+    });
   });
 
   describe('#SystemGenericFileLine', () => {
@@ -1231,8 +1249,8 @@ describe('SystemGenericFileDetails', () => {
       });
     });
 
-    test('it does NOT render the text "via" when eventAction is not a whitelisted action', () => {
-      const eventAction = 'a_non_whitelisted_event_action';
+    test('it does NOT render the text "via" when eventAction is not a allowlisted action', () => {
+      const eventAction = 'a_non_allowlisted_event_action';
 
       const wrapper = mount(
         <TestProviders>
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/generic_file_details.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/generic_file_details.tsx
index 8dd513539a96a..3a95c0ea927c8 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/generic_file_details.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/generic_file_details.tsx
@@ -240,7 +240,7 @@ export const SystemGenericFileDetails = React.memo<GenericDetailsProps>(
     const packageVersion: string | null | undefined = get('system.audit.package.version[0]', data);
     const processHashMd5: string | null | undefined = get('process.hash.md5[0]', data);
     const processHashSha1: string | null | undefined = get('process.hash.sha1[0]', data);
-    const processHashSha256: string | null | undefined = get('process.hash.sha256', data);
+    const processHashSha256: string | null | undefined = get('process.hash.sha256[0]', data);
     const processPid: number | null | undefined = get('process.pid[0]', data);
     const processPpid: number | null | undefined = get('process.ppid[0]', data);
     const processName: string | null | undefined = get('process.name[0]', data);
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/helpers.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/helpers.ts
index 2d16892329e19..a6b78269cff2f 100644
--- a/x-pack/plugins/security_solution/public/timelines/store/timeline/helpers.ts
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/helpers.ts
@@ -154,7 +154,7 @@ interface AddNewTimelineParams {
 export const addNewTimeline = ({
   columns,
   dataProviders = [],
-  dateRange: mayDateRange,
+  dateRange: maybeDateRange,
   excludedRowRendererIds = [],
   filters = timelineDefaults.filters,
   id,
@@ -167,7 +167,7 @@ export const addNewTimeline = ({
   timelineType,
 }: AddNewTimelineParams): TimelineById => {
   const { from: startDateRange, to: endDateRange } = normalizeTimeRange({ from: '', to: '' });
-  const dateRange = mayDateRange ?? { start: startDateRange, end: endDateRange };
+  const dateRange = maybeDateRange ?? { start: startDateRange, end: endDateRange };
   const templateTimelineInfo =
     timelineType === TimelineType.template
       ? {
diff --git a/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.ts b/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.ts
index b756c4e3d14c3..e6fd4bad97c5f 100644
--- a/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.ts
@@ -12,6 +12,7 @@ import { validate } from '../../../../common/validate';
 import { Entry, EntryNested } from '../../../../../lists/common/schemas/types/entries';
 import { FoundExceptionListItemSchema } from '../../../../../lists/common/schemas/response/found_exception_list_item_schema';
 import { ExceptionListClient } from '../../../../../lists/server';
+import { ENDPOINT_LIST_ID } from '../../../../common/shared_imports';
 import {
   InternalArtifactSchema,
   TranslatedEntry,
@@ -60,7 +61,7 @@ export async function getFullEndpointExceptionList(
 
   do {
     const response = await eClient.findExceptionListItem({
-      listId: 'endpoint_list',
+      listId: ENDPOINT_LIST_ID,
       namespaceType: 'agnostic',
       filter: `exception-list-agnostic.attributes._tags:\"os:${os}\"`,
       perPage: 100,
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/pagination.ts b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/pagination.ts
index 2b107ab1b6db4..150f56cbd70cc 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/pagination.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/pagination.ts
@@ -61,7 +61,7 @@ export class PaginationBuilder {
     const lastResult = results[results.length - 1];
     const cursor = {
       timestamp: lastResult['@timestamp'],
-      eventID: eventId(lastResult),
+      eventID: eventId(lastResult) === undefined ? '' : String(eventId(lastResult)),
     };
     return PaginationBuilder.urlEncodeCursor(cursor);
   }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/filter_events_with_list.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/filter_events_with_list.ts
index 654ace290f85f..ea52aecb379fa 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/filter_events_with_list.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/filter_events_with_list.ts
@@ -32,6 +32,7 @@ export const filterEventsAgainstList = async ({
   buildRuleMessage,
 }: FilterEventsAgainstList): Promise<SignalSearchResponse> => {
   try {
+    logger.debug(buildRuleMessage(`exceptionsList: ${JSON.stringify(exceptionsList, null, 2)}`));
     if (exceptionsList == null || exceptionsList.length === 0) {
       logger.debug(buildRuleMessage('about to return original search result'));
       return eventSearchResult;
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/search_after_bulk_create.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/search_after_bulk_create.ts
index cd6beb9c68ab2..2a0e39cbbf237 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/search_after_bulk_create.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/search_after_bulk_create.ts
@@ -91,7 +91,7 @@ export const searchAfterAndBulkCreate = async ({
   };
 
   let sortId; // tells us where to start our next search_after query
-  let signalsCreatedCount = 0;
+  let searchResultSize = 0;
 
   /*
     The purpose of `maxResults` is to ensure we do not perform
@@ -127,8 +127,8 @@ export const searchAfterAndBulkCreate = async ({
       toReturn.success = false;
       return toReturn;
     }
-    signalsCreatedCount = 0;
-    while (signalsCreatedCount < tuple.maxSignals) {
+    searchResultSize = 0;
+    while (searchResultSize < tuple.maxSignals) {
       try {
         logger.debug(buildRuleMessage(`sortIds: ${sortId}`));
         const {
@@ -167,6 +167,7 @@ export const searchAfterAndBulkCreate = async ({
                 searchResult.hits.hits[searchResult.hits.hits.length - 1]?._source['@timestamp']
               )
             : null;
+        searchResultSize += searchResult.hits.hits.length;
 
         // filter out the search results that match with the values found in the list.
         // the resulting set are valid signals that are not on the allowlist.
@@ -186,14 +187,6 @@ export const searchAfterAndBulkCreate = async ({
           break;
         }
 
-        // make sure we are not going to create more signals than maxSignals allows
-        if (signalsCreatedCount + filteredEvents.hits.hits.length > tuple.maxSignals) {
-          filteredEvents.hits.hits = filteredEvents.hits.hits.slice(
-            0,
-            tuple.maxSignals - signalsCreatedCount
-          );
-        }
-
         const {
           bulkCreateDuration: bulkDuration,
           createdItemsCount: createdCount,
@@ -218,7 +211,6 @@ export const searchAfterAndBulkCreate = async ({
         });
         logger.debug(buildRuleMessage(`created ${createdCount} signals`));
         toReturn.createdSignalsCount += createdCount;
-        signalsCreatedCount += createdCount;
         if (bulkDuration) {
           toReturn.bulkCreateTimes.push(bulkDuration);
         }
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/action_clone/clone_button.tsx b/x-pack/plugins/transform/public/app/sections/transform_management/components/action_clone/clone_button.tsx
index 4686ede7bc2c2..2b5ffa27e0f82 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/action_clone/clone_button.tsx
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/action_clone/clone_button.tsx
@@ -7,7 +7,7 @@
 import React, { FC, useContext } from 'react';
 import { useHistory } from 'react-router-dom';
 import { i18n } from '@kbn/i18n';
-import { EuiIcon, EuiLink, EuiToolTip } from '@elastic/eui';
+import { EuiButtonEmpty, EuiToolTip } from '@elastic/eui';
 
 import {
   createCapabilityFailureMessage,
@@ -25,7 +25,7 @@ export const CloneButton: FC<CloneActionProps> = ({ itemId }) => {
 
   const { canCreateTransform } = useContext(AuthorizationContext).capabilities;
 
-  const buttonCloneText = i18n.translate('xpack.transform.transformList.cloneActionName', {
+  const buttonText = i18n.translate('xpack.transform.transformList.cloneActionName', {
     defaultMessage: 'Clone',
   });
 
@@ -33,27 +33,30 @@ export const CloneButton: FC<CloneActionProps> = ({ itemId }) => {
     history.push(`/${SECTION_SLUG.CLONE_TRANSFORM}/${itemId}`);
   }
 
-  const cloneButton = (
-    <EuiLink
+  const buttonDisabled = !canCreateTransform;
+
+  const button = (
+    <EuiButtonEmpty
+      aria-label={buttonText}
+      color="text"
       data-test-subj="transformActionClone"
-      color={!canCreateTransform ? 'subdued' : 'text'}
-      disabled={!canCreateTransform}
-      onClick={!canCreateTransform ? undefined : clickHandler}
-      aria-label={buttonCloneText}
+      flush="left"
+      iconType="copy"
+      isDisabled={buttonDisabled}
+      onClick={clickHandler}
+      size="s"
     >
-      <EuiIcon type="copy" /> {buttonCloneText}
-    </EuiLink>
+      {buttonText}
+    </EuiButtonEmpty>
   );
 
-  if (!canCreateTransform) {
-    const content = createCapabilityFailureMessage('canStartStopTransform');
-
+  if (buttonDisabled) {
     return (
-      <EuiToolTip position="top" content={content}>
-        {cloneButton}
+      <EuiToolTip position="top" content={createCapabilityFailureMessage('canStartStopTransform')}>
+        {button}
       </EuiToolTip>
     );
   }
 
-  return <>{cloneButton}</>;
+  return button;
 };
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/action_delete/__snapshots__/delete_button.test.tsx.snap b/x-pack/plugins/transform/public/app/sections/transform_management/components/action_delete/__snapshots__/delete_button.test.tsx.snap
index 3980cc5d5a1ae..7e98fc90cfad4 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/action_delete/__snapshots__/delete_button.test.tsx.snap
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/action_delete/__snapshots__/delete_button.test.tsx.snap
@@ -6,17 +6,17 @@ exports[`Transform: Transform List Actions <DeleteAction /> Minimal initializati
   delay="regular"
   position="top"
 >
-  <EuiLink
+  <EuiButtonEmpty
     aria-label="Delete"
-    color="subdued"
+    color="text"
     data-test-subj="transformActionDelete"
-    disabled={true}
+    flush="left"
+    iconType="trash"
+    isDisabled={true}
+    onClick={[Function]}
+    size="s"
   >
-    <EuiIcon
-      type="trash"
-    />
-     
     Delete
-  </EuiLink>
+  </EuiButtonEmpty>
 </EuiToolTip>
 `;
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/action_delete/delete_button.tsx b/x-pack/plugins/transform/public/app/sections/transform_management/components/action_delete/delete_button.tsx
index b81c3ebc34ca0..2ca48ed734c7f 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/action_delete/delete_button.tsx
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/action_delete/delete_button.tsx
@@ -6,7 +6,7 @@
 
 import React, { FC, useContext } from 'react';
 import { i18n } from '@kbn/i18n';
-import { EuiIcon, EuiLink, EuiToolTip } from '@elastic/eui';
+import { EuiButtonEmpty, EuiToolTip } from '@elastic/eui';
 import { TRANSFORM_STATE } from '../../../../../../common';
 import {
   AuthorizationContext,
@@ -29,7 +29,7 @@ export const DeleteButton: FC<DeleteButtonProps> = ({ items, forceDisable, onCli
   const disabled = items.some(transformCanNotBeDeleted);
   const { canDeleteTransform } = useContext(AuthorizationContext).capabilities;
 
-  const buttonDeleteText = i18n.translate('xpack.transform.transformList.deleteActionName', {
+  const buttonText = i18n.translate('xpack.transform.transformList.deleteActionName', {
     defaultMessage: 'Delete',
   });
   const bulkDeleteButtonDisabledText = i18n.translate(
@@ -46,16 +46,20 @@ export const DeleteButton: FC<DeleteButtonProps> = ({ items, forceDisable, onCli
   );
 
   const buttonDisabled = forceDisable === true || disabled || !canDeleteTransform;
-  let deleteButton = (
-    <EuiLink
+
+  const button = (
+    <EuiButtonEmpty
+      aria-label={buttonText}
+      color="text"
       data-test-subj="transformActionDelete"
-      color={buttonDisabled ? 'subdued' : 'text'}
-      disabled={buttonDisabled}
-      onClick={buttonDisabled ? undefined : () => onClick(items)}
-      aria-label={buttonDeleteText}
+      flush="left"
+      iconType="trash"
+      isDisabled={buttonDisabled}
+      onClick={() => onClick(items)}
+      size="s"
     >
-      <EuiIcon type="trash" /> {buttonDeleteText}
-    </EuiLink>
+      {buttonText}
+    </EuiButtonEmpty>
   );
 
   if (disabled || !canDeleteTransform) {
@@ -66,12 +70,12 @@ export const DeleteButton: FC<DeleteButtonProps> = ({ items, forceDisable, onCli
       content = createCapabilityFailureMessage('canDeleteTransform');
     }
 
-    deleteButton = (
+    return (
       <EuiToolTip position="top" content={content}>
-        {deleteButton}
+        {button}
       </EuiToolTip>
     );
   }
 
-  return deleteButton;
+  return button;
 };
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/action_edit/edit_button.tsx b/x-pack/plugins/transform/public/app/sections/transform_management/components/action_edit/edit_button.tsx
index 6ba8e7aeba20f..40c27cff1e398 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/action_edit/edit_button.tsx
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/action_edit/edit_button.tsx
@@ -8,7 +8,7 @@ import React, { useContext, FC } from 'react';
 
 import { i18n } from '@kbn/i18n';
 
-import { EuiIcon, EuiLink, EuiToolTip } from '@elastic/eui';
+import { EuiButtonEmpty, EuiToolTip } from '@elastic/eui';
 
 import {
   createCapabilityFailureMessage,
@@ -21,31 +21,34 @@ interface EditButtonProps {
 export const EditButton: FC<EditButtonProps> = ({ onClick }) => {
   const { canCreateTransform } = useContext(AuthorizationContext).capabilities;
 
-  const buttonEditText = i18n.translate('xpack.transform.transformList.editActionName', {
+  const buttonText = i18n.translate('xpack.transform.transformList.editActionName', {
     defaultMessage: 'Edit',
   });
 
-  const editButton = (
-    <EuiLink
+  const buttonDisabled = !canCreateTransform;
+
+  const button = (
+    <EuiButtonEmpty
+      aria-label={buttonText}
+      color="text"
       data-test-subj="transformActionEdit"
-      color={!canCreateTransform ? 'subdued' : 'text'}
-      disabled={!canCreateTransform}
-      onClick={!canCreateTransform ? undefined : onClick}
-      aria-label={buttonEditText}
+      flush="left"
+      iconType="pencil"
+      isDisabled={buttonDisabled}
+      onClick={onClick}
+      size="s"
     >
-      <EuiIcon type="pencil" /> {buttonEditText}
-    </EuiLink>
+      {buttonText}
+    </EuiButtonEmpty>
   );
 
   if (!canCreateTransform) {
-    const content = createCapabilityFailureMessage('canStartStopTransform');
-
     return (
-      <EuiToolTip position="top" content={content}>
-        {editButton}
+      <EuiToolTip position="top" content={createCapabilityFailureMessage('canStartStopTransform')}>
+        {button}
       </EuiToolTip>
     );
   }
 
-  return editButton;
+  return button;
 };
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/action_start/__snapshots__/start_button.test.tsx.snap b/x-pack/plugins/transform/public/app/sections/transform_management/components/action_start/__snapshots__/start_button.test.tsx.snap
index 231a1f30f2c31..d8184773e16b5 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/action_start/__snapshots__/start_button.test.tsx.snap
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/action_start/__snapshots__/start_button.test.tsx.snap
@@ -6,15 +6,17 @@ exports[`Transform: Transform List Actions <StartAction /> Minimal initializatio
   delay="regular"
   position="top"
 >
-  <EuiLink
-    color="subdued"
+  <EuiButtonEmpty
+    aria-label="Start"
+    color="text"
     data-test-subj="transformActionStart"
+    flush="left"
+    iconType="play"
+    isDisabled={true}
+    onClick={[Function]}
+    size="s"
   >
-    <EuiIcon
-      type="play"
-    />
-     
     Start
-  </EuiLink>
+  </EuiButtonEmpty>
 </EuiToolTip>
 `;
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/action_start/start_button.tsx b/x-pack/plugins/transform/public/app/sections/transform_management/components/action_start/start_button.tsx
index a0fe1bfbb9544..60f899adc5fb2 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/action_start/start_button.tsx
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/action_start/start_button.tsx
@@ -6,7 +6,7 @@
 
 import React, { FC, useContext } from 'react';
 import { i18n } from '@kbn/i18n';
-import { EuiIcon, EuiLink, EuiToolTip } from '@elastic/eui';
+import { EuiButtonEmpty, EuiToolTip } from '@elastic/eui';
 
 import { TRANSFORM_STATE } from '../../../../../../common';
 
@@ -25,7 +25,7 @@ export const StartButton: FC<StartButtonProps> = ({ items, forceDisable, onClick
   const { canStartStopTransform } = useContext(AuthorizationContext).capabilities;
   const isBulkAction = items.length > 1;
 
-  const buttonStartText = i18n.translate('xpack.transform.transformList.startActionName', {
+  const buttonText = i18n.translate('xpack.transform.transformList.startActionName', {
     defaultMessage: 'Start',
   });
 
@@ -84,23 +84,30 @@ export const StartButton: FC<StartButtonProps> = ({ items, forceDisable, onClick
     }
   }
 
-  const disabled = forceDisable === true || actionIsDisabled;
+  const buttonDisabled = forceDisable === true || actionIsDisabled;
 
-  const startButton = (
-    <EuiLink
+  const button = (
+    <EuiButtonEmpty
+      aria-label={buttonText}
+      color="text"
       data-test-subj="transformActionStart"
-      color={disabled ? 'subdued' : 'text'}
-      onClick={disabled ? undefined : () => onClick(items)}
+      flush="left"
+      iconType="play"
+      isDisabled={buttonDisabled}
+      onClick={() => onClick(items)}
+      size="s"
     >
-      <EuiIcon type="play" /> {buttonStartText}
-    </EuiLink>
+      {buttonText}
+    </EuiButtonEmpty>
   );
-  if (disabled && content !== undefined) {
+
+  if (buttonDisabled && content !== undefined) {
     return (
       <EuiToolTip position="top" content={content}>
-        {startButton}
+        {button}
       </EuiToolTip>
     );
   }
-  return startButton;
+
+  return button;
 };
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/action_stop/__snapshots__/stop_button.test.tsx.snap b/x-pack/plugins/transform/public/app/sections/transform_management/components/action_stop/__snapshots__/stop_button.test.tsx.snap
index dd81bf34bf582..0052dc6254789 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/action_stop/__snapshots__/stop_button.test.tsx.snap
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/action_stop/__snapshots__/stop_button.test.tsx.snap
@@ -6,17 +6,17 @@ exports[`Transform: Transform List Actions <StopAction /> Minimal initialization
   delay="regular"
   position="top"
 >
-  <EuiLink
+  <EuiButtonEmpty
     aria-label="Stop"
-    color="subdued"
+    color="text"
     data-test-subj="transformActionStop"
+    flush="left"
+    iconType="stop"
+    isDisabled={true}
     onClick={[Function]}
+    size="s"
   >
-    <EuiIcon
-      type="stop"
-    />
-     
     Stop
-  </EuiLink>
+  </EuiButtonEmpty>
 </EuiToolTip>
 `;
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/action_stop/stop_button.tsx b/x-pack/plugins/transform/public/app/sections/transform_management/components/action_stop/stop_button.tsx
index 2c67ea3e83ecc..3c5e4323cc69a 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/action_stop/stop_button.tsx
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/action_stop/stop_button.tsx
@@ -6,7 +6,7 @@
 
 import React, { FC, useContext } from 'react';
 import { i18n } from '@kbn/i18n';
-import { EuiIcon, EuiLink, EuiToolTip } from '@elastic/eui';
+import { EuiButtonEmpty, EuiToolTip } from '@elastic/eui';
 
 import { TRANSFORM_STATE } from '../../../../../../common';
 
@@ -25,7 +25,7 @@ export const StopButton: FC<StopButtonProps> = ({ items, forceDisable }) => {
   const isBulkAction = items.length > 1;
   const { canStartStopTransform } = useContext(AuthorizationContext).capabilities;
   const stopTransforms = useStopTransforms();
-  const buttonStopText = i18n.translate('xpack.transform.transformList.stopActionName', {
+  const buttonText = i18n.translate('xpack.transform.transformList.stopActionName', {
     defaultMessage: 'Stop',
   });
 
@@ -56,18 +56,24 @@ export const StopButton: FC<StopButtonProps> = ({ items, forceDisable }) => {
     stopTransforms(items);
   };
 
-  const disabled = forceDisable === true || !canStartStopTransform || stoppedTransform === true;
+  const buttonDisabled =
+    forceDisable === true || !canStartStopTransform || stoppedTransform === true;
 
-  const stopButton = (
-    <EuiLink
+  const button = (
+    <EuiButtonEmpty
+      aria-label={buttonText}
+      color="text"
       data-test-subj="transformActionStop"
-      color={disabled ? 'subdued' : 'text'}
+      flush="left"
+      iconType="stop"
+      isDisabled={buttonDisabled}
       onClick={handleStop}
-      aria-label={buttonStopText}
+      size="s"
     >
-      <EuiIcon type="stop" /> {buttonStopText}
-    </EuiLink>
+      {buttonText}
+    </EuiButtonEmpty>
   );
+
   if (!canStartStopTransform || stoppedTransform) {
     return (
       <EuiToolTip
@@ -78,10 +84,10 @@ export const StopButton: FC<StopButtonProps> = ({ items, forceDisable }) => {
             : stoppedTransformMessage
         }
       >
-        {stopButton}
+        {button}
       </EuiToolTip>
     );
   }
 
-  return stopButton;
+  return button;
 };
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/transform_list.tsx b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/transform_list.tsx
index 9df4113fa9a8b..a31251943061a 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/transform_list.tsx
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/transform_list.tsx
@@ -292,7 +292,7 @@ export const TransformList: FC<Props> = ({
         button={buttonIcon}
         isOpen={isActionsMenuOpen}
         closePopover={() => setIsActionsMenuOpen(false)}
-        panelPaddingSize="none"
+        panelPaddingSize="s"
         anchorPosition="rightUp"
       >
         {bulkActionMenuItems}
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index a4100ae914b25..b87957ae45289 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -4258,11 +4258,6 @@
     "xpack.apm.metrics.transactionChart.transactionsPerMinuteLabel": "1 分あたりのトランザクション数",
     "xpack.apm.notAvailableLabel": "N/A",
     "xpack.apm.percentOfParent": "({parentType, select, transaction { 件中 {value} 件のトランザクション} トレース {trace} })",
-    "xpack.apm.permission.apm": "APM",
-    "xpack.apm.permission.description": "このユーザーには、すべての APM インデックスへのアクセス権がありません。APM アプリを使用できますが、一部のデータが欠けることがあります。以下のインデックスへのアクセス権が必要です。",
-    "xpack.apm.permission.dismissWarning": "閉じる",
-    "xpack.apm.permission.learnMore": "APM パーミッションの詳細を表示",
-    "xpack.apm.permission.title": "APM へのアクセス権がありません",
     "xpack.apm.propertiesTable.agentFeature.noDataAvailableLabel": "利用可能なデータがありません",
     "xpack.apm.propertiesTable.agentFeature.noResultFound": "\"{value}\"に対する結果が見つかりませんでした。",
     "xpack.apm.propertiesTable.tabs.exceptionStacktraceLabel": "例外のスタックトレース",
@@ -9488,7 +9483,6 @@
     "xpack.ml.dataframe.analytics.create.duplicateIndexPatternErrorMessageError": "インデックスパターン{indexPatternName}はすでに作成されています。",
     "xpack.ml.dataframe.analytics.create.errorCreatingDataFrameAnalyticsJob": "データフレーム分析ジョブの作成中にエラーが発生しました。",
     "xpack.ml.dataframe.analytics.create.errorGettingDataFrameAnalyticsList": "既存のデータフレーム分析ジョブIDの取得中にエラーが発生しました。",
-    "xpack.ml.dataframe.analytics.create.errorGettingDataFrameIndexNames": "既存のインデックス名の取得中にエラーが発生しました。",
     "xpack.ml.dataframe.analytics.create.errorGettingIndexPatternTitles": "既存のインデックスパターンのタイトルの取得中にエラーが発生しました。",
     "xpack.ml.dataframe.analytics.create.errorStartingDataFrameAnalyticsJob": "データフレーム分析ジョブの開始中にエラーが発生しました。",
     "xpack.ml.dataframe.analytics.create.indexPatternAlreadyExistsError": "このタイトルのインデックスパターンが既に存在します。",
@@ -9588,7 +9582,6 @@
     "xpack.ml.dataframe.analyticsList.title": "分析ジョブ",
     "xpack.ml.dataframe.analyticsList.type": "タイプ",
     "xpack.ml.dataframe.analyticsList.viewActionName": "表示",
-    "xpack.ml.dataframe.analyticsList.viewAriaLabel": "表示",
     "xpack.ml.dataframe.stepCreateForm.createDataFrameAnalyticsSuccessMessage": "データフレーム分析 {jobId} の作成リクエストが受け付けられました。",
     "xpack.ml.dataframe.stepDetailsForm.destinationIndexInvalidErrorLink": "インデックス名の制限に関する詳細。",
     "xpack.ml.dataFrameAnalyticsBreadcrumbs.dataFrameExplorationLabel": "データフレーム分析",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index 69e37f3f9f9f0..01ffa4833a3bb 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -4262,11 +4262,6 @@
     "xpack.apm.metrics.transactionChart.transactionsPerMinuteLabel": "每分钟事务数",
     "xpack.apm.notAvailableLabel": "不适用",
     "xpack.apm.percentOfParent": "({value} 的 {parentType, select, transaction {事务} trace {trace} })",
-    "xpack.apm.permission.apm": "APM",
-    "xpack.apm.permission.description": "您的用户无权访问所有 APM 索引。您仍可以使用 APM 应用，但部分数据可能缺失。您必须获授以下索引的权限：",
-    "xpack.apm.permission.dismissWarning": "关闭",
-    "xpack.apm.permission.learnMore": "详细了解 APM 权限",
-    "xpack.apm.permission.title": "缺少访问 APM 的权限",
     "xpack.apm.propertiesTable.agentFeature.noDataAvailableLabel": "没有可用数据",
     "xpack.apm.propertiesTable.agentFeature.noResultFound": "没有“{value}”的结果。",
     "xpack.apm.propertiesTable.tabs.exceptionStacktraceLabel": "异常堆栈跟踪",
@@ -9493,7 +9488,6 @@
     "xpack.ml.dataframe.analytics.create.duplicateIndexPatternErrorMessageError": "索引模式 {indexPatternName} 已存在。",
     "xpack.ml.dataframe.analytics.create.errorCreatingDataFrameAnalyticsJob": "创建数据帧分析作业时发生错误：",
     "xpack.ml.dataframe.analytics.create.errorGettingDataFrameAnalyticsList": "获取现有数据帧分析作业 ID 时发生错误：",
-    "xpack.ml.dataframe.analytics.create.errorGettingDataFrameIndexNames": "获取现有索引名称时发生错误：",
     "xpack.ml.dataframe.analytics.create.errorGettingIndexPatternTitles": "获取现有索引模式标题时发生错误：",
     "xpack.ml.dataframe.analytics.create.errorStartingDataFrameAnalyticsJob": "启动数据帧分析作业时发生错误：",
     "xpack.ml.dataframe.analytics.create.indexPatternAlreadyExistsError": "具有此名称的索引模式已存在。",
@@ -9593,7 +9587,6 @@
     "xpack.ml.dataframe.analyticsList.title": "分析作业",
     "xpack.ml.dataframe.analyticsList.type": "类型",
     "xpack.ml.dataframe.analyticsList.viewActionName": "查看",
-    "xpack.ml.dataframe.analyticsList.viewAriaLabel": "查看",
     "xpack.ml.dataframe.stepCreateForm.createDataFrameAnalyticsSuccessMessage": "数据帧分析 {jobId} 创建请求已确认。",
     "xpack.ml.dataframe.stepDetailsForm.destinationIndexInvalidErrorLink": "详细了解索引名称限制。",
     "xpack.ml.dataFrameAnalyticsBreadcrumbs.dataFrameExplorationLabel": "数据帧分析",
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_connectors.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_connectors.test.tsx
index 452d9c288926e..25381614a6c07 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_connectors.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_connectors.test.tsx
@@ -72,6 +72,7 @@ describe('ServiceNowActionConnectorFields renders', () => {
         editActionConfig={() => {}}
         editActionSecrets={() => {}}
         docLinks={deps!.docLinks}
+        consumer={'case'}
       />
     );
     expect(wrapper.find('[data-test-subj="case-servicenow-mappings"]').length > 0).toBeTruthy();
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_connectors.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_connectors.tsx
index a5c4849cb63d9..139ef8fa58ff3 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_connectors.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_connectors.tsx
@@ -12,9 +12,11 @@ import {
   EuiFormRow,
   EuiFieldPassword,
   EuiSpacer,
+  EuiLink,
 } from '@elastic/eui';
 
 import { isEmpty } from 'lodash';
+import { FormattedMessage } from '@kbn/i18n/react';
 import { ActionConnectorFieldsProps } from '../../../../types';
 import * as i18n from './translations';
 import { ServiceNowActionConnector, CasesConfigurationMapping } from './types';
@@ -23,7 +25,7 @@ import { FieldMapping } from './case_mappings/field_mapping';
 
 const ServiceNowConnectorFields: React.FC<ActionConnectorFieldsProps<
   ServiceNowActionConnector
->> = ({ action, editActionSecrets, editActionConfig, errors, consumer }) => {
+>> = ({ action, editActionSecrets, editActionConfig, errors, consumer, docLinks }) => {
   // TODO: remove incidentConfiguration later, when Case ServiceNow will move their fields to the level of action execution
   const { apiUrl, incidentConfiguration, isCaseOwned } = action.config;
   const mapping = incidentConfiguration ? incidentConfiguration.mapping : [];
@@ -79,6 +81,17 @@ const ServiceNowConnectorFields: React.FC<ActionConnectorFieldsProps<
             error={errors.apiUrl}
             isInvalid={isApiUrlInvalid}
             label={i18n.API_URL_LABEL}
+            helpText={
+              <EuiLink
+                href={`${docLinks.ELASTIC_WEBSITE_URL}guide/en/kibana/${docLinks.DOC_LINK_VERSION}/servicenow-action-type.html#configuring-servicenow`}
+                target="_blank"
+              >
+                <FormattedMessage
+                  id="xpack.triggersActionsUI.components.builtinActionTypes.serviceNowAction.apiUrlHelpLabel"
+                  defaultMessage="Configure Personal Developer Instance for ServiceNow"
+                />
+              </EuiLink>
+            }
           >
             <EuiFieldText
               fullWidth
@@ -149,7 +162,7 @@ const ServiceNowConnectorFields: React.FC<ActionConnectorFieldsProps<
           </EuiFormRow>
         </EuiFlexItem>
       </EuiFlexGroup>
-      {isCaseOwned && ( // TODO: remove this block later, when Case ServiceNow will move their fields to the level of action execution
+      {consumer === 'case' && ( // TODO: remove this block later, when Case ServiceNow will move their fields to the level of action execution
         <>
           <EuiSpacer size="l" />
           <EuiFlexGroup>
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_params.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_params.test.tsx
index 3ea628cd65473..1fc856b1e1ab2 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_params.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_params.test.tsx
@@ -39,7 +39,7 @@ describe('ServiceNowParamsFields renders', () => {
     );
     expect(wrapper.find('[data-test-subj="impactSelect"]').length > 0).toBeTruthy();
     expect(wrapper.find('[data-test-subj="titleInput"]').length > 0).toBeTruthy();
-    expect(wrapper.find('[data-test-subj="incidentDescriptionTextArea"]').length > 0).toBeTruthy();
-    expect(wrapper.find('[data-test-subj="incidentCommentTextArea"]').length > 0).toBeTruthy();
+    expect(wrapper.find('[data-test-subj="descriptionTextArea"]').length > 0).toBeTruthy();
+    expect(wrapper.find('[data-test-subj="commentTextArea"]').length > 0).toBeTruthy();
   });
 });
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_params.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_params.tsx
index 67070b6dc8907..1e0f4d1fdc57c 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_params.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_params.tsx
@@ -5,17 +5,17 @@
  */
 
 import React, { Fragment, useEffect } from 'react';
-import { EuiFormRow, EuiTextArea } from '@elastic/eui';
+import { EuiFormRow } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { EuiSelect } from '@elastic/eui';
 import { EuiFlexGroup } from '@elastic/eui';
 import { EuiFlexItem } from '@elastic/eui';
-import { EuiFieldText } from '@elastic/eui';
 import { EuiSpacer } from '@elastic/eui';
 import { EuiTitle } from '@elastic/eui';
 import { ActionParamsProps } from '../../../../types';
-import { AddMessageVariables } from '../../add_message_variables';
 import { ServiceNowActionParams } from './types';
+import { TextAreaWithMessageVariables } from '../../text_area_with_message_variables';
+import { TextFieldWithMessageVariables } from '../../text_field_with_message_variables';
 
 const ServiceNowParamsFields: React.FunctionComponent<ActionParamsProps<
   ServiceNowActionParams
@@ -76,13 +76,6 @@ const ServiceNowParamsFields: React.FunctionComponent<ActionParamsProps<
     // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [title, description, comment, severity, impact, urgency]);
 
-  const onSelectMessageVariable = (paramsProperty: string, variable: string) => {
-    editSubActionProperty(
-      paramsProperty,
-      ((actionParams as any).subActionParams[paramsProperty] ?? '').concat(` {{${variable}}}`)
-    );
-  };
-
   return (
     <Fragment>
       <EuiTitle size="s">
@@ -164,96 +157,44 @@ const ServiceNowParamsFields: React.FunctionComponent<ActionParamsProps<
             defaultMessage: 'Short description',
           }
         )}
-        labelAppend={
-          <AddMessageVariables
-            messageVariables={messageVariables}
-            onSelectEventHandler={(variable: string) => onSelectMessageVariable('title', variable)}
-            paramsProperty="title"
-          />
-        }
       >
-        <EuiFieldText
-          fullWidth
-          name="title"
-          data-test-subj="titleInput"
-          isInvalid={errors.title.length > 0 && title !== undefined}
-          value={title || ''}
-          onChange={(e: React.ChangeEvent<HTMLInputElement>) => {
-            editSubActionProperty('title', e.target.value);
-          }}
-          onBlur={() => {
-            if (!title) {
-              editSubActionProperty('title', '');
-            }
-          }}
+        <TextFieldWithMessageVariables
+          index={index}
+          editAction={editSubActionProperty}
+          messageVariables={messageVariables}
+          paramsProperty={'title'}
+          inputTargetValue={title}
+          errors={errors.title as string[]}
         />
       </EuiFormRow>
-      <EuiFormRow
-        fullWidth
+      <TextAreaWithMessageVariables
+        index={index}
+        editAction={editSubActionProperty}
+        messageVariables={messageVariables}
+        paramsProperty={'description'}
+        inputTargetValue={description}
         label={i18n.translate(
           'xpack.triggersActionsUI.components.builtinActionTypes.serviceNow.descriptionTextAreaFieldLabel',
           {
             defaultMessage: 'Description (optional)',
           }
         )}
-        labelAppend={
-          <AddMessageVariables
-            messageVariables={messageVariables}
-            onSelectEventHandler={(variable: string) =>
-              onSelectMessageVariable('description', variable)
-            }
-            paramsProperty="description"
-          />
-        }
-      >
-        <EuiTextArea
-          fullWidth
-          name="description"
-          value={description || ''}
-          data-test-subj="incidentDescriptionTextArea"
-          onChange={(e) => {
-            editSubActionProperty('description', e.target.value);
-          }}
-          onBlur={() => {
-            if (!description) {
-              editSubActionProperty('description', '');
-            }
-          }}
-        />
-      </EuiFormRow>
-      <EuiFormRow
-        fullWidth
+        errors={errors.description as string[]}
+      />
+      <TextAreaWithMessageVariables
+        index={index}
+        editAction={editSubActionProperty}
+        messageVariables={messageVariables}
+        paramsProperty={'comment'}
+        inputTargetValue={comment}
         label={i18n.translate(
           'xpack.triggersActionsUI.components.builtinActionTypes.serviceNow.commentsTextAreaFieldLabel',
           {
             defaultMessage: 'Additional comments (optional)',
           }
         )}
-        labelAppend={
-          <AddMessageVariables
-            messageVariables={messageVariables}
-            onSelectEventHandler={(variable: string) =>
-              onSelectMessageVariable('comment', variable)
-            }
-            paramsProperty="comment"
-          />
-        }
-      >
-        <EuiTextArea
-          fullWidth
-          name="comment"
-          value={comment || ''}
-          data-test-subj="incidentCommentTextArea"
-          onChange={(e) => {
-            editSubActionProperty('comment', e.target.value);
-          }}
-          onBlur={() => {
-            if (!comment) {
-              editSubActionProperty('comment', '');
-            }
-          }}
-        />
-      </EuiFormRow>
+        errors={errors.comment as string[]}
+      />
     </Fragment>
   );
 };
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/webhook/webhook_connectors.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/webhook/webhook_connectors.test.tsx
index 3b7865e59b9e6..3a2afff03c58f 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/webhook/webhook_connectors.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/webhook/webhook_connectors.test.tsx
@@ -36,6 +36,7 @@ describe('WebhookActionConnectorFields renders', () => {
       />
     );
     expect(wrapper.find('[data-test-subj="webhookViewHeadersSwitch"]').length > 0).toBeTruthy();
+    expect(wrapper.find('[data-test-subj="webhookHeaderText"]').length > 0).toBeTruthy();
     wrapper.find('[data-test-subj="webhookViewHeadersSwitch"]').first().simulate('click');
     expect(wrapper.find('[data-test-subj="webhookMethodSelect"]').length > 0).toBeTruthy();
     expect(wrapper.find('[data-test-subj="webhookUrlText"]').length > 0).toBeTruthy();
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/webhook/webhook_connectors.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/webhook/webhook_connectors.tsx
index 57c88607c0884..2321d5b4b5479 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/webhook/webhook_connectors.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/webhook/webhook_connectors.tsx
@@ -31,14 +31,16 @@ const HTTP_VERBS = ['post', 'put'];
 const WebhookActionConnectorFields: React.FunctionComponent<ActionConnectorFieldsProps<
   WebhookActionConnector
 >> = ({ action, editActionConfig, editActionSecrets, errors }) => {
+  const { user, password } = action.secrets;
+  const { method, url, headers } = action.config;
+
   const [httpHeaderKey, setHttpHeaderKey] = useState<string>('');
   const [httpHeaderValue, setHttpHeaderValue] = useState<string>('');
   const [hasHeaders, setHasHeaders] = useState<boolean>(false);
 
-  const { user, password } = action.secrets;
-  const { method, url, headers } = action.config;
-
-  editActionConfig('method', 'post'); // set method to POST by default
+  if (!method) {
+    editActionConfig('method', 'post'); // set method to POST by default
+  }
 
   const headerErrors = {
     keyHeader: new Array<string>(),
@@ -80,7 +82,7 @@ const WebhookActionConnectorFields: React.FunctionComponent<ActionConnectorField
 
   function viewHeaders() {
     setHasHeaders(!hasHeaders);
-    if (!hasHeaders) {
+    if (!hasHeaders && !headers) {
       editActionConfig('headers', {});
     }
   }
@@ -338,8 +340,8 @@ const WebhookActionConnectorFields: React.FunctionComponent<ActionConnectorField
 
       <EuiSpacer size="m" />
       <div>
-        {hasHeaders && Object.keys(headers || {}).length > 0 ? (
-          <Fragment>
+        {Object.keys(headers || {}).length > 0 ? (
+          <>
             <EuiSpacer size="m" />
             <EuiTitle size="xxs">
               <h5>
@@ -351,10 +353,10 @@ const WebhookActionConnectorFields: React.FunctionComponent<ActionConnectorField
             </EuiTitle>
             <EuiSpacer size="s" />
             {headersList}
-          </Fragment>
+          </>
         ) : null}
         <EuiSpacer size="m" />
-        {headerControl}
+        {hasHeaders && headerControl}
         <EuiSpacer size="m" />
       </div>
     </Fragment>
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_form.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_form.tsx
index 9182d5a687eb5..67c7ca91156da 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_form.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_form.tsx
@@ -45,7 +45,6 @@ import { TypeRegistry } from '../../type_registry';
 import { actionTypeCompare } from '../../lib/action_type_compare';
 import { checkActionFormActionTypeEnabled } from '../../lib/check_action_type_enabled';
 import { VIEW_LICENSE_OPTIONS_LINK } from '../../../common/constants';
-import { ServiceNowConnectorConfiguration } from '../../../common';
 
 interface ActionAccordionFormProps {
   actions: AlertAction[];
@@ -132,14 +131,7 @@ export const ActionForm = ({
       try {
         setIsLoadingConnectors(true);
         const loadedConnectors = await loadConnectors({ http });
-        setConnectors(
-          loadedConnectors.filter(
-            (action) =>
-              action.actionTypeId !== ServiceNowConnectorConfiguration.id ||
-              (action.actionTypeId === ServiceNowConnectorConfiguration.id &&
-                !action.config.isCaseOwned)
-          )
-        );
+        setConnectors(loadedConnectors);
       } catch (e) {
         toastNotifications.addDanger({
           title: i18n.translate(
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_edit_flyout.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_edit_flyout.tsx
index 68fd8b65f1a41..52425a616aad4 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_edit_flyout.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_edit_flyout.tsx
@@ -51,11 +51,20 @@ export const ConnectorEditFlyout = ({
     consumer,
   } = useActionsConnectorsContext();
   const canSave = hasSaveActionsCapability(capabilities);
-  const closeFlyout = useCallback(() => setEditFlyoutVisibility(false), [setEditFlyoutVisibility]);
+
   const [{ connector }, dispatch] = useReducer(connectorReducer, {
     connector: { ...initialConnector, secrets: {} },
   });
   const [isSaving, setIsSaving] = useState<boolean>(false);
+  const setConnector = (key: string, value: any) => {
+    dispatch({ command: { type: 'setConnector' }, payload: { key, value } });
+  };
+
+  const closeFlyout = useCallback(() => {
+    setEditFlyoutVisibility(false);
+    setConnector('connector', { ...initialConnector, secrets: {} });
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [setEditFlyoutVisibility]);
 
   if (!editFlyoutVisible) {
     return null;
@@ -213,7 +222,7 @@ export const ConnectorEditFlyout = ({
       <EuiFlyoutFooter>
         <EuiFlexGroup justifyContent="spaceBetween">
           <EuiFlexItem grow={false}>
-            <EuiButtonEmpty onClick={closeFlyout}>
+            <EuiButtonEmpty onClick={closeFlyout} data-test-subj="cancelSaveEditedConnectorButton">
               {i18n.translate(
                 'xpack.triggersActionsUI.sections.editConnectorForm.cancelButtonLabel',
                 {
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_list.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_list.tsx
index 0e0691960729d..5d52896cc628f 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_list.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_list.tsx
@@ -20,7 +20,6 @@ import {
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { ServiceNowConnectorConfiguration } from '../../../../common';
 import { useAppDependencies } from '../../../app_context';
 import { loadAllActions, loadActionTypes, deleteActions } from '../../../lib/action_connector_api';
 import ConnectorAddFlyout from '../../action_connector_form/connector_add_flyout';
@@ -119,14 +118,7 @@ export const ActionsConnectorsList: React.FunctionComponent = () => {
     setIsLoadingActions(true);
     try {
       const actionsResponse = await loadAllActions({ http });
-      setActions(
-        actionsResponse.filter(
-          (action) =>
-            action.actionTypeId !== ServiceNowConnectorConfiguration.id ||
-            (action.actionTypeId === ServiceNowConnectorConfiguration.id &&
-              !action.config.isCaseOwned)
-        )
-      );
+      setActions(actionsResponse);
     } catch (e) {
       toastNotifications.addDanger({
         title: i18n.translate(
diff --git a/x-pack/test/alerting_api_integration/basic/tests/actions/builtin_action_types/server_log.ts b/x-pack/test/alerting_api_integration/basic/tests/actions/builtin_action_types/server_log.ts
index ea5f523b396b4..7204581d036e0 100644
--- a/x-pack/test/alerting_api_integration/basic/tests/actions/builtin_action_types/server_log.ts
+++ b/x-pack/test/alerting_api_integration/basic/tests/actions/builtin_action_types/server_log.ts
@@ -9,11 +9,8 @@ import { FtrProviderContext } from '../../../../common/ftr_provider_context';
 // eslint-disable-next-line import/no-default-export
 export default function serverLogTest({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
-  const esArchiver = getService('esArchiver');
 
   describe('server-log action', () => {
-    after(() => esArchiver.unload('empty_kibana'));
-
     it('should return 200 when creating a server-log action', async () => {
       await supertest
         .post('/api/actions/action')
diff --git a/x-pack/test/alerting_api_integration/common/config.ts b/x-pack/test/alerting_api_integration/common/config.ts
index e3281cfdfa9a3..946b3d2f2591b 100644
--- a/x-pack/test/alerting_api_integration/common/config.ts
+++ b/x-pack/test/alerting_api_integration/common/config.ts
@@ -33,6 +33,7 @@ const enabledActionTypes = [
   'test.index-record',
   'test.noop',
   'test.rate-limit',
+  'test.throw',
 ];
 
 // eslint-disable-next-line import/no-default-export
diff --git a/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts/server/action_types.ts b/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts/server/action_types.ts
index 9ce2c2fb58272..fd0d03dc18410 100644
--- a/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts/server/action_types.ts
+++ b/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts/server/action_types.ts
@@ -24,6 +24,14 @@ export function defineActionTypes(
       return { status: 'ok', actionId: '' };
     },
   };
+  const throwActionType: ActionType = {
+    id: 'test.throw',
+    name: 'Test: Throw',
+    minimumLicenseRequired: 'gold',
+    async executor() {
+      throw new Error('this action is intended to fail');
+    },
+  };
   const indexRecordActionType: ActionType = {
     id: 'test.index-record',
     name: 'Test: Index Record',
@@ -193,6 +201,7 @@ export function defineActionTypes(
     },
   };
   actions.registerType(noopActionType);
+  actions.registerType(throwActionType);
   actions.registerType(indexRecordActionType);
   actions.registerType(failingActionType);
   actions.registerType(rateLimitedActionType);
diff --git a/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts/server/alert_types.ts b/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts/server/alert_types.ts
index 1262539ac9570..ee3e0e6646112 100644
--- a/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts/server/alert_types.ts
+++ b/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts/server/alert_types.ts
@@ -286,6 +286,50 @@ export function defineAlertTypes(
     },
     async executor(opts: AlertExecutorOptions) {},
   };
+  const throwAlertType: AlertType = {
+    id: 'test.throw',
+    name: 'Test: Throw',
+    actionGroups: [
+      {
+        id: 'default',
+        name: 'Default',
+      },
+    ],
+    producer: 'alerting',
+    defaultActionGroupId: 'default',
+    async executor({ services, params, state }: AlertExecutorOptions) {
+      throw new Error('this alert is intended to fail');
+    },
+  };
+  const patternFiringAlertType: AlertType = {
+    id: 'test.patternFiring',
+    name: 'Test: Firing on a Pattern',
+    actionGroups: [{ id: 'default', name: 'Default' }],
+    producer: 'alerting',
+    defaultActionGroupId: 'default',
+    async executor(alertExecutorOptions: AlertExecutorOptions) {
+      const { services, state, params } = alertExecutorOptions;
+      const pattern = params.pattern;
+      if (!Array.isArray(pattern)) throw new Error('pattern is not an array');
+      if (pattern.length === 0) throw new Error('pattern is empty');
+
+      // get the pattern index, return if past it
+      const patternIndex = state.patternIndex ?? 0;
+      if (patternIndex > pattern.length) {
+        return { patternIndex };
+      }
+
+      // fire if pattern says to
+      if (pattern[patternIndex]) {
+        services.alertInstanceFactory('instance').scheduleActions('default');
+      }
+
+      return {
+        patternIndex: (patternIndex + 1) % pattern.length,
+      };
+    },
+  };
+
   alerts.registerType(alwaysFiringAlertType);
   alerts.registerType(cumulativeFiringAlertType);
   alerts.registerType(neverFiringAlertType);
@@ -295,4 +339,6 @@ export function defineAlertTypes(
   alerts.registerType(noopAlertType);
   alerts.registerType(onlyContextVariablesAlertType);
   alerts.registerType(onlyStateVariablesAlertType);
+  alerts.registerType(patternFiringAlertType);
+  alerts.registerType(throwAlertType);
 }
diff --git a/x-pack/test/alerting_api_integration/common/lib/get_event_log.ts b/x-pack/test/alerting_api_integration/common/lib/get_event_log.ts
new file mode 100644
index 0000000000000..69eeaafbf64fa
--- /dev/null
+++ b/x-pack/test/alerting_api_integration/common/lib/get_event_log.ts
@@ -0,0 +1,48 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IValidatedEvent } from '../../../../plugins/event_log/server';
+import { getUrlPrefix } from '.';
+import { FtrProviderContext } from '../ftr_provider_context';
+
+interface GetEventLogParams {
+  getService: FtrProviderContext['getService'];
+  spaceId: string;
+  type: string;
+  id: string;
+  provider: string;
+  actions: string[];
+}
+
+// Return event log entries given the specified parameters; for the `actions`
+// parameter, at least one event of each action must be in the returned entries.
+export async function getEventLog(params: GetEventLogParams): Promise<IValidatedEvent[]> {
+  const { getService, spaceId, type, id, provider, actions } = params;
+  const supertest = getService('supertest');
+
+  const spacePrefix = getUrlPrefix(spaceId);
+  const url = `${spacePrefix}/api/event_log/${type}/${id}/_find`;
+
+  const { body: result } = await supertest.get(url).expect(200);
+  if (!result.total) {
+    throw new Error('no events found yet');
+  }
+
+  const events: IValidatedEvent[] = (result.data as IValidatedEvent[]).filter(
+    (event) => event?.event?.provider === provider
+  );
+  const foundActions = new Set(
+    events.map((event) => event?.event?.action).filter((event) => !!event)
+  );
+
+  for (const action of actions) {
+    if (!foundActions.has(action)) {
+      throw new Error(`no event found with action "${action}"`);
+    }
+  }
+
+  return events;
+}
diff --git a/x-pack/test/alerting_api_integration/common/lib/index.ts b/x-pack/test/alerting_api_integration/common/lib/index.ts
index c1e59664f9ce2..eae679cd38c11 100644
--- a/x-pack/test/alerting_api_integration/common/lib/index.ts
+++ b/x-pack/test/alerting_api_integration/common/lib/index.ts
@@ -12,3 +12,4 @@ export { AlertUtils } from './alert_utils';
 export { TaskManagerUtils } from './task_manager_utils';
 export * from './test_assertions';
 export { checkAAD } from './check_aad';
+export { getEventLog } from './get_event_log';
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/email.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/email.ts
index ffbb29b431d8d..1c3d3e3d713e2 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/email.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/email.ts
@@ -11,11 +11,8 @@ import { FtrProviderContext } from '../../../../common/ftr_provider_context';
 // eslint-disable-next-line import/no-default-export
 export default function emailTest({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
-  const esArchiver = getService('esArchiver');
 
   describe('create email action', () => {
-    after(() => esArchiver.unload('empty_kibana'));
-
     let createdActionId = '';
 
     it('should return 200 when creating an email action successfully', async () => {
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/es_index.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/es_index.ts
index c1dc155c17238..61903c2902317 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/es_index.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/es_index.ts
@@ -14,10 +14,8 @@ const ES_TEST_INDEX_NAME = 'functional-test-actions-index';
 export default function indexTest({ getService }: FtrProviderContext) {
   const es = getService('legacyEs');
   const supertest = getService('supertest');
-  const esArchiver = getService('esArchiver');
 
   describe('index action', () => {
-    after(() => esArchiver.unload('empty_kibana'));
     beforeEach(() => clearTestIndex(es));
 
     let createdActionID: string;
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/es_index_preconfigured.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/es_index_preconfigured.ts
index 93daa16e71bcf..09b4b433d4847 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/es_index_preconfigured.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/es_index_preconfigured.ts
@@ -16,10 +16,8 @@ const ES_TEST_INDEX_NAME = 'functional-test-actions-index-preconfigured';
 export default function indexTest({ getService }: FtrProviderContext) {
   const es = getService('legacyEs');
   const supertest = getService('supertest');
-  const esArchiver = getService('esArchiver');
 
   describe('preconfigured index action', () => {
-    after(() => esArchiver.unload('empty_kibana'));
     beforeEach(() => clearTestIndex(es));
 
     it('should execute successfully when expected for a single body', async () => {
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/jira.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/jira.ts
index 19206ce681000..24931f11d4999 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/jira.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/jira.ts
@@ -34,7 +34,6 @@ const mapping = [
 // eslint-disable-next-line import/no-default-export
 export default function jiraTest({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
-  const esArchiver = getService('esArchiver');
   const kibanaServer = getService('kibanaServer');
 
   const mockJira = {
@@ -82,8 +81,6 @@ export default function jiraTest({ getService }: FtrProviderContext) {
       );
     });
 
-    after(() => esArchiver.unload('empty_kibana'));
-
     describe('Jira - Action Creation', () => {
       it('should return 200 when creating a jira action successfully', async () => {
         const { body: createdAction } = await supertest
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/pagerduty.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/pagerduty.ts
index 71ceb731da9f0..f4fcbb65ab5a3 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/pagerduty.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/pagerduty.ts
@@ -16,7 +16,6 @@ import {
 // eslint-disable-next-line import/no-default-export
 export default function pagerdutyTest({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
-  const esArchiver = getService('esArchiver');
   const kibanaServer = getService('kibanaServer');
 
   describe('pagerduty action', () => {
@@ -30,8 +29,6 @@ export default function pagerdutyTest({ getService }: FtrProviderContext) {
       );
     });
 
-    after(() => esArchiver.unload('empty_kibana'));
-
     it('should return successfully when passed valid create parameters', async () => {
       const { body: createdAction } = await supertest
         .post('/api/actions/action')
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/resilient.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/resilient.ts
index a77e0414a19d4..94feabb556a51 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/resilient.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/resilient.ts
@@ -34,7 +34,6 @@ const mapping = [
 // eslint-disable-next-line import/no-default-export
 export default function resilientTest({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
-  const esArchiver = getService('esArchiver');
   const kibanaServer = getService('kibanaServer');
 
   const mockResilient = {
@@ -82,8 +81,6 @@ export default function resilientTest({ getService }: FtrProviderContext) {
       );
     });
 
-    after(() => esArchiver.unload('empty_kibana'));
-
     describe('IBM Resilient - Action Creation', () => {
       it('should return 200 when creating a ibm resilient action successfully', async () => {
         const { body: createdAction } = await supertest
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/server_log.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/server_log.ts
index a915987ce5feb..e8b088abff3c8 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/server_log.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/server_log.ts
@@ -11,11 +11,8 @@ import { FtrProviderContext } from '../../../../common/ftr_provider_context';
 // eslint-disable-next-line import/no-default-export
 export default function serverLogTest({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
-  const esArchiver = getService('esArchiver');
 
   describe('server-log action', () => {
-    after(() => esArchiver.unload('empty_kibana'));
-
     let serverLogActionId: string;
 
     it('should return 200 when creating a builtin server-log action', async () => {
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/servicenow.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/servicenow.ts
index 8205b75cabed5..d3b72d01216d0 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/servicenow.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/servicenow.ts
@@ -34,7 +34,6 @@ const mapping = [
 // eslint-disable-next-line import/no-default-export
 export default function servicenowTest({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
-  const esArchiver = getService('esArchiver');
   const kibanaServer = getService('kibanaServer');
 
   const mockServiceNow = {
@@ -81,8 +80,6 @@ export default function servicenowTest({ getService }: FtrProviderContext) {
       );
     });
 
-    after(() => esArchiver.unload('empty_kibana'));
-
     describe('ServiceNow - Action Creation', () => {
       it('should return 200 when creating a servicenow action successfully', async () => {
         const { body: createdAction } = await supertest
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/slack.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/slack.ts
index 537205360f4aa..f21bc8edeef1e 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/slack.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/slack.ts
@@ -16,7 +16,6 @@ import {
 // eslint-disable-next-line import/no-default-export
 export default function slackTest({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
-  const esArchiver = getService('esArchiver');
   const kibanaServer = getService('kibanaServer');
 
   describe('slack action', () => {
@@ -30,8 +29,6 @@ export default function slackTest({ getService }: FtrProviderContext) {
       );
     });
 
-    after(() => esArchiver.unload('empty_kibana'));
-
     it('should return 200 when creating a slack action successfully', async () => {
       const { body: createdAction } = await supertest
         .post('/api/actions/action')
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/webhook.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/webhook.ts
index 10adf12baf652..7eba753d7e98b 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/webhook.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/webhook.ts
@@ -27,7 +27,6 @@ function parsePort(url: Record<string, string>): Record<string, string | null |
 // eslint-disable-next-line import/no-default-export
 export default function webhookTest({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
-  const esArchiver = getService('esArchiver');
   const kibanaServer = getService('kibanaServer');
 
   async function createWebhookAction(
@@ -71,8 +70,6 @@ export default function webhookTest({ getService }: FtrProviderContext) {
       );
     });
 
-    after(() => esArchiver.unload('empty_kibana'));
-
     it('should return 200 when creating a webhook action successfully', async () => {
       const { body: createdAction } = await supertest
         .post('/api/actions/action')
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/execute.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/execute.ts
index 70a3663c1c798..5d609d001ee5d 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/execute.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/execute.ts
@@ -11,8 +11,12 @@ import {
   ES_TEST_INDEX_NAME,
   getUrlPrefix,
   ObjectRemover,
+  getEventLog,
 } from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
+import { IValidatedEvent } from '../../../../../plugins/event_log/server';
+
+const NANOS_IN_MILLIS = 1000 * 1000;
 
 // eslint-disable-next-line import/no-default-export
 export default function ({ getService }: FtrProviderContext) {
@@ -107,6 +111,13 @@ export default function ({ getService }: FtrProviderContext) {
                 reference,
                 source: 'action:test.index-record',
               });
+
+              await validateEventLog({
+                spaceId: space.id,
+                actionId: createdAction.id,
+                outcome: 'success',
+                message: `action executed: test.index-record:${createdAction.id}: My action`,
+              });
               break;
             default:
               throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
@@ -480,4 +491,66 @@ export default function ({ getService }: FtrProviderContext) {
       });
     }
   });
+
+  interface ValidateEventLogParams {
+    spaceId: string;
+    actionId: string;
+    outcome: string;
+    message: string;
+    errorMessage?: string;
+  }
+
+  async function validateEventLog(params: ValidateEventLogParams): Promise<void> {
+    const { spaceId, actionId, outcome, message, errorMessage } = params;
+
+    const events: IValidatedEvent[] = await retry.try(async () => {
+      return await getEventLog({
+        getService,
+        spaceId,
+        type: 'action',
+        id: actionId,
+        provider: 'actions',
+        actions: ['execute'],
+      });
+    });
+
+    expect(events.length).to.equal(1);
+
+    const event = events[0];
+
+    const duration = event?.event?.duration;
+    const eventStart = Date.parse(event?.event?.start || 'undefined');
+    const eventEnd = Date.parse(event?.event?.end || 'undefined');
+    const dateNow = Date.now();
+
+    expect(typeof duration).to.be('number');
+    expect(eventStart).to.be.ok();
+    expect(eventEnd).to.be.ok();
+
+    const durationDiff = Math.abs(
+      Math.round(duration! / NANOS_IN_MILLIS) - (eventEnd - eventStart)
+    );
+
+    // account for rounding errors
+    expect(durationDiff < 1).to.equal(true);
+    expect(eventStart <= eventEnd).to.equal(true);
+    expect(eventEnd <= dateNow).to.equal(true);
+
+    expect(event?.event?.outcome).to.equal(outcome);
+
+    expect(event?.kibana?.saved_objects).to.eql([
+      {
+        rel: 'primary',
+        type: 'action',
+        id: actionId,
+        namespace: spaceId,
+      },
+    ]);
+
+    expect(event?.message).to.eql(message);
+
+    if (errorMessage) {
+      expect(event?.error?.message).to.eql(errorMessage);
+    }
+  }
 }
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/alerts.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/alerts.ts
index dce809f0b7be9..db1e59746162b 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/alerts.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/alerts.ts
@@ -15,7 +15,11 @@ import {
   ObjectRemover,
   AlertUtils,
   TaskManagerUtils,
+  getEventLog,
 } from '../../../common/lib';
+import { IValidatedEvent } from '../../../../../plugins/event_log/server';
+
+const NANOS_IN_MILLIS = 1000 * 1000;
 
 // eslint-disable-next-line import/no-default-export
 export default function alertTests({ getService }: FtrProviderContext) {
@@ -26,7 +30,7 @@ export default function alertTests({ getService }: FtrProviderContext) {
   const esTestIndexTool = new ESTestIndexTool(es, retry);
   const taskManagerUtils = new TaskManagerUtils(es, retry);
 
-  // Failing ES promotion: https://github.com/elastic/kibana/issues/71582
+  // FLAKY: https://github.com/elastic/kibana/issues/72207
   describe.skip('alerts', () => {
     const authorizationIndex = '.kibana-test-authorization';
     const objectRemover = new ObjectRemover(supertest);
@@ -160,6 +164,13 @@ instanceStateValue: true
               });
 
               await taskManagerUtils.waitForActionTaskParamsToBeCleanedUp(testStart);
+
+              await validateEventLog({
+                spaceId: space.id,
+                alertId,
+                outcome: 'success',
+                message: `alert executed: test.always-firing:${alertId}: 'abc'`,
+              });
               break;
             default:
               throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
@@ -928,4 +939,66 @@ instanceStateValue: true
       });
     }
   });
+
+  interface ValidateEventLogParams {
+    spaceId: string;
+    alertId: string;
+    outcome: string;
+    message: string;
+    errorMessage?: string;
+  }
+
+  async function validateEventLog(params: ValidateEventLogParams): Promise<void> {
+    const { spaceId, alertId, outcome, message, errorMessage } = params;
+
+    const events: IValidatedEvent[] = await retry.try(async () => {
+      return await getEventLog({
+        getService,
+        spaceId,
+        type: 'alert',
+        id: alertId,
+        provider: 'alerting',
+        actions: ['execute'],
+      });
+    });
+
+    expect(events.length).to.be.greaterThan(0);
+
+    const event = events[0];
+
+    const duration = event?.event?.duration;
+    const eventStart = Date.parse(event?.event?.start || 'undefined');
+    const eventEnd = Date.parse(event?.event?.end || 'undefined');
+    const dateNow = Date.now();
+
+    expect(typeof duration).to.be('number');
+    expect(eventStart).to.be.ok();
+    expect(eventEnd).to.be.ok();
+
+    const durationDiff = Math.abs(
+      Math.round(duration! / NANOS_IN_MILLIS) - (eventEnd - eventStart)
+    );
+
+    // account for rounding errors
+    expect(durationDiff < 1).to.equal(true);
+    expect(eventStart <= eventEnd).to.equal(true);
+    expect(eventEnd <= dateNow).to.equal(true);
+
+    expect(event?.event?.outcome).to.equal(outcome);
+
+    expect(event?.kibana?.saved_objects).to.eql([
+      {
+        rel: 'primary',
+        type: 'alert',
+        id: alertId,
+        namespace: spaceId,
+      },
+    ]);
+
+    expect(event?.message).to.eql(message);
+
+    if (errorMessage) {
+      expect(event?.error?.message).to.eql(errorMessage);
+    }
+  }
 }
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/update.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/update.ts
index 37c0116396b1c..2bcc035beb7a9 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/update.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/update.ts
@@ -29,8 +29,7 @@ export default function createUpdateTests({ getService }: FtrProviderContext) {
       .then((response: SupertestResponse) => response.body);
   }
 
-  // Failing ES promotion: https://github.com/elastic/kibana/issues/71558
-  describe.skip('update', () => {
+  describe('update', () => {
     const objectRemover = new ObjectRemover(supertest);
 
     after(() => objectRemover.removeAll());
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/actions/builtin_action_types/es_index.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/actions/builtin_action_types/es_index.ts
index 0822e614464cb..0609e2f3f444f 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/actions/builtin_action_types/es_index.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/actions/builtin_action_types/es_index.ts
@@ -14,10 +14,8 @@ const ES_TEST_INDEX_NAME = 'functional-test-actions-index';
 export default function indexTest({ getService }: FtrProviderContext) {
   const es = getService('legacyEs');
   const supertest = getService('supertest');
-  const esArchiver = getService('esArchiver');
 
   describe('index action', () => {
-    after(() => esArchiver.unload('empty_kibana'));
     beforeEach(() => clearTestIndex(es));
 
     let createdActionID: string;
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/actions/builtin_action_types/webhook.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/actions/builtin_action_types/webhook.ts
index fb8460068cbcf..b3572978cee70 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/actions/builtin_action_types/webhook.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/actions/builtin_action_types/webhook.ts
@@ -15,7 +15,6 @@ import {
 // eslint-disable-next-line import/no-default-export
 export default function webhookTest({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
-  const esArchiver = getService('esArchiver');
   const kibanaServer = getService('kibanaServer');
 
   async function createWebhookAction(
@@ -55,8 +54,6 @@ export default function webhookTest({ getService }: FtrProviderContext) {
       );
     });
 
-    after(() => esArchiver.unload('empty_kibana'));
-
     it('webhook can be executed without username and password', async () => {
       const webhookActionId = await createWebhookAction(webhookSimulatorURL);
       const { body: result } = await supertest
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/actions/execute.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/actions/execute.ts
index 7bbeab7cc8726..f74c6eaa3298a 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/actions/execute.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/actions/execute.ts
@@ -11,8 +11,12 @@ import {
   ES_TEST_INDEX_NAME,
   getUrlPrefix,
   ObjectRemover,
+  getEventLog,
 } from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
+import { IValidatedEvent } from '../../../../../plugins/event_log/server';
+
+const NANOS_IN_MILLIS = 1000 * 1000;
 
 // eslint-disable-next-line import/no-default-export
 export default function ({ getService }: FtrProviderContext) {
@@ -86,6 +90,13 @@ export default function ({ getService }: FtrProviderContext) {
         reference,
         source: 'action:test.index-record',
       });
+
+      await validateEventLog({
+        spaceId: Spaces.space1.id,
+        actionId: createdAction.id,
+        outcome: 'success',
+        message: `action executed: test.index-record:${createdAction.id}: My action`,
+      });
     });
 
     it('should handle failed executions', async () => {
@@ -118,6 +129,14 @@ export default function ({ getService }: FtrProviderContext) {
         serviceMessage: `expected failure for ${ES_TEST_INDEX_NAME} ${reference}`,
         retry: false,
       });
+
+      await validateEventLog({
+        spaceId: Spaces.space1.id,
+        actionId: createdAction.id,
+        outcome: 'failure',
+        message: `action execution failure: test.failing:${createdAction.id}: failing action`,
+        errorMessage: `an error occurred while running the action executor: expected failure for .kibana-alerting-test-data actions-failure-1:space1`,
+      });
     });
 
     it(`shouldn't execute an action from another space`, async () => {
@@ -198,4 +217,66 @@ export default function ({ getService }: FtrProviderContext) {
       });
     });
   });
+
+  interface ValidateEventLogParams {
+    spaceId: string;
+    actionId: string;
+    outcome: string;
+    message: string;
+    errorMessage?: string;
+  }
+
+  async function validateEventLog(params: ValidateEventLogParams): Promise<void> {
+    const { spaceId, actionId, outcome, message, errorMessage } = params;
+
+    const events: IValidatedEvent[] = await retry.try(async () => {
+      return await getEventLog({
+        getService,
+        spaceId,
+        type: 'action',
+        id: actionId,
+        provider: 'actions',
+        actions: ['execute'],
+      });
+    });
+
+    expect(events.length).to.equal(1);
+
+    const event = events[0];
+
+    const duration = event?.event?.duration;
+    const eventStart = Date.parse(event?.event?.start || 'undefined');
+    const eventEnd = Date.parse(event?.event?.end || 'undefined');
+    const dateNow = Date.now();
+
+    expect(typeof duration).to.be('number');
+    expect(eventStart).to.be.ok();
+    expect(eventEnd).to.be.ok();
+
+    const durationDiff = Math.abs(
+      Math.round(duration! / NANOS_IN_MILLIS) - (eventEnd - eventStart)
+    );
+
+    // account for rounding errors
+    expect(durationDiff < 1).to.equal(true);
+    expect(eventStart <= eventEnd).to.equal(true);
+    expect(eventEnd <= dateNow).to.equal(true);
+
+    expect(event?.event?.outcome).to.equal(outcome);
+
+    expect(event?.kibana?.saved_objects).to.eql([
+      {
+        rel: 'primary',
+        type: 'action',
+        id: actionId,
+        namespace: 'space1',
+      },
+    ]);
+
+    expect(event?.message).to.eql(message);
+
+    if (errorMessage) {
+      expect(event?.error?.message).to.eql(errorMessage);
+    }
+  }
 }
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/event_log.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/event_log.ts
new file mode 100644
index 0000000000000..79d25d8d10436
--- /dev/null
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/event_log.ts
@@ -0,0 +1,265 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import expect from '@kbn/expect';
+import { Spaces } from '../../scenarios';
+import { getUrlPrefix, getTestAlertData, ObjectRemover, getEventLog } from '../../../common/lib';
+import { FtrProviderContext } from '../../../common/ftr_provider_context';
+import { IValidatedEvent } from '../../../../../plugins/event_log/server';
+
+const NANOS_IN_MILLIS = 1000 * 1000;
+
+// eslint-disable-next-line import/no-default-export
+export default function eventLogTests({ getService }: FtrProviderContext) {
+  const supertest = getService('supertest');
+  const retry = getService('retry');
+
+  describe('eventLog', () => {
+    const objectRemover = new ObjectRemover(supertest);
+
+    after(() => objectRemover.removeAll());
+
+    it('should generate expected events for normal operation', async () => {
+      const { body: createdAction } = await supertest
+        .post(`${getUrlPrefix(Spaces.space1.id)}/api/actions/action`)
+        .set('kbn-xsrf', 'foo')
+        .send({
+          name: 'MY action',
+          actionTypeId: 'test.noop',
+          config: {},
+          secrets: {},
+        })
+        .expect(200);
+
+      // pattern of when the alert should fire
+      const pattern = [false, true, true];
+
+      const response = await supertest
+        .post(`${getUrlPrefix(Spaces.space1.id)}/api/alerts/alert`)
+        .set('kbn-xsrf', 'foo')
+        .send(
+          getTestAlertData({
+            alertTypeId: 'test.patternFiring',
+            schedule: { interval: '1s' },
+            throttle: null,
+            params: {
+              pattern,
+            },
+            actions: [
+              {
+                id: createdAction.id,
+                group: 'default',
+                params: {},
+              },
+            ],
+          })
+        );
+
+      expect(response.status).to.eql(200);
+      const alertId = response.body.id;
+      objectRemover.add(Spaces.space1.id, alertId, 'alert', 'alerts');
+
+      // get the events we're expecting
+      const events = await retry.try(async () => {
+        return await getEventLog({
+          getService,
+          spaceId: Spaces.space1.id,
+          type: 'alert',
+          id: alertId,
+          provider: 'alerting',
+          actions: ['execute', 'execute-action', 'new-instance', 'resolved-instance'],
+        });
+      });
+
+      // make sure the counts of the # of events per type are as expected
+      const executeEvents = getEventsByAction(events, 'execute');
+      const executeActionEvents = getEventsByAction(events, 'execute-action');
+      const newInstanceEvents = getEventsByAction(events, 'new-instance');
+      const resolvedInstanceEvents = getEventsByAction(events, 'resolved-instance');
+
+      expect(executeEvents.length >= 4).to.be(true);
+      expect(executeActionEvents.length).to.be(2);
+      expect(newInstanceEvents.length).to.be(1);
+      expect(resolvedInstanceEvents.length).to.be(1);
+
+      // make sure the events are in the right temporal order
+      const executeTimes = getTimestamps(executeEvents);
+      const executeActionTimes = getTimestamps(executeActionEvents);
+      const newInstanceTimes = getTimestamps(newInstanceEvents);
+      const resolvedInstanceTimes = getTimestamps(resolvedInstanceEvents);
+
+      expect(executeTimes[0] < newInstanceTimes[0]).to.be(true);
+      expect(executeTimes[1] <= newInstanceTimes[0]).to.be(true);
+      expect(executeTimes[2] > newInstanceTimes[0]).to.be(true);
+      expect(executeTimes[1] <= executeActionTimes[0]).to.be(true);
+      expect(executeTimes[2] > executeActionTimes[0]).to.be(true);
+      expect(resolvedInstanceTimes[0] > newInstanceTimes[0]).to.be(true);
+
+      // validate each event
+      for (const event of events) {
+        switch (event?.event?.action) {
+          case 'execute':
+            validateEvent(event, {
+              spaceId: Spaces.space1.id,
+              savedObjects: [{ type: 'alert', id: alertId, rel: 'primary' }],
+              outcome: 'success',
+              message: `alert executed: test.patternFiring:${alertId}: 'abc'`,
+            });
+            break;
+          case 'execute-action':
+            validateEvent(event, {
+              spaceId: Spaces.space1.id,
+              savedObjects: [
+                { type: 'alert', id: alertId, rel: 'primary' },
+                { type: 'action', id: createdAction.id },
+              ],
+              message: `alert: test.patternFiring:${alertId}: 'abc' instanceId: 'instance' scheduled actionGroup: 'default' action: test.noop:${createdAction.id}`,
+            });
+            break;
+          case 'new-instance':
+            validateEvent(event, {
+              spaceId: Spaces.space1.id,
+              savedObjects: [{ type: 'alert', id: alertId, rel: 'primary' }],
+              message: `test.patternFiring:${alertId}: 'abc' created new instance: 'instance'`,
+            });
+            break;
+          case 'resolved-instance':
+            validateEvent(event, {
+              spaceId: Spaces.space1.id,
+              savedObjects: [{ type: 'alert', id: alertId, rel: 'primary' }],
+              message: `test.patternFiring:${alertId}: 'abc' resolved instance: 'instance'`,
+            });
+            break;
+          // this will get triggered as we add new event actions
+          default:
+            throw new Error(`unexpected event action "${event?.event?.action}"`);
+        }
+      }
+    });
+
+    it('should generate events for execution errors', async () => {
+      const response = await supertest
+        .post(`${getUrlPrefix(Spaces.space1.id)}/api/alerts/alert`)
+        .set('kbn-xsrf', 'foo')
+        .send(
+          getTestAlertData({
+            alertTypeId: 'test.throw',
+            schedule: { interval: '1s' },
+            throttle: null,
+          })
+        );
+
+      expect(response.status).to.eql(200);
+      const alertId = response.body.id;
+      objectRemover.add(Spaces.space1.id, alertId, 'alert', 'alerts');
+
+      const events = await retry.try(async () => {
+        return await getEventLog({
+          getService,
+          spaceId: Spaces.space1.id,
+          type: 'alert',
+          id: alertId,
+          provider: 'alerting',
+          actions: ['execute'],
+        });
+      });
+
+      const event = events[0];
+      expect(event).to.be.ok();
+
+      validateEvent(event, {
+        spaceId: Spaces.space1.id,
+        savedObjects: [{ type: 'alert', id: alertId, rel: 'primary' }],
+        outcome: 'failure',
+        message: `alert execution failure: test.throw:${alertId}: 'abc'`,
+        errorMessage: 'this alert is intended to fail',
+      });
+    });
+  });
+
+  interface SavedObject {
+    type: string;
+    id: string;
+    rel?: string;
+  }
+
+  interface ValidateEventLogParams {
+    spaceId: string;
+    savedObjects: SavedObject[];
+    outcome?: string;
+    message: string;
+    errorMessage?: string;
+  }
+
+  function validateEvent(event: IValidatedEvent, params: ValidateEventLogParams): void {
+    const { spaceId, savedObjects, outcome, message, errorMessage } = params;
+
+    const duration = event?.event?.duration;
+    const eventStart = Date.parse(event?.event?.start || 'undefined');
+    const eventEnd = Date.parse(event?.event?.end || 'undefined');
+    const dateNow = Date.now();
+
+    if (duration !== undefined) {
+      expect(typeof duration).to.be('number');
+      expect(eventStart).to.be.ok();
+      expect(eventEnd).to.be.ok();
+
+      const durationDiff = Math.abs(
+        Math.round(duration! / NANOS_IN_MILLIS) - (eventEnd - eventStart)
+      );
+
+      // account for rounding errors
+      expect(durationDiff < 1).to.equal(true);
+      expect(eventStart <= eventEnd).to.equal(true);
+      expect(eventEnd <= dateNow).to.equal(true);
+    }
+
+    expect(event?.event?.outcome).to.equal(outcome);
+
+    for (const savedObject of savedObjects) {
+      expect(
+        isSavedObjectInEvent(event, spaceId, savedObject.type, savedObject.id, savedObject.rel)
+      ).to.be(true);
+    }
+
+    expect(event?.message).to.eql(message);
+
+    if (errorMessage) {
+      expect(event?.error?.message).to.eql(errorMessage);
+    }
+  }
+}
+
+function getEventsByAction(events: IValidatedEvent[], action: string) {
+  return events.filter((event) => event?.event?.action === action);
+}
+
+function getTimestamps(events: IValidatedEvent[]) {
+  return events.map((event) => event?.['@timestamp'] ?? 'missing timestamp');
+}
+
+function isSavedObjectInEvent(
+  event: IValidatedEvent,
+  namespace: string,
+  type: string,
+  id: string,
+  rel?: string
+): boolean {
+  const savedObjects = event?.kibana?.saved_objects ?? [];
+
+  for (const savedObject of savedObjects) {
+    if (
+      savedObject.namespace === namespace &&
+      savedObject.type === type &&
+      savedObject.id === id &&
+      savedObject.rel === rel
+    ) {
+      return true;
+    }
+  }
+
+  return false;
+}
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/index.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/index.ts
index 2fc35ddaa3c61..0970738b630c4 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/index.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/index.ts
@@ -17,6 +17,7 @@ export default function alertingTests({ loadTestFile }: FtrProviderContext) {
     loadTestFile(require.resolve('./get'));
     loadTestFile(require.resolve('./get_alert_state'));
     loadTestFile(require.resolve('./list_alert_types'));
+    loadTestFile(require.resolve('./event_log'));
     loadTestFile(require.resolve('./mute_all'));
     loadTestFile(require.resolve('./mute_instance'));
     loadTestFile(require.resolve('./unmute_all'));
@@ -26,6 +27,8 @@ export default function alertingTests({ loadTestFile }: FtrProviderContext) {
     loadTestFile(require.resolve('./alerts_space1'));
     loadTestFile(require.resolve('./alerts_default_space'));
     loadTestFile(require.resolve('./builtin_alert_types'));
+
+    // note that this test will destroy existing spaces
     loadTestFile(require.resolve('./migrations'));
   });
 }
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/index.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/index.ts
index 17f602d3d94f7..281096f8a3592 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/index.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/index.ts
@@ -27,7 +27,7 @@ export default function alertingApiIntegrationTests({
       }
     });
 
-    after(() => esArchiver.unload('empty_kibana'));
+    after(async () => await esArchiver.unload('empty_kibana'));
 
     loadTestFile(require.resolve('./actions'));
     loadTestFile(require.resolve('./alerting'));
diff --git a/x-pack/test/api_integration/apis/fleet/agents/enroll.ts b/x-pack/test/api_integration/apis/fleet/agents/enroll.ts
index e9f7471f6437e..8a21fbcf24c7d 100644
--- a/x-pack/test/api_integration/apis/fleet/agents/enroll.ts
+++ b/x-pack/test/api_integration/apis/fleet/agents/enroll.ts
@@ -21,7 +21,8 @@ export default function (providerContext: FtrProviderContext) {
   let apiKey: { id: string; api_key: string };
   let kibanaVersion: string;
 
-  describe('fleet_agents_enroll', () => {
+  // Flaky: https://github.com/elastic/kibana/issues/60865
+  describe.skip('fleet_agents_enroll', () => {
     before(async () => {
       await esArchiver.loadIfNeeded('fleet/agents');
 
diff --git a/x-pack/test/api_integration/apis/fleet/index.js b/x-pack/test/api_integration/apis/fleet/index.js
index ec80b9aed4be0..df81b826132a9 100644
--- a/x-pack/test/api_integration/apis/fleet/index.js
+++ b/x-pack/test/api_integration/apis/fleet/index.js
@@ -5,9 +5,7 @@
  */
 
 export default function loadTests({ loadTestFile }) {
-  // Temporarily skipped to promote snapshot
-  // Re-enabled in https://github.com/elastic/kibana/pull/71727
-  describe.skip('Fleet Endpoints', () => {
+  describe('Fleet Endpoints', () => {
     loadTestFile(require.resolve('./setup'));
     loadTestFile(require.resolve('./delete_agent'));
     loadTestFile(require.resolve('./list_agent'));
diff --git a/x-pack/test/api_integration/apis/fleet/install.ts b/x-pack/test/api_integration/apis/fleet/install.ts
index 3a122463fae55..59b040e30fb48 100644
--- a/x-pack/test/api_integration/apis/fleet/install.ts
+++ b/x-pack/test/api_integration/apis/fleet/install.ts
@@ -6,11 +6,15 @@
 
 import expect from '@kbn/expect';
 import { FtrProviderContext } from '../../ftr_provider_context';
+import { setupIngest } from './agents/services';
 
-export default function ({ getService }: FtrProviderContext) {
+export default function (providerContext: FtrProviderContext) {
+  const { getService } = providerContext;
   const supertest = getService('supertest');
 
   describe('fleet_install', () => {
+    setupIngest(providerContext);
+
     it('should return a 400 if we try download an install script for a not supported OS', async () => {
       await supertest.get(`/api/ingest_manager/fleet/install/gameboy`).expect(400);
     });
diff --git a/x-pack/test/api_integration/apis/lists/create_exception_list_item.ts b/x-pack/test/api_integration/apis/lists/create_exception_list_item.ts
index 41f2a2dd2e3f5..bf35a6283aae5 100644
--- a/x-pack/test/api_integration/apis/lists/create_exception_list_item.ts
+++ b/x-pack/test/api_integration/apis/lists/create_exception_list_item.ts
@@ -6,6 +6,7 @@
 
 import expect from '@kbn/expect/expect.js';
 import { FtrProviderContext } from '../../ftr_provider_context';
+import { ENDPOINT_LIST_ID } from '../../../../plugins/lists/common';
 
 export default function ({ getService }: FtrProviderContext) {
   const esArchiver = getService('esArchiver');
@@ -20,7 +21,7 @@ export default function ({ getService }: FtrProviderContext) {
         namespace_type: 'agnostic',
         description: 'bad endpoint item for testing',
         name: 'bad endpoint item',
-        list_id: 'endpoint_list',
+        list_id: ENDPOINT_LIST_ID,
         type: 'simple',
         entries: [
           {
@@ -50,7 +51,7 @@ export default function ({ getService }: FtrProviderContext) {
         namespace_type: 'agnostic',
         description: 'bad endpoint item for testing',
         name: 'bad endpoint item',
-        list_id: 'endpoint_list',
+        list_id: ENDPOINT_LIST_ID,
         type: 'simple',
         entries: [
           {
diff --git a/x-pack/test/api_integration/apis/management/index_management/data_streams.ts b/x-pack/test/api_integration/apis/management/index_management/data_streams.ts
index 9f5c2a3de07bf..f8ddca374209b 100644
--- a/x-pack/test/api_integration/apis/management/index_management/data_streams.ts
+++ b/x-pack/test/api_integration/apis/management/index_management/data_streams.ts
@@ -51,8 +51,7 @@ export default function ({ getService }: FtrProviderContext) {
     await deleteComposableIndexTemplate(name);
   };
 
-  // Temporarily skipping tests until ES snapshot is updated
-  describe.skip('Data streams', function () {
+  describe('Data streams', function () {
     describe('Get', () => {
       const testDataStreamName = 'test-data-stream';
 
diff --git a/x-pack/test/detection_engine_api_integration/basic/tests/add_prepackaged_rules.ts b/x-pack/test/detection_engine_api_integration/basic/tests/add_prepackaged_rules.ts
index 242f906d0d197..3340ac49b2d2d 100644
--- a/x-pack/test/detection_engine_api_integration/basic/tests/add_prepackaged_rules.ts
+++ b/x-pack/test/detection_engine_api_integration/basic/tests/add_prepackaged_rules.ts
@@ -20,7 +20,8 @@ export default ({ getService }: FtrProviderContext): void => {
   const supertest = getService('supertest');
   const es = getService('es');
 
-  describe('add_prepackaged_rules', () => {
+  // FLAKY: https://github.com/elastic/kibana/issues/71867
+  describe.skip('add_prepackaged_rules', () => {
     describe('validation errors', () => {
       it('should give an error that the index must exist first if it does not exist before adding prepackaged rules', async () => {
         const { body } = await supertest
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/add_prepackaged_rules.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/add_prepackaged_rules.ts
index 5e0ce0b824323..7671b1bd49744 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/add_prepackaged_rules.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/add_prepackaged_rules.ts
@@ -20,7 +20,7 @@ export default ({ getService }: FtrProviderContext): void => {
   const supertest = getService('supertest');
   const es = getService('es');
 
-  // https://github.com/elastic/kibana/issues/71814
+  // FLAKY: https://github.com/elastic/kibana/issues/71814
   describe.skip('add_prepackaged_rules', () => {
     describe('validation errors', () => {
       it('should give an error that the index must exist first if it does not exist before adding prepackaged rules', async () => {
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_rules.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_rules.ts
index 73d39b600cf11..c763be1c2c3ec 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_rules.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_rules.ts
@@ -31,8 +31,7 @@ export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const es = getService('es');
 
-  // Preventing ES promotion: https://github.com/elastic/kibana/issues/71555
-  describe.skip('create_rules', () => {
+  describe('create_rules', () => {
     describe('validation errors', () => {
       it('should give an error that the index must exist first if it does not exist before creating a rule', async () => {
         const { body } = await supertest
diff --git a/x-pack/test/functional/apps/dashboard_mode/dashboard_empty_screen.js b/x-pack/test/functional/apps/dashboard_mode/dashboard_empty_screen.js
index ece326eabf869..c8a8f9653c11b 100644
--- a/x-pack/test/functional/apps/dashboard_mode/dashboard_empty_screen.js
+++ b/x-pack/test/functional/apps/dashboard_mode/dashboard_empty_screen.js
@@ -36,22 +36,19 @@ export default function ({ getPageObjects, getService }) {
       await PageObjects.visualize.clickLensWidget();
       await PageObjects.lens.goToTimeRange();
       await PageObjects.lens.configureDimension({
-        dimension:
-          '[data-test-subj="lnsXY_xDimensionPanel"] [data-test-subj="lns-empty-dimension"]',
+        dimension: 'lnsXY_xDimensionPanel > lns-empty-dimension',
         operation: 'date_histogram',
         field: '@timestamp',
       });
 
       await PageObjects.lens.configureDimension({
-        dimension:
-          '[data-test-subj="lnsXY_yDimensionPanel"] [data-test-subj="lns-empty-dimension"]',
+        dimension: 'lnsXY_yDimensionPanel > lns-empty-dimension',
         operation: 'avg',
         field: 'bytes',
       });
 
       await PageObjects.lens.configureDimension({
-        dimension:
-          '[data-test-subj="lnsXY_splitDimensionPanel"] [data-test-subj="lns-empty-dimension"]',
+        dimension: 'lnsXY_splitDimensionPanel > lns-empty-dimension',
         operation: 'terms',
         field: 'ip',
       });
diff --git a/x-pack/test/functional/apps/discover/async_scripted_fields.js b/x-pack/test/functional/apps/discover/async_scripted_fields.js
index 46848b1db0ef4..33a64e4f9cdd3 100644
--- a/x-pack/test/functional/apps/discover/async_scripted_fields.js
+++ b/x-pack/test/functional/apps/discover/async_scripted_fields.js
@@ -14,9 +14,9 @@ export default function ({ getService, getPageObjects }) {
   const esArchiver = getService('esArchiver');
   const log = getService('log');
   const testSubjects = getService('testSubjects');
-
   const PageObjects = getPageObjects(['common', 'settings', 'discover', 'timePicker']);
   const queryBar = getService('queryBar');
+  const security = getService('security');
 
   describe('async search with scripted fields', function () {
     this.tags(['skipFirefox']);
@@ -24,6 +24,7 @@ export default function ({ getService, getPageObjects }) {
     before(async function () {
       await esArchiver.load('kibana_scripted_fields_on_logstash');
       await esArchiver.loadIfNeeded('logstash_functional');
+      await security.testUser.setRoles(['test_logstash_reader', 'global_discover_read']);
       // changing the timepicker default here saves us from having to set it in Discover (~8s)
       await kibanaServer.uiSettings.update({
         'timepicker:timeDefaults':
@@ -36,6 +37,7 @@ export default function ({ getService, getPageObjects }) {
       await kibanaServer.uiSettings.update({});
       await esArchiver.unload('logstash_functional');
       await esArchiver.load('empty_kibana');
+      await security.testUser.restoreDefaults();
     });
 
     it('query should show failed shards pop up', async function () {
diff --git a/x-pack/test/functional/apps/lens/smokescreen.ts b/x-pack/test/functional/apps/lens/smokescreen.ts
index 97cdd081705a4..8bb5faf2469d7 100644
--- a/x-pack/test/functional/apps/lens/smokescreen.ts
+++ b/x-pack/test/functional/apps/lens/smokescreen.ts
@@ -111,9 +111,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await PageObjects.lens.clickVisualizeListItemTitle('Artistpreviouslyknownaslens');
       await PageObjects.lens.goToTimeRange();
       await assertExpectedMetric();
-      await PageObjects.lens.switchToVisualization('lnsChartSwitchPopover_lnsDatatable');
+      await PageObjects.lens.switchToVisualization('lnsDatatable');
       await assertExpectedTable();
-      await PageObjects.lens.switchToVisualization('lnsChartSwitchPopover_lnsMetric');
+      await PageObjects.lens.switchToVisualization('lnsMetric');
       await assertExpectedMetric();
     });
 
@@ -123,33 +123,29 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await PageObjects.lens.goToTimeRange();
 
       await PageObjects.lens.configureDimension({
-        dimension:
-          '[data-test-subj="lnsXY_xDimensionPanel"] [data-test-subj="lns-empty-dimension"]',
+        dimension: 'lnsXY_xDimensionPanel > lns-empty-dimension',
         operation: 'date_histogram',
         field: '@timestamp',
       });
 
       await PageObjects.lens.configureDimension({
-        dimension:
-          '[data-test-subj="lnsXY_yDimensionPanel"] [data-test-subj="lns-empty-dimension"]',
+        dimension: 'lnsXY_yDimensionPanel > lns-empty-dimension',
         operation: 'avg',
         field: 'bytes',
       });
 
       await PageObjects.lens.configureDimension({
-        dimension:
-          '[data-test-subj="lnsXY_splitDimensionPanel"] [data-test-subj="lns-empty-dimension"]',
+        dimension: 'lnsXY_splitDimensionPanel > lns-empty-dimension',
         operation: 'terms',
         field: '@message.raw',
       });
 
-      await PageObjects.lens.switchToVisualization('lnsChartSwitchPopover_lnsDatatable');
+      await PageObjects.lens.switchToVisualization('lnsDatatable');
       await PageObjects.lens.removeDimension('lnsDatatable_column');
-      await PageObjects.lens.switchToVisualization('lnsChartSwitchPopover_bar_stacked');
+      await PageObjects.lens.switchToVisualization('bar_stacked');
 
       await PageObjects.lens.configureDimension({
-        dimension:
-          '[data-test-subj="lnsXY_splitDimensionPanel"] [data-test-subj="lns-empty-dimension"]',
+        dimension: 'lnsXY_splitDimensionPanel > lns-empty-dimension',
         operation: 'terms',
         field: 'ip',
       });
diff --git a/x-pack/test/functional/apps/management/create_index_pattern_wizard.js b/x-pack/test/functional/apps/management/create_index_pattern_wizard.js
new file mode 100644
index 0000000000000..187124f9edc12
--- /dev/null
+++ b/x-pack/test/functional/apps/management/create_index_pattern_wizard.js
@@ -0,0 +1,54 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export default function ({ getService, getPageObjects }) {
+  const kibanaServer = getService('kibanaServer');
+  const es = getService('legacyEs');
+  const PageObjects = getPageObjects(['settings', 'common']);
+
+  describe('"Create Index Pattern" wizard', function () {
+    before(async function () {
+      // delete .kibana index and then wait for Kibana to re-create it
+      await kibanaServer.uiSettings.replace({});
+      await PageObjects.settings.navigateTo();
+      await PageObjects.settings.clickKibanaIndexPatterns();
+    });
+
+    describe('data streams', () => {
+      it('can be an index pattern', async () => {
+        await es.transport.request({
+          path: '/_index_template/generic-logs',
+          method: 'PUT',
+          body: {
+            index_patterns: ['logs-*', 'test_data_stream'],
+            template: {
+              mappings: {
+                properties: {
+                  '@timestamp': {
+                    type: 'date',
+                  },
+                },
+              },
+            },
+            data_stream: {},
+          },
+        });
+
+        await es.transport.request({
+          path: '/_data_stream/test_data_stream',
+          method: 'PUT',
+        });
+
+        await PageObjects.settings.createIndexPattern('test_data_stream', false);
+
+        await es.transport.request({
+          path: '/_data_stream/test_data_stream',
+          method: 'DELETE',
+        });
+      });
+    });
+  });
+}
diff --git a/x-pack/plugins/ml/public/application/components/ml_in_memory_table/index.ts b/x-pack/test/functional/apps/management/index.js
similarity index 56%
rename from x-pack/plugins/ml/public/application/components/ml_in_memory_table/index.ts
rename to x-pack/test/functional/apps/management/index.js
index bbd793696e005..19c68a2da9d9b 100644
--- a/x-pack/plugins/ml/public/application/components/ml_in_memory_table/index.ts
+++ b/x-pack/test/functional/apps/management/index.js
@@ -4,5 +4,10 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export { ProgressBar, mlInMemoryTableFactory } from './ml_in_memory_table';
-export * from './types';
+export default function ({ loadTestFile }) {
+  describe('management', function () {
+    this.tags(['ciGroup2']);
+
+    loadTestFile(require.resolve('./create_index_pattern_wizard'));
+  });
+}
diff --git a/x-pack/test/functional/apps/ml/anomaly_detection/advanced_job.ts b/x-pack/test/functional/apps/ml/anomaly_detection/advanced_job.ts
index 497078c4fd273..b574c67daf7a4 100644
--- a/x-pack/test/functional/apps/ml/anomaly_detection/advanced_job.ts
+++ b/x-pack/test/functional/apps/ml/anomaly_detection/advanced_job.ts
@@ -261,7 +261,7 @@ export default function ({ getService }: FtrProviderContext) {
         modelSizeStats: {
           result_type: 'model_size_stats',
           model_bytes_exceeded: '0.0 B',
-          total_by_field_count: '994',
+          // not checking total_by_field_count as the number of categories might change
           total_over_field_count: '0',
           total_partition_field_count: '2',
           bucket_allocation_failures_count: '0',
@@ -517,44 +517,18 @@ export default function ({ getService }: FtrProviderContext) {
             id: testData.jobId,
             description: testData.jobDescription,
             jobGroups: [...new Set(testData.jobGroups)].sort(),
-            recordCount: testData.expected.row.recordCount,
-            memoryStatus: testData.expected.row.memoryStatus,
-            jobState: testData.expected.row.jobState,
-            datafeedState: testData.expected.row.datafeedState,
-            latestTimestamp: testData.expected.row.latestTimestamp,
+            ...testData.expected.row,
           });
 
           await ml.jobTable.assertJobRowDetailsCounts(
             testData.jobId,
             {
               job_id: testData.jobId,
-              processed_record_count: testData.expected.counts.processed_record_count,
-              processed_field_count: testData.expected.counts.processed_field_count,
-              input_bytes: testData.expected.counts.input_bytes,
-              input_field_count: testData.expected.counts.input_field_count,
-              invalid_date_count: testData.expected.counts.invalid_date_count,
-              missing_field_count: testData.expected.counts.missing_field_count,
-              out_of_order_timestamp_count: testData.expected.counts.out_of_order_timestamp_count,
-              empty_bucket_count: testData.expected.counts.empty_bucket_count,
-              sparse_bucket_count: testData.expected.counts.sparse_bucket_count,
-              bucket_count: testData.expected.counts.bucket_count,
-              earliest_record_timestamp: testData.expected.counts.earliest_record_timestamp,
-              latest_record_timestamp: testData.expected.counts.latest_record_timestamp,
-              input_record_count: testData.expected.counts.input_record_count,
-              latest_bucket_timestamp: testData.expected.counts.latest_bucket_timestamp,
+              ...testData.expected.counts,
             },
             {
               job_id: testData.jobId,
-              result_type: testData.expected.modelSizeStats.result_type,
-              model_bytes_exceeded: testData.expected.modelSizeStats.model_bytes_exceeded,
-              total_by_field_count: testData.expected.modelSizeStats.total_by_field_count,
-              total_over_field_count: testData.expected.modelSizeStats.total_over_field_count,
-              total_partition_field_count:
-                testData.expected.modelSizeStats.total_partition_field_count,
-              bucket_allocation_failures_count:
-                testData.expected.modelSizeStats.bucket_allocation_failures_count,
-              memory_status: testData.expected.modelSizeStats.memory_status,
-              timestamp: testData.expected.modelSizeStats.timestamp,
+              ...testData.expected.modelSizeStats,
             }
           );
         });
@@ -780,44 +754,18 @@ export default function ({ getService }: FtrProviderContext) {
             id: testData.jobIdClone,
             description: testData.jobDescription,
             jobGroups: [...new Set(testData.jobGroupsClone)].sort(),
-            recordCount: testData.expected.row.recordCount,
-            memoryStatus: testData.expected.row.memoryStatus,
-            jobState: testData.expected.row.jobState,
-            datafeedState: testData.expected.row.datafeedState,
-            latestTimestamp: testData.expected.row.latestTimestamp,
+            ...testData.expected.row,
           });
 
           await ml.jobTable.assertJobRowDetailsCounts(
             testData.jobIdClone,
             {
               job_id: testData.jobIdClone,
-              processed_record_count: testData.expected.counts.processed_record_count,
-              processed_field_count: testData.expected.counts.processed_field_count,
-              input_bytes: testData.expected.counts.input_bytes,
-              input_field_count: testData.expected.counts.input_field_count,
-              invalid_date_count: testData.expected.counts.invalid_date_count,
-              missing_field_count: testData.expected.counts.missing_field_count,
-              out_of_order_timestamp_count: testData.expected.counts.out_of_order_timestamp_count,
-              empty_bucket_count: testData.expected.counts.empty_bucket_count,
-              sparse_bucket_count: testData.expected.counts.sparse_bucket_count,
-              bucket_count: testData.expected.counts.bucket_count,
-              earliest_record_timestamp: testData.expected.counts.earliest_record_timestamp,
-              latest_record_timestamp: testData.expected.counts.latest_record_timestamp,
-              input_record_count: testData.expected.counts.input_record_count,
-              latest_bucket_timestamp: testData.expected.counts.latest_bucket_timestamp,
+              ...testData.expected.counts,
             },
             {
               job_id: testData.jobIdClone,
-              result_type: testData.expected.modelSizeStats.result_type,
-              model_bytes_exceeded: testData.expected.modelSizeStats.model_bytes_exceeded,
-              total_by_field_count: testData.expected.modelSizeStats.total_by_field_count,
-              total_over_field_count: testData.expected.modelSizeStats.total_over_field_count,
-              total_partition_field_count:
-                testData.expected.modelSizeStats.total_partition_field_count,
-              bucket_allocation_failures_count:
-                testData.expected.modelSizeStats.bucket_allocation_failures_count,
-              memory_status: testData.expected.modelSizeStats.memory_status,
-              timestamp: testData.expected.modelSizeStats.timestamp,
+              ...testData.expected.modelSizeStats,
             }
           );
         });
diff --git a/x-pack/test/functional/apps/ml/anomaly_detection/categorization_job.ts b/x-pack/test/functional/apps/ml/anomaly_detection/categorization_job.ts
index 3461fe72c1556..0f8aad36ed372 100644
--- a/x-pack/test/functional/apps/ml/anomaly_detection/categorization_job.ts
+++ b/x-pack/test/functional/apps/ml/anomaly_detection/categorization_job.ts
@@ -64,7 +64,7 @@ export default function ({ getService }: FtrProviderContext) {
       job_id: expectedJobId,
       result_type: 'model_size_stats',
       model_bytes_exceeded: '0.0 B',
-      total_by_field_count: '30',
+      // not checking total_by_field_count as the number of categories might change
       total_over_field_count: '0',
       total_partition_field_count: '2',
       bucket_allocation_failures_count: '0',
diff --git a/x-pack/test/functional/apps/ml/anomaly_detection/date_nanos_job.ts b/x-pack/test/functional/apps/ml/anomaly_detection/date_nanos_job.ts
index 2cc393c3d986d..da56d96d3d59e 100644
--- a/x-pack/test/functional/apps/ml/anomaly_detection/date_nanos_job.ts
+++ b/x-pack/test/functional/apps/ml/anomaly_detection/date_nanos_job.ts
@@ -391,44 +391,18 @@ export default function ({ getService }: FtrProviderContext) {
             id: testData.jobId,
             description: testData.jobDescription,
             jobGroups: [...new Set(testData.jobGroups)].sort(),
-            recordCount: testData.expected.row.recordCount,
-            memoryStatus: testData.expected.row.memoryStatus,
-            jobState: testData.expected.row.jobState,
-            datafeedState: testData.expected.row.datafeedState,
-            latestTimestamp: testData.expected.row.latestTimestamp,
+            ...testData.expected.row,
           });
 
           await ml.jobTable.assertJobRowDetailsCounts(
             testData.jobId,
             {
               job_id: testData.jobId,
-              processed_record_count: testData.expected.counts.processed_record_count,
-              processed_field_count: testData.expected.counts.processed_field_count,
-              input_bytes: testData.expected.counts.input_bytes,
-              input_field_count: testData.expected.counts.input_field_count,
-              invalid_date_count: testData.expected.counts.invalid_date_count,
-              missing_field_count: testData.expected.counts.missing_field_count,
-              out_of_order_timestamp_count: testData.expected.counts.out_of_order_timestamp_count,
-              empty_bucket_count: testData.expected.counts.empty_bucket_count,
-              sparse_bucket_count: testData.expected.counts.sparse_bucket_count,
-              bucket_count: testData.expected.counts.bucket_count,
-              earliest_record_timestamp: testData.expected.counts.earliest_record_timestamp,
-              latest_record_timestamp: testData.expected.counts.latest_record_timestamp,
-              input_record_count: testData.expected.counts.input_record_count,
-              latest_bucket_timestamp: testData.expected.counts.latest_bucket_timestamp,
+              ...testData.expected.counts,
             },
             {
               job_id: testData.jobId,
-              result_type: testData.expected.modelSizeStats.result_type,
-              model_bytes_exceeded: testData.expected.modelSizeStats.model_bytes_exceeded,
-              total_by_field_count: testData.expected.modelSizeStats.total_by_field_count,
-              total_over_field_count: testData.expected.modelSizeStats.total_over_field_count,
-              total_partition_field_count:
-                testData.expected.modelSizeStats.total_partition_field_count,
-              bucket_allocation_failures_count:
-                testData.expected.modelSizeStats.bucket_allocation_failures_count,
-              memory_status: testData.expected.modelSizeStats.memory_status,
-              timestamp: testData.expected.modelSizeStats.timestamp,
+              ...testData.expected.modelSizeStats,
             }
           );
         });
diff --git a/x-pack/test/functional/apps/ml/anomaly_detection/saved_search_job.ts b/x-pack/test/functional/apps/ml/anomaly_detection/saved_search_job.ts
index 75f0f2682c198..c1276c158eb64 100644
--- a/x-pack/test/functional/apps/ml/anomaly_detection/saved_search_job.ts
+++ b/x-pack/test/functional/apps/ml/anomaly_detection/saved_search_job.ts
@@ -429,44 +429,18 @@ export default function ({ getService }: FtrProviderContext) {
             id: testData.jobId,
             description: testData.jobDescription,
             jobGroups: [...new Set(testData.jobGroups)].sort(),
-            recordCount: testData.expected.row.recordCount,
-            memoryStatus: testData.expected.row.memoryStatus,
-            jobState: testData.expected.row.jobState,
-            datafeedState: testData.expected.row.datafeedState,
-            latestTimestamp: testData.expected.row.latestTimestamp,
+            ...testData.expected.row,
           });
 
           await ml.jobTable.assertJobRowDetailsCounts(
             testData.jobId,
             {
               job_id: testData.jobId,
-              processed_record_count: testData.expected.counts.processed_record_count,
-              processed_field_count: testData.expected.counts.processed_field_count,
-              input_bytes: testData.expected.counts.input_bytes,
-              input_field_count: testData.expected.counts.input_field_count,
-              invalid_date_count: testData.expected.counts.invalid_date_count,
-              missing_field_count: testData.expected.counts.missing_field_count,
-              out_of_order_timestamp_count: testData.expected.counts.out_of_order_timestamp_count,
-              empty_bucket_count: testData.expected.counts.empty_bucket_count,
-              sparse_bucket_count: testData.expected.counts.sparse_bucket_count,
-              bucket_count: testData.expected.counts.bucket_count,
-              earliest_record_timestamp: testData.expected.counts.earliest_record_timestamp,
-              latest_record_timestamp: testData.expected.counts.latest_record_timestamp,
-              input_record_count: testData.expected.counts.input_record_count,
-              latest_bucket_timestamp: testData.expected.counts.latest_bucket_timestamp,
+              ...testData.expected.counts,
             },
             {
               job_id: testData.jobId,
-              result_type: testData.expected.modelSizeStats.result_type,
-              model_bytes_exceeded: testData.expected.modelSizeStats.model_bytes_exceeded,
-              total_by_field_count: testData.expected.modelSizeStats.total_by_field_count,
-              total_over_field_count: testData.expected.modelSizeStats.total_over_field_count,
-              total_partition_field_count:
-                testData.expected.modelSizeStats.total_partition_field_count,
-              bucket_allocation_failures_count:
-                testData.expected.modelSizeStats.bucket_allocation_failures_count,
-              memory_status: testData.expected.modelSizeStats.memory_status,
-              timestamp: testData.expected.modelSizeStats.timestamp,
+              ...testData.expected.modelSizeStats,
             }
           );
         });
diff --git a/x-pack/test/functional/apps/ml/data_frame_analytics/index.ts b/x-pack/test/functional/apps/ml/data_frame_analytics/index.ts
index a2ac236a5ea27..0202c8431ce34 100644
--- a/x-pack/test/functional/apps/ml/data_frame_analytics/index.ts
+++ b/x-pack/test/functional/apps/ml/data_frame_analytics/index.ts
@@ -6,8 +6,7 @@
 import { FtrProviderContext } from '../../../ftr_provider_context';
 
 export default function ({ loadTestFile }: FtrProviderContext) {
-  // flaky tests
-  describe.skip('data frame analytics', function () {
+  describe('data frame analytics', function () {
     this.tags(['mlqa', 'skipFirefox']);
 
     loadTestFile(require.resolve('./outlier_detection_creation'));
diff --git a/x-pack/test/functional/apps/monitoring/cluster/overview.js b/x-pack/test/functional/apps/monitoring/cluster/overview.js
index 94996d6ab40ab..0e608e9a055fa 100644
--- a/x-pack/test/functional/apps/monitoring/cluster/overview.js
+++ b/x-pack/test/functional/apps/monitoring/cluster/overview.js
@@ -10,8 +10,7 @@ import { getLifecycleMethods } from '../_get_lifecycle_methods';
 export default function ({ getService, getPageObjects }) {
   const overview = getService('monitoringClusterOverview');
 
-  // https://github.com/elastic/kibana/issues/71796
-  describe.skip('Cluster overview', () => {
+  describe('Cluster overview', () => {
     describe('for Green cluster with Gold license', () => {
       const { setup, tearDown } = getLifecycleMethods(getService, getPageObjects);
 
diff --git a/x-pack/test/functional/config.js b/x-pack/test/functional/config.js
index ad65f82d6dfe1..5c13e430ae2ca 100644
--- a/x-pack/test/functional/config.js
+++ b/x-pack/test/functional/config.js
@@ -57,6 +57,7 @@ export default async function ({ readConfigFile }) {
       resolve(__dirname, './apps/remote_clusters'),
       resolve(__dirname, './apps/transform'),
       resolve(__dirname, './apps/reporting_management'),
+      resolve(__dirname, './apps/management'),
 
       // This license_management file must be last because it is destructive.
       resolve(__dirname, './apps/license_management'),
diff --git a/x-pack/test/functional/page_objects/lens_page.ts b/x-pack/test/functional/page_objects/lens_page.ts
index ce621d4471d0f..4252c400ff1cd 100644
--- a/x-pack/test/functional/page_objects/lens_page.ts
+++ b/x-pack/test/functional/page_objects/lens_page.ts
@@ -74,16 +74,6 @@ export function LensPageProvider({ getService, getPageObjects }: FtrProviderCont
       return this.assertExpectedText(selector, (value) => value === expectedText);
     },
 
-    /**
-     * Uses the Lens visualization switcher to switch visualizations.
-     *
-     * @param dataTestSubj - the data-test-subj of the visualization to switch to
-     */
-    async switchToVisualization(dataTestSubj: string) {
-      await testSubjects.click('lnsChartSwitchPopover');
-      await testSubjects.click(dataTestSubj);
-    },
-
     /**
      * Clicks a visualize list item's title (in the visualize app).
      *
@@ -101,12 +91,12 @@ export function LensPageProvider({ getService, getPageObjects }: FtrProviderCont
      * @param opts.field - the desired field for the dimension
      */
     async configureDimension(opts: { dimension: string; operation: string; field: string }) {
-      await find.clickByCssSelector(opts.dimension);
+      await retry.try(async () => {
+        await testSubjects.click(opts.dimension);
+        await testSubjects.exists(`lns-indexPatternDimension-${opts.operation}`);
+      });
 
-      await find.clickByCssSelector(
-        `[data-test-subj="lns-indexPatternDimensionIncompatible-${opts.operation}"],
-          [data-test-subj="lns-indexPatternDimension-${opts.operation}"]`
-      );
+      await testSubjects.click(`lns-indexPatternDimension-${opts.operation}`);
 
       const target = await testSubjects.find('indexPattern-dimension-field');
       await comboBox.openOptionsList(target);
@@ -117,9 +107,7 @@ export function LensPageProvider({ getService, getPageObjects }: FtrProviderCont
      * Removes the dimension matching a specific test subject
      */
     async removeDimension(dimensionTestSubj: string) {
-      await find.clickByCssSelector(
-        `[data-test-subj="${dimensionTestSubj}"] [data-test-subj="indexPattern-dimensionPopover-remove"]`
-      );
+      await testSubjects.click(`${dimensionTestSubj} > indexPattern-dimensionPopover-remove`);
     },
 
     /**
@@ -158,5 +146,26 @@ export function LensPageProvider({ getService, getPageObjects }: FtrProviderCont
     getTitle() {
       return testSubjects.getVisibleText('lns_ChartTitle');
     },
+
+    /**
+     * Uses the Lens visualization switcher to switch visualizations.
+     *
+     * @param subVisualizationId - the ID of the sub-visualization to switch to, such as
+     * lnsDatatable or bar_stacked
+     */
+    async switchToVisualization(subVisualizationId: string) {
+      await this.openChartSwitchPopover();
+      await testSubjects.click(`lnsChartSwitchPopover_${subVisualizationId}`);
+    },
+
+    async openChartSwitchPopover() {
+      if (await testSubjects.exists('visTypeTitle')) {
+        return;
+      }
+      await retry.try(async () => {
+        await testSubjects.click('lnsChartSwitchPopover');
+        await testSubjects.existOrFail('visTypeTitle');
+      });
+    },
   });
 }
diff --git a/x-pack/test/functional/services/ml/data_frame_analytics_creation.ts b/x-pack/test/functional/services/ml/data_frame_analytics_creation.ts
index fc4aaa4fbf5fd..e36855a4e769e 100644
--- a/x-pack/test/functional/services/ml/data_frame_analytics_creation.ts
+++ b/x-pack/test/functional/services/ml/data_frame_analytics_creation.ts
@@ -181,7 +181,11 @@ export function MachineLearningDataFrameAnalyticsCreationProvider(
     },
 
     async assertIncludeFieldsSelectionExists() {
-      await testSubjects.existOrFail('mlAnalyticsCreateJobWizardIncludesSelect', { timeout: 5000 });
+      await testSubjects.existOrFail('mlAnalyticsCreateJobWizardIncludesTable', { timeout: 8000 });
+
+      await retry.tryForTime(8000, async () => {
+        await testSubjects.existOrFail('mlAnalyticsCreateJobWizardIncludesSelect');
+      });
     },
 
     // async assertIncludedFieldsSelection(expectedSelection: string[]) {
diff --git a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/connectors.ts b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/connectors.ts
index 810a80c3401ca..86e355988da0b 100644
--- a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/connectors.ts
+++ b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/connectors.ts
@@ -63,18 +63,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
     it('should edit a connector', async () => {
       const connectorName = generateUniqueKey();
       const updatedConnectorName = `${connectorName}updated`;
-
-      await pageObjects.triggersActionsUI.clickCreateConnectorButton();
-
-      await testSubjects.click('.slack-card');
-
-      await testSubjects.setValue('nameInput', connectorName);
-
-      await testSubjects.setValue('slackWebhookUrlInput', 'https://test');
-
-      await find.clickByCssSelector('[data-test-subj="saveNewActionButton"]:not(disabled)');
-
-      await pageObjects.common.closeToast();
+      await createConnector(connectorName);
 
       await pageObjects.triggersActionsUI.searchConnectors(connectorName);
 
@@ -103,19 +92,31 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
       ]);
     });
 
-    it('should delete a connector', async () => {
-      async function createConnector(connectorName: string) {
-        await pageObjects.triggersActionsUI.clickCreateConnectorButton();
+    it('should reset connector when canceling an edit', async () => {
+      const connectorName = generateUniqueKey();
+      await createConnector(connectorName);
+      await pageObjects.triggersActionsUI.searchConnectors(connectorName);
+
+      const searchResultsBeforeEdit = await pageObjects.triggersActionsUI.getConnectorsList();
+      expect(searchResultsBeforeEdit.length).to.eql(1);
 
-        await testSubjects.click('.slack-card');
+      await find.clickByCssSelector('[data-test-subj="connectorsTableCell-name"] button');
 
-        await testSubjects.setValue('nameInput', connectorName);
+      await testSubjects.setValue('nameInput', 'some test name to cancel');
+      await testSubjects.click('cancelSaveEditedConnectorButton');
 
-        await testSubjects.setValue('slackWebhookUrlInput', 'https://test');
+      await find.waitForDeletedByCssSelector('[data-test-subj="cancelSaveEditedConnectorButton"]');
 
-        await find.clickByCssSelector('[data-test-subj="saveNewActionButton"]:not(disabled)');
-        await pageObjects.common.closeToast();
-      }
+      await pageObjects.triggersActionsUI.searchConnectors(connectorName);
+
+      await find.clickByCssSelector('[data-test-subj="connectorsTableCell-name"] button');
+      const nameInputAfterCancel = await testSubjects.find('nameInput');
+      const textAfterCancel = await nameInputAfterCancel.getAttribute('value');
+      expect(textAfterCancel).to.eql(connectorName);
+      await testSubjects.click('euiFlyoutCloseButton');
+    });
+
+    it('should delete a connector', async () => {
       const connectorName = generateUniqueKey();
       await createConnector(connectorName);
 
@@ -141,19 +142,6 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
     });
 
     it('should bulk delete connectors', async () => {
-      async function createConnector(connectorName: string) {
-        await pageObjects.triggersActionsUI.clickCreateConnectorButton();
-
-        await testSubjects.click('.slack-card');
-
-        await testSubjects.setValue('nameInput', connectorName);
-
-        await testSubjects.setValue('slackWebhookUrlInput', 'https://test');
-
-        await find.clickByCssSelector('[data-test-subj="saveNewActionButton"]:not(disabled)');
-        await pageObjects.common.closeToast();
-      }
-
       const connectorName = generateUniqueKey();
       await createConnector(connectorName);
 
@@ -208,4 +196,17 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
       expect(await testSubjects.exists('saveEditedActionButton')).to.be(false);
     });
   });
+
+  async function createConnector(connectorName: string) {
+    await pageObjects.triggersActionsUI.clickCreateConnectorButton();
+
+    await testSubjects.click('.slack-card');
+
+    await testSubjects.setValue('nameInput', connectorName);
+
+    await testSubjects.setValue('slackWebhookUrlInput', 'https://test');
+
+    await find.clickByCssSelector('[data-test-subj="saveNewActionButton"]:not(disabled)');
+    await pageObjects.common.closeToast();
+  }
 };
diff --git a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/details.ts b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/details.ts
index 4c33a709d9bf9..d86d272c1da8c 100644
--- a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/details.ts
+++ b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/details.ts
@@ -19,8 +19,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
   const retry = getService('retry');
   const find = getService('find');
 
-  // Failing ES Promotion: https://github.com/elastic/kibana/issues/71559
-  describe.skip('Alert Details', function () {
+  describe('Alert Details', function () {
     describe('Header', function () {
       const testRunUuid = uuid.v4();
       before(async () => {
diff --git a/x-pack/test/ingest_manager_api_integration/apis/epm/install.ts b/x-pack/test/ingest_manager_api_integration/apis/epm/install.ts
index f2ca98ca39a0b..f73ba56c172c4 100644
--- a/x-pack/test/ingest_manager_api_integration/apis/epm/install.ts
+++ b/x-pack/test/ingest_manager_api_integration/apis/epm/install.ts
@@ -21,9 +21,7 @@ export default function ({ getService }: FtrProviderContext) {
   const mappingsPackage = 'overrides-0.1.0';
   const server = dockerServers.get('registry');
 
-  // Temporarily skipped to promote snapshot
-  // Re-enabled in https://github.com/elastic/kibana/pull/71727
-  describe.skip('installs packages that include settings and mappings overrides', async () => {
+  describe('installs packages that include settings and mappings overrides', async () => {
     after(async () => {
       if (server.enabled) {
         // remove the package just in case it being installed will affect other tests
diff --git a/x-pack/test/plugin_api_integration/plugins/event_log/server/plugin.ts b/x-pack/test/plugin_api_integration/plugins/event_log/server/plugin.ts
index 2ef932d19e9ee..4fb0511db2194 100644
--- a/x-pack/test/plugin_api_integration/plugins/event_log/server/plugin.ts
+++ b/x-pack/test/plugin_api_integration/plugins/event_log/server/plugin.ts
@@ -44,7 +44,7 @@ export class EventLogFixturePlugin
     core.savedObjects.registerType({
       name: 'event_log_test',
       hidden: false,
-      namespaceType: 'agnostic',
+      namespaceType: 'single',
       mappings: {
         properties: {},
       },
diff --git a/x-pack/test/plugin_api_integration/test_suites/event_log/public_api_integration.ts b/x-pack/test/plugin_api_integration/test_suites/event_log/public_api_integration.ts
index b6eacf2427643..eea18863e3be8 100644
--- a/x-pack/test/plugin_api_integration/test_suites/event_log/public_api_integration.ts
+++ b/x-pack/test/plugin_api_integration/test_suites/event_log/public_api_integration.ts
@@ -18,137 +18,162 @@ export default function ({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
   const log = getService('log');
   const retry = getService('retry');
+  const spacesService = getService('spaces');
+  const esArchiver = getService('esArchiver');
 
   describe('Event Log public API', () => {
-    it('should allow querying for events by Saved Object', async () => {
-      const id = uuid.v4();
+    before(async () => {
+      await spacesService.create({
+        id: 'namespace-a',
+        name: 'Space A',
+        disabledFeatures: [],
+      });
+    });
 
-      const expectedEvents = [fakeEvent(id), fakeEvent(id)];
+    after(async () => {
+      await esArchiver.unload('empty_kibana');
+    });
 
-      await logTestEvent(id, expectedEvents[0]);
-      await logTestEvent(id, expectedEvents[1]);
+    for (const namespace of [undefined, 'namespace-a']) {
+      const namespaceName = namespace === undefined ? 'default' : namespace;
 
-      await retry.try(async () => {
-        const {
-          body: { data, total },
-        } = await findEvents(id, {});
+      describe(`namespace: ${namespaceName}`, () => {
+        it('should allow querying for events by Saved Object', async () => {
+          const id = uuid.v4();
 
-        expect(data.length).to.be(2);
-        expect(total).to.be(2);
+          const expectedEvents = [fakeEvent(namespace, id), fakeEvent(namespace, id)];
 
-        assertEventsFromApiMatchCreatedEvents(data, expectedEvents);
-      });
-    });
+          await logTestEvent(namespace, id, expectedEvents[0]);
+          await logTestEvent(namespace, id, expectedEvents[1]);
 
-    it('should support pagination for events', async () => {
-      const id = uuid.v4();
+          await retry.try(async () => {
+            const {
+              body: { data, total },
+            } = await findEvents(namespace, id, {});
 
-      const expectedEvents = await logFakeEvents(id, 6);
+            expect(data.length).to.be(2);
+            expect(total).to.be(2);
 
-      await retry.try(async () => {
-        const {
-          body: { data: foundEvents },
-        } = await findEvents(id, {});
+            assertEventsFromApiMatchCreatedEvents(data, expectedEvents);
+          });
+        });
 
-        expect(foundEvents.length).to.be(6);
-      });
+        it('should support pagination for events', async () => {
+          const id = uuid.v4();
 
-      const [expectedFirstPage, expectedSecondPage] = chunk(expectedEvents, 3);
+          const expectedEvents = await logFakeEvents(namespace, id, 6);
 
-      const {
-        body: { data: firstPage },
-      } = await findEvents(id, { per_page: 3 });
+          await retry.try(async () => {
+            const {
+              body: { data: foundEvents },
+            } = await findEvents(namespace, id, {});
 
-      expect(firstPage.length).to.be(3);
-      assertEventsFromApiMatchCreatedEvents(firstPage, expectedFirstPage);
+            expect(foundEvents.length).to.be(6);
+          });
 
-      const {
-        body: { data: secondPage },
-      } = await findEvents(id, { per_page: 3, page: 2 });
+          const [expectedFirstPage, expectedSecondPage] = chunk(expectedEvents, 3);
 
-      expect(secondPage.length).to.be(3);
-      assertEventsFromApiMatchCreatedEvents(secondPage, expectedSecondPage);
-    });
+          const {
+            body: { data: firstPage },
+          } = await findEvents(namespace, id, { per_page: 3 });
 
-    it('should support sorting by event end', async () => {
-      const id = uuid.v4();
+          expect(firstPage.length).to.be(3);
+          assertEventsFromApiMatchCreatedEvents(firstPage, expectedFirstPage);
 
-      const expectedEvents = await logFakeEvents(id, 6);
+          const {
+            body: { data: secondPage },
+          } = await findEvents(namespace, id, { per_page: 3, page: 2 });
 
-      await retry.try(async () => {
-        const {
-          body: { data: foundEvents },
-        } = await findEvents(id, { sort_field: 'event.end', sort_order: 'desc' });
+          expect(secondPage.length).to.be(3);
+          assertEventsFromApiMatchCreatedEvents(secondPage, expectedSecondPage);
+        });
 
-        expect(foundEvents.length).to.be(expectedEvents.length);
-        assertEventsFromApiMatchCreatedEvents(foundEvents, expectedEvents.reverse());
-      });
-    });
+        it('should support sorting by event end', async () => {
+          const id = uuid.v4();
 
-    it('should support date ranges for events', async () => {
-      const id = uuid.v4();
+          const expectedEvents = await logFakeEvents(namespace, id, 6);
 
-      // write a document that shouldn't be found in the inclusive date range search
-      const firstEvent = fakeEvent(id);
-      await logTestEvent(id, firstEvent);
+          await retry.try(async () => {
+            const {
+              body: { data: foundEvents },
+            } = await findEvents(namespace, id, { sort_field: 'event.end', sort_order: 'desc' });
 
-      // wait a second, get the start time for the date range search
-      await delay(1000);
-      const start = new Date().toISOString();
+            expect(foundEvents.length).to.be(expectedEvents.length);
+            assertEventsFromApiMatchCreatedEvents(foundEvents, expectedEvents.reverse());
+          });
+        });
 
-      // write the documents that we should be found in the date range searches
-      const expectedEvents = await logFakeEvents(id, 6);
+        it('should support date ranges for events', async () => {
+          const id = uuid.v4();
 
-      // get the end time for the date range search
-      const end = new Date().toISOString();
+          // write a document that shouldn't be found in the inclusive date range search
+          const firstEvent = fakeEvent(namespace, id);
+          await logTestEvent(namespace, id, firstEvent);
 
-      // write a document that shouldn't be found in the inclusive date range search
-      await delay(1000);
-      const lastEvent = fakeEvent(id);
-      await logTestEvent(id, lastEvent);
+          // wait a second, get the start time for the date range search
+          await delay(1000);
+          const start = new Date().toISOString();
 
-      await retry.try(async () => {
-        const {
-          body: { data: foundEvents, total },
-        } = await findEvents(id, {});
+          // write the documents that we should be found in the date range searches
+          const expectedEvents = await logFakeEvents(namespace, id, 6);
 
-        expect(foundEvents.length).to.be(8);
-        expect(total).to.be(8);
-      });
+          // get the end time for the date range search
+          const end = new Date().toISOString();
 
-      const {
-        body: { data: eventsWithinRange },
-      } = await findEvents(id, { start, end });
+          // write a document that shouldn't be found in the inclusive date range search
+          await delay(1000);
+          const lastEvent = fakeEvent(namespace, id);
+          await logTestEvent(namespace, id, lastEvent);
 
-      expect(eventsWithinRange.length).to.be(expectedEvents.length);
-      assertEventsFromApiMatchCreatedEvents(eventsWithinRange, expectedEvents);
+          await retry.try(async () => {
+            const {
+              body: { data: foundEvents, total },
+            } = await findEvents(namespace, id, {});
 
-      const {
-        body: { data: eventsFrom },
-      } = await findEvents(id, { start });
+            expect(foundEvents.length).to.be(8);
+            expect(total).to.be(8);
+          });
 
-      expect(eventsFrom.length).to.be(expectedEvents.length + 1);
-      assertEventsFromApiMatchCreatedEvents(eventsFrom, [...expectedEvents, lastEvent]);
+          const {
+            body: { data: eventsWithinRange },
+          } = await findEvents(namespace, id, { start, end });
 
-      const {
-        body: { data: eventsUntil },
-      } = await findEvents(id, { end });
+          expect(eventsWithinRange.length).to.be(expectedEvents.length);
+          assertEventsFromApiMatchCreatedEvents(eventsWithinRange, expectedEvents);
 
-      expect(eventsUntil.length).to.be(expectedEvents.length + 1);
-      assertEventsFromApiMatchCreatedEvents(eventsUntil, [firstEvent, ...expectedEvents]);
-    });
+          const {
+            body: { data: eventsFrom },
+          } = await findEvents(namespace, id, { start });
+
+          expect(eventsFrom.length).to.be(expectedEvents.length + 1);
+          assertEventsFromApiMatchCreatedEvents(eventsFrom, [...expectedEvents, lastEvent]);
+
+          const {
+            body: { data: eventsUntil },
+          } = await findEvents(namespace, id, { end });
+
+          expect(eventsUntil.length).to.be(expectedEvents.length + 1);
+          assertEventsFromApiMatchCreatedEvents(eventsUntil, [firstEvent, ...expectedEvents]);
+        });
+      });
+    }
   });
 
-  async function findEvents(id: string, query: Record<string, any> = {}) {
-    const uri = `/api/event_log/event_log_test/${id}/_find${
+  async function findEvents(
+    namespace: string | undefined,
+    id: string,
+    query: Record<string, any> = {}
+  ) {
+    const urlPrefix = urlPrefixFromNamespace(namespace);
+    const url = `${urlPrefix}/api/event_log/event_log_test/${id}/_find${
       isEmpty(query)
         ? ''
         : `?${Object.entries(query)
             .map(([key, val]) => `${key}=${val}`)
             .join('&')}`
     }`;
-    log.debug(`calling ${uri}`);
-    return await supertest.get(uri).set('kbn-xsrf', 'foo').expect(200);
+    log.debug(`Finding Events for Saved Object with ${url}`);
+    return await supertest.get(url).set('kbn-xsrf', 'foo').expect(200);
   }
 
   function assertEventsFromApiMatchCreatedEvents(
@@ -169,16 +194,27 @@ export default function ({ getService }: FtrProviderContext) {
     }
   }
 
-  async function logTestEvent(id: string, event: IEvent) {
-    log.debug(`Logging Event for Saved Object ${id}`);
-    return await supertest
-      .post(`/api/log_event_fixture/${id}/_log`)
-      .set('kbn-xsrf', 'foo')
-      .send(event)
-      .expect(200);
+  async function logTestEvent(namespace: string | undefined, id: string, event: IEvent) {
+    const urlPrefix = urlPrefixFromNamespace(namespace);
+    const url = `${urlPrefix}/api/log_event_fixture/${id}/_log`;
+    log.debug(`Logging Event for Saved Object with ${url} - ${JSON.stringify(event)}`);
+    return await supertest.post(url).set('kbn-xsrf', 'foo').send(event).expect(200);
   }
 
-  function fakeEvent(id: string, overrides: Partial<IEvent> = {}): IEvent {
+  function fakeEvent(
+    namespace: string | undefined,
+    id: string,
+    overrides: Partial<IEvent> = {}
+  ): IEvent {
+    const savedObject: any = {
+      rel: 'primary',
+      type: 'event_log_test',
+      id,
+    };
+    if (namespace !== undefined) {
+      savedObject.namespace = namespace;
+    }
+
     return merge(
       {
         event: {
@@ -186,14 +222,7 @@ export default function ({ getService }: FtrProviderContext) {
           action: 'test',
         },
         kibana: {
-          saved_objects: [
-            {
-              rel: 'primary',
-              namespace: 'default',
-              type: 'event_log_test',
-              id,
-            },
-          ],
+          saved_objects: [savedObject],
         },
         message: `test ${moment().toISOString()}`,
       },
@@ -201,13 +230,22 @@ export default function ({ getService }: FtrProviderContext) {
     );
   }
 
-  async function logFakeEvents(savedObjectId: string, eventsToLog: number): Promise<IEvent[]> {
+  async function logFakeEvents(
+    namespace: string | undefined,
+    savedObjectId: string,
+    eventsToLog: number
+  ): Promise<IEvent[]> {
     const expectedEvents: IEvent[] = [];
     for (let index = 0; index < eventsToLog; index++) {
-      const event = fakeEvent(savedObjectId);
-      await logTestEvent(savedObjectId, event);
+      const event = fakeEvent(namespace, savedObjectId);
+      await logTestEvent(namespace, savedObjectId, event);
       expectedEvents.push(event);
     }
     return expectedEvents;
   }
 }
+
+function urlPrefixFromNamespace(namespace: string | undefined): string {
+  if (namespace === undefined) return '';
+  return `/s/${namespace}`;
+}
diff --git a/x-pack/test/plugin_api_integration/test_suites/task_manager/task_manager_integration.js b/x-pack/test/plugin_api_integration/test_suites/task_manager/task_manager_integration.js
index 6d8121f8bf45b..165e79fb311ea 100644
--- a/x-pack/test/plugin_api_integration/test_suites/task_manager/task_manager_integration.js
+++ b/x-pack/test/plugin_api_integration/test_suites/task_manager/task_manager_integration.js
@@ -28,7 +28,8 @@ export default function ({ getService }) {
   const testHistoryIndex = '.kibana_task_manager_test_result';
   const supertest = supertestAsPromised(url.format(config.get('servers.kibana')));
 
-  describe('scheduling and running tasks', () => {
+  // FLAKY: https://github.com/elastic/kibana/issues/71390
+  describe.skip('scheduling and running tasks', () => {
     beforeEach(
       async () => await supertest.delete('/api/sample_tasks').set('kbn-xsrf', 'xxx').expect(200)
     );
diff --git a/x-pack/test/security_solution_cypress/es_archives/custom_rule_with_timeline/data.json.gz b/x-pack/test/security_solution_cypress/es_archives/custom_rule_with_timeline/data.json.gz
deleted file mode 100644
index b3a94c77c1184..0000000000000
Binary files a/x-pack/test/security_solution_cypress/es_archives/custom_rule_with_timeline/data.json.gz and /dev/null differ
diff --git a/x-pack/test/security_solution_cypress/es_archives/custom_rule_with_timeline/mappings.json b/x-pack/test/security_solution_cypress/es_archives/custom_rule_with_timeline/mappings.json
deleted file mode 100644
index 01a768351e483..0000000000000
--- a/x-pack/test/security_solution_cypress/es_archives/custom_rule_with_timeline/mappings.json
+++ /dev/null
@@ -1,6418 +0,0 @@
-{
-  "type": "index",
-  "value": {
-    "aliases": {
-      ".kibana": {
-      }
-    },
-    "index": ".kibana_1",
-    "mappings": {
-      "_meta": {
-        "migrationMappingPropertyHashes": {
-          "action": "6e96ac5e648f57523879661ea72525b7",
-          "action_task_params": "a9d49f184ee89641044be0ca2950fa3a",
-          "alert": "7b44fba6773e37c806ce290ea9b7024e",
-          "apm-indices": "9bb9b2bf1fa636ed8619cbab5ce6a1dd",
-          "apm-telemetry": "3525d7c22c42bc80f5e6e9cb3f2b26a2",
-          "application_usage_totals": "3d1b76c39bfb2cc8296b024d73854724",
-          "application_usage_transactional": "43b8830d5d0df85a6823d290885fc9fd",
-          "canvas-element": "7390014e1091044523666d97247392fc",
-          "canvas-workpad": "b0a1706d356228dbdcb4a17e6b9eb231",
-          "canvas-workpad-template": "ae2673f678281e2c055d764b153e9715",
-          "cases": "32aa96a6d3855ddda53010ae2048ac22",
-          "cases-comments": "c2061fb929f585df57425102fa928b4b",
-          "cases-configure": "42711cbb311976c0687853f4c1354572",
-          "cases-user-actions": "32277330ec6b721abe3b846cfd939a71",
-          "config": "c63748b75f39d0c54de12d12c1ccbc20",
-          "dashboard": "d00f614b29a80360e1190193fd333bab",
-          "endpoint:exceptions-artifact": "053713a6b91811c7de078ead17384914",
-          "endpoint:exceptions-manifest": "67c28185da541c1404e7852d30498cd6",
-          "epm-packages": "04696e7dba1b9597f7d6ed78a4a76658",
-          "file-upload-telemetry": "0ed4d3e1983d1217a30982630897092e",
-          "fleet-agent-actions": "00fe5651ed2da16b7f8159bbf0f7d910",
-          "fleet-agent-events": "3231653fafe4ef3196fe3b32ab774bf2",
-          "fleet-agents": "578bbfa81650206927683ebde0c85409",
-          "fleet-enrollment-api-keys": "451e5c329b3ae9722dc7bc8f5921e05d",
-          "graph-workspace": "cd7ba1330e6682e9cc00b78850874be1",
-          "index-pattern": "66eccb05066c5a89924f48a9e9736499",
-          "infrastructure-ui-source": "2b2809653635caf490c93f090502d04c",
-          "ingest-agent-configs": "f1e09bc73462386a8c07e9d1997d0688",
-          "ingest-outputs": "87da6a0e27b3a61ad389fb7a7e2da293",
-          "ingest-package-configs": "48e8bd97e488008e21c0b5a2367b83ad",
-          "ingest_manager_settings": "c5b0749b4ab03c582efd4c14cb8f132c",
-          "inventory-view": "88fc7e12fd1b45b6f0787323ce4f18d2",
-          "kql-telemetry": "d12a98a6f19a2d273696597547e064ee",
-          "lens": "d33c68a69ff1e78c9888dedd2164ac22",
-          "lens-ui-telemetry": "509bfa5978586998e05f9e303c07a327",
-          "map": "4a05b35c3a3a58fbc72dd0202dc3487f",
-          "maps-telemetry": "5ef305b18111b77789afefbd36b66171",
-          "metrics-explorer-view": "a8df1d270ee48c969d22d23812d08187",
-          "migrationVersion": "4a1746014a75ade3a714e1db5763276f",
-          "ml-telemetry": "257fd1d4b4fdbb9cb4b8a3b27da201e9",
-          "namespace": "2f4316de49999235636386fe51dc06c1",
-          "namespaces": "2f4316de49999235636386fe51dc06c1",
-          "query": "11aaeb7f5f7fa5bb43f25e18ce26e7d9",
-          "references": "7997cf5a56cc02bdc9c93361bde732b0",
-          "sample-data-telemetry": "7d3cfeb915303c9641c59681967ffeb4",
-          "search": "181661168bbadd1eff5902361e2a0d5c",
-          "siem-detection-engine-rule-actions": "6569b288c169539db10cb262bf79de18",
-          "siem-detection-engine-rule-status": "ae783f41c6937db6b7a2ef5c93a9e9b0",
-          "siem-ui-timeline": "17ec409954864e592ceec0c5eae29ad9",
-          "siem-ui-timeline-note": "8874706eedc49059d4cf0f5094559084",
-          "siem-ui-timeline-pinned-event": "20638091112f0e14f0e443d512301c29",
-          "space": "c5ca8acafa0beaa4d08d014a97b6bc6b",
-          "telemetry": "36a616f7026dfa617d6655df850fe16d",
-          "timelion-sheet": "9a2a2748877c7a7b582fef201ab1d4cf",
-          "tsvb-validation-telemetry": "3a37ef6c8700ae6fc97d5c7da00e9215",
-          "type": "2f4316de49999235636386fe51dc06c1",
-          "ui-metric": "0d409297dc5ebe1e3a1da691c6ee32e3",
-          "updated_at": "00da57df13e94e9d98437d13ace4bfe0",
-          "upgrade-assistant-reindex-operation": "296a89039fc4260292be36b1b005d8f2",
-          "upgrade-assistant-telemetry": "56702cec857e0a9dacfb696655b4ff7b",
-          "uptime-dynamic-settings": "fcdb453a30092f022f2642db29523d80",
-          "url": "c7f66a0df8b1b52f17c28c4adb111105",
-          "visualization": "52d7a13ad68a150c4525b292d23e12cc"
-        }
-      },
-      "dynamic": "strict",
-      "properties": {
-        "action": {
-          "properties": {
-            "actionTypeId": {
-              "type": "keyword"
-            },
-            "config": {
-              "enabled": false,
-              "type": "object"
-            },
-            "name": {
-              "fields": {
-                "keyword": {
-                  "type": "keyword"
-                }
-              },
-              "type": "text"
-            },
-            "secrets": {
-              "type": "binary"
-            }
-          }
-        },
-        "action_task_params": {
-          "properties": {
-            "actionId": {
-              "type": "keyword"
-            },
-            "apiKey": {
-              "type": "binary"
-            },
-            "params": {
-              "enabled": false,
-              "type": "object"
-            }
-          }
-        },
-        "alert": {
-          "properties": {
-            "actions": {
-              "properties": {
-                "actionRef": {
-                  "type": "keyword"
-                },
-                "actionTypeId": {
-                  "type": "keyword"
-                },
-                "group": {
-                  "type": "keyword"
-                },
-                "params": {
-                  "enabled": false,
-                  "type": "object"
-                }
-              },
-              "type": "nested"
-            },
-            "alertTypeId": {
-              "type": "keyword"
-            },
-            "apiKey": {
-              "type": "binary"
-            },
-            "apiKeyOwner": {
-              "type": "keyword"
-            },
-            "consumer": {
-              "type": "keyword"
-            },
-            "createdAt": {
-              "type": "date"
-            },
-            "createdBy": {
-              "type": "keyword"
-            },
-            "enabled": {
-              "type": "boolean"
-            },
-            "muteAll": {
-              "type": "boolean"
-            },
-            "mutedInstanceIds": {
-              "type": "keyword"
-            },
-            "name": {
-              "fields": {
-                "keyword": {
-                  "type": "keyword"
-                }
-              },
-              "type": "text"
-            },
-            "params": {
-              "enabled": false,
-              "type": "object"
-            },
-            "schedule": {
-              "properties": {
-                "interval": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "scheduledTaskId": {
-              "type": "keyword"
-            },
-            "tags": {
-              "type": "keyword"
-            },
-            "throttle": {
-              "type": "keyword"
-            },
-            "updatedBy": {
-              "type": "keyword"
-            }
-          }
-        },
-        "apm-indices": {
-          "properties": {
-            "apm_oss": {
-              "properties": {
-                "errorIndices": {
-                  "type": "keyword"
-                },
-                "metricsIndices": {
-                  "type": "keyword"
-                },
-                "onboardingIndices": {
-                  "type": "keyword"
-                },
-                "sourcemapIndices": {
-                  "type": "keyword"
-                },
-                "spanIndices": {
-                  "type": "keyword"
-                },
-                "transactionIndices": {
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "apm-telemetry": {
-          "properties": {
-            "agents": {
-              "properties": {
-                "dotnet": {
-                  "properties": {
-                    "agent": {
-                      "properties": {
-                        "version": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        }
-                      }
-                    },
-                    "service": {
-                      "properties": {
-                        "framework": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        },
-                        "language": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        },
-                        "runtime": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "go": {
-                  "properties": {
-                    "agent": {
-                      "properties": {
-                        "version": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        }
-                      }
-                    },
-                    "service": {
-                      "properties": {
-                        "framework": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        },
-                        "language": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        },
-                        "runtime": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "java": {
-                  "properties": {
-                    "agent": {
-                      "properties": {
-                        "version": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        }
-                      }
-                    },
-                    "service": {
-                      "properties": {
-                        "framework": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        },
-                        "language": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        },
-                        "runtime": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "js-base": {
-                  "properties": {
-                    "agent": {
-                      "properties": {
-                        "version": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        }
-                      }
-                    },
-                    "service": {
-                      "properties": {
-                        "framework": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        },
-                        "language": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        },
-                        "runtime": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "nodejs": {
-                  "properties": {
-                    "agent": {
-                      "properties": {
-                        "version": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        }
-                      }
-                    },
-                    "service": {
-                      "properties": {
-                        "framework": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        },
-                        "language": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        },
-                        "runtime": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "python": {
-                  "properties": {
-                    "agent": {
-                      "properties": {
-                        "version": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        }
-                      }
-                    },
-                    "service": {
-                      "properties": {
-                        "framework": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        },
-                        "language": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        },
-                        "runtime": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "ruby": {
-                  "properties": {
-                    "agent": {
-                      "properties": {
-                        "version": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        }
-                      }
-                    },
-                    "service": {
-                      "properties": {
-                        "framework": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        },
-                        "language": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        },
-                        "runtime": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "rum-js": {
-                  "properties": {
-                    "agent": {
-                      "properties": {
-                        "version": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        }
-                      }
-                    },
-                    "service": {
-                      "properties": {
-                        "framework": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        },
-                        "language": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        },
-                        "runtime": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
-            "cardinality": {
-              "properties": {
-                "transaction": {
-                  "properties": {
-                    "name": {
-                      "properties": {
-                        "all_agents": {
-                          "properties": {
-                            "1d": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "rum": {
-                          "properties": {
-                            "1d": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "user_agent": {
-                  "properties": {
-                    "original": {
-                      "properties": {
-                        "all_agents": {
-                          "properties": {
-                            "1d": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "rum": {
-                          "properties": {
-                            "1d": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
-            "counts": {
-              "properties": {
-                "agent_configuration": {
-                  "properties": {
-                    "all": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "error": {
-                  "properties": {
-                    "1d": {
-                      "type": "long"
-                    },
-                    "all": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "max_error_groups_per_service": {
-                  "properties": {
-                    "1d": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "max_transaction_groups_per_service": {
-                  "properties": {
-                    "1d": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "metric": {
-                  "properties": {
-                    "1d": {
-                      "type": "long"
-                    },
-                    "all": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "onboarding": {
-                  "properties": {
-                    "1d": {
-                      "type": "long"
-                    },
-                    "all": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "services": {
-                  "properties": {
-                    "1d": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "sourcemap": {
-                  "properties": {
-                    "1d": {
-                      "type": "long"
-                    },
-                    "all": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "span": {
-                  "properties": {
-                    "1d": {
-                      "type": "long"
-                    },
-                    "all": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "traces": {
-                  "properties": {
-                    "1d": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "transaction": {
-                  "properties": {
-                    "1d": {
-                      "type": "long"
-                    },
-                    "all": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "has_any_services": {
-              "type": "boolean"
-            },
-            "indices": {
-              "properties": {
-                "all": {
-                  "properties": {
-                    "total": {
-                      "properties": {
-                        "docs": {
-                          "properties": {
-                            "count": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "store": {
-                          "properties": {
-                            "size_in_bytes": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "shards": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "integrations": {
-              "properties": {
-                "ml": {
-                  "properties": {
-                    "all_jobs_count": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "retainment": {
-              "properties": {
-                "error": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "metric": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "onboarding": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "span": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "transaction": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "services_per_agent": {
-              "properties": {
-                "dotnet": {
-                  "null_value": 0,
-                  "type": "long"
-                },
-                "go": {
-                  "null_value": 0,
-                  "type": "long"
-                },
-                "java": {
-                  "null_value": 0,
-                  "type": "long"
-                },
-                "js-base": {
-                  "null_value": 0,
-                  "type": "long"
-                },
-                "nodejs": {
-                  "null_value": 0,
-                  "type": "long"
-                },
-                "python": {
-                  "null_value": 0,
-                  "type": "long"
-                },
-                "ruby": {
-                  "null_value": 0,
-                  "type": "long"
-                },
-                "rum-js": {
-                  "null_value": 0,
-                  "type": "long"
-                }
-              }
-            },
-            "tasks": {
-              "properties": {
-                "agent_configuration": {
-                  "properties": {
-                    "took": {
-                      "properties": {
-                        "ms": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                },
-                "agents": {
-                  "properties": {
-                    "took": {
-                      "properties": {
-                        "ms": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                },
-                "cardinality": {
-                  "properties": {
-                    "took": {
-                      "properties": {
-                        "ms": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                },
-                "groupings": {
-                  "properties": {
-                    "took": {
-                      "properties": {
-                        "ms": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                },
-                "indices_stats": {
-                  "properties": {
-                    "took": {
-                      "properties": {
-                        "ms": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                },
-                "integrations": {
-                  "properties": {
-                    "took": {
-                      "properties": {
-                        "ms": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                },
-                "processor_events": {
-                  "properties": {
-                    "took": {
-                      "properties": {
-                        "ms": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                },
-                "services": {
-                  "properties": {
-                    "took": {
-                      "properties": {
-                        "ms": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                },
-                "versions": {
-                  "properties": {
-                    "took": {
-                      "properties": {
-                        "ms": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
-            "version": {
-              "properties": {
-                "apm_server": {
-                  "properties": {
-                    "major": {
-                      "type": "long"
-                    },
-                    "minor": {
-                      "type": "long"
-                    },
-                    "patch": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "application_usage_totals": {
-          "dynamic": "false",
-          "type": "object"
-        },
-        "application_usage_transactional": {
-          "dynamic": "false",
-          "properties": {
-            "timestamp": {
-              "type": "date"
-            }
-          }
-        },
-        "canvas-element": {
-          "dynamic": "false",
-          "properties": {
-            "@created": {
-              "type": "date"
-            },
-            "@timestamp": {
-              "type": "date"
-            },
-            "content": {
-              "type": "text"
-            },
-            "help": {
-              "type": "text"
-            },
-            "image": {
-              "type": "text"
-            },
-            "name": {
-              "fields": {
-                "keyword": {
-                  "type": "keyword"
-                }
-              },
-              "type": "text"
-            }
-          }
-        },
-        "canvas-workpad": {
-          "dynamic": "false",
-          "properties": {
-            "@created": {
-              "type": "date"
-            },
-            "@timestamp": {
-              "type": "date"
-            },
-            "name": {
-              "fields": {
-                "keyword": {
-                  "type": "keyword"
-                }
-              },
-              "type": "text"
-            }
-          }
-        },
-        "canvas-workpad-template": {
-          "dynamic": "false",
-          "properties": {
-            "help": {
-              "fields": {
-                "keyword": {
-                  "type": "keyword"
-                }
-              },
-              "type": "text"
-            },
-            "name": {
-              "fields": {
-                "keyword": {
-                  "type": "keyword"
-                }
-              },
-              "type": "text"
-            },
-            "tags": {
-              "fields": {
-                "keyword": {
-                  "type": "keyword"
-                }
-              },
-              "type": "text"
-            },
-            "template_key": {
-              "type": "keyword"
-            }
-          }
-        },
-        "cases": {
-          "properties": {
-            "closed_at": {
-              "type": "date"
-            },
-            "closed_by": {
-              "properties": {
-                "email": {
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "type": "keyword"
-                },
-                "username": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "connector_id": {
-              "type": "keyword"
-            },
-            "created_at": {
-              "type": "date"
-            },
-            "created_by": {
-              "properties": {
-                "email": {
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "type": "keyword"
-                },
-                "username": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "description": {
-              "type": "text"
-            },
-            "external_service": {
-              "properties": {
-                "connector_id": {
-                  "type": "keyword"
-                },
-                "connector_name": {
-                  "type": "keyword"
-                },
-                "external_id": {
-                  "type": "keyword"
-                },
-                "external_title": {
-                  "type": "text"
-                },
-                "external_url": {
-                  "type": "text"
-                },
-                "pushed_at": {
-                  "type": "date"
-                },
-                "pushed_by": {
-                  "properties": {
-                    "email": {
-                      "type": "keyword"
-                    },
-                    "full_name": {
-                      "type": "keyword"
-                    },
-                    "username": {
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "status": {
-              "type": "keyword"
-            },
-            "tags": {
-              "type": "keyword"
-            },
-            "title": {
-              "type": "keyword"
-            },
-            "updated_at": {
-              "type": "date"
-            },
-            "updated_by": {
-              "properties": {
-                "email": {
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "type": "keyword"
-                },
-                "username": {
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "cases-comments": {
-          "properties": {
-            "comment": {
-              "type": "text"
-            },
-            "created_at": {
-              "type": "date"
-            },
-            "created_by": {
-              "properties": {
-                "email": {
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "type": "keyword"
-                },
-                "username": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "pushed_at": {
-              "type": "date"
-            },
-            "pushed_by": {
-              "properties": {
-                "email": {
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "type": "keyword"
-                },
-                "username": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "updated_at": {
-              "type": "date"
-            },
-            "updated_by": {
-              "properties": {
-                "email": {
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "type": "keyword"
-                },
-                "username": {
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "cases-configure": {
-          "properties": {
-            "closure_type": {
-              "type": "keyword"
-            },
-            "connector_id": {
-              "type": "keyword"
-            },
-            "connector_name": {
-              "type": "keyword"
-            },
-            "created_at": {
-              "type": "date"
-            },
-            "created_by": {
-              "properties": {
-                "email": {
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "type": "keyword"
-                },
-                "username": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "updated_at": {
-              "type": "date"
-            },
-            "updated_by": {
-              "properties": {
-                "email": {
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "type": "keyword"
-                },
-                "username": {
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "cases-user-actions": {
-          "properties": {
-            "action": {
-              "type": "keyword"
-            },
-            "action_at": {
-              "type": "date"
-            },
-            "action_by": {
-              "properties": {
-                "email": {
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "type": "keyword"
-                },
-                "username": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "action_field": {
-              "type": "keyword"
-            },
-            "new_value": {
-              "type": "text"
-            },
-            "old_value": {
-              "type": "text"
-            }
-          }
-        },
-        "config": {
-          "dynamic": "false",
-          "properties": {
-            "buildNum": {
-              "type": "keyword"
-            }
-          }
-        },
-        "dashboard": {
-          "properties": {
-            "description": {
-              "type": "text"
-            },
-            "hits": {
-              "type": "integer"
-            },
-            "kibanaSavedObjectMeta": {
-              "properties": {
-                "searchSourceJSON": {
-                  "type": "text"
-                }
-              }
-            },
-            "optionsJSON": {
-              "type": "text"
-            },
-            "panelsJSON": {
-              "type": "text"
-            },
-            "refreshInterval": {
-              "properties": {
-                "display": {
-                  "type": "keyword"
-                },
-                "pause": {
-                  "type": "boolean"
-                },
-                "section": {
-                  "type": "integer"
-                },
-                "value": {
-                  "type": "integer"
-                }
-              }
-            },
-            "timeFrom": {
-              "type": "keyword"
-            },
-            "timeRestore": {
-              "type": "boolean"
-            },
-            "timeTo": {
-              "type": "keyword"
-            },
-            "title": {
-              "type": "text"
-            },
-            "version": {
-              "type": "integer"
-            }
-          }
-        },
-        "endpoint:exceptions-artifact": {
-          "properties": {
-            "body": {
-              "type": "binary"
-            },
-            "created": {
-              "index": false,
-              "type": "date"
-            },
-            "encoding": {
-              "index": false,
-              "type": "keyword"
-            },
-            "identifier": {
-              "type": "keyword"
-            },
-            "sha256": {
-              "type": "keyword"
-            },
-            "size": {
-              "index": false,
-              "type": "long"
-            }
-          }
-        },
-        "endpoint:exceptions-manifest": {
-          "properties": {
-            "created": {
-              "index": false,
-              "type": "date"
-            },
-            "ids": {
-              "index": false,
-              "type": "keyword"
-            }
-          }
-        },
-        "epm-packages": {
-          "properties": {
-            "es_index_patterns": {
-              "enabled": false,
-              "type": "object"
-            },
-            "installed": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                },
-                "type": {
-                  "type": "keyword"
-                }
-              },
-              "type": "nested"
-            },
-            "internal": {
-              "type": "boolean"
-            },
-            "name": {
-              "type": "keyword"
-            },
-            "removable": {
-              "type": "boolean"
-            },
-            "version": {
-              "type": "keyword"
-            }
-          }
-        },
-        "file-upload-telemetry": {
-          "properties": {
-            "filesUploadedTotalCount": {
-              "type": "long"
-            }
-          }
-        },
-        "fleet-agent-actions": {
-          "properties": {
-            "agent_id": {
-              "type": "keyword"
-            },
-            "created_at": {
-              "type": "date"
-            },
-            "data": {
-              "type": "binary"
-            },
-            "sent_at": {
-              "type": "date"
-            },
-            "type": {
-              "type": "keyword"
-            }
-          }
-        },
-        "fleet-agent-events": {
-          "properties": {
-            "action_id": {
-              "type": "keyword"
-            },
-            "agent_id": {
-              "type": "keyword"
-            },
-            "config_id": {
-              "type": "keyword"
-            },
-            "data": {
-              "type": "text"
-            },
-            "message": {
-              "type": "text"
-            },
-            "payload": {
-              "type": "text"
-            },
-            "stream_id": {
-              "type": "keyword"
-            },
-            "subtype": {
-              "type": "keyword"
-            },
-            "timestamp": {
-              "type": "date"
-            },
-            "type": {
-              "type": "keyword"
-            }
-          }
-        },
-        "fleet-agents": {
-          "properties": {
-            "access_api_key_id": {
-              "type": "keyword"
-            },
-            "active": {
-              "type": "boolean"
-            },
-            "config_id": {
-              "type": "keyword"
-            },
-            "config_newest_revision": {
-              "type": "integer"
-            },
-            "config_revision": {
-              "type": "integer"
-            },
-            "current_error_events": {
-              "index": false,
-              "type": "text"
-            },
-            "default_api_key": {
-              "type": "binary"
-            },
-            "default_api_key_id": {
-              "type": "keyword"
-            },
-            "enrolled_at": {
-              "type": "date"
-            },
-            "last_checkin": {
-              "type": "date"
-            },
-            "last_updated": {
-              "type": "date"
-            },
-            "local_metadata": {
-              "type": "flattened"
-            },
-            "packages": {
-              "type": "keyword"
-            },
-            "shared_id": {
-              "type": "keyword"
-            },
-            "type": {
-              "type": "keyword"
-            },
-            "updated_at": {
-              "type": "date"
-            },
-            "user_provided_metadata": {
-              "type": "flattened"
-            },
-            "version": {
-              "type": "keyword"
-            }
-          }
-        },
-        "fleet-enrollment-api-keys": {
-          "properties": {
-            "active": {
-              "type": "boolean"
-            },
-            "api_key": {
-              "type": "binary"
-            },
-            "api_key_id": {
-              "type": "keyword"
-            },
-            "config_id": {
-              "type": "keyword"
-            },
-            "created_at": {
-              "type": "date"
-            },
-            "expire_at": {
-              "type": "date"
-            },
-            "name": {
-              "type": "keyword"
-            },
-            "type": {
-              "type": "keyword"
-            },
-            "updated_at": {
-              "type": "date"
-            }
-          }
-        },
-        "graph-workspace": {
-          "properties": {
-            "description": {
-              "type": "text"
-            },
-            "kibanaSavedObjectMeta": {
-              "properties": {
-                "searchSourceJSON": {
-                  "type": "text"
-                }
-              }
-            },
-            "numLinks": {
-              "type": "integer"
-            },
-            "numVertices": {
-              "type": "integer"
-            },
-            "title": {
-              "type": "text"
-            },
-            "version": {
-              "type": "integer"
-            },
-            "wsState": {
-              "type": "text"
-            }
-          }
-        },
-        "index-pattern": {
-          "properties": {
-            "fieldFormatMap": {
-              "type": "text"
-            },
-            "fields": {
-              "type": "text"
-            },
-            "intervalName": {
-              "type": "keyword"
-            },
-            "notExpandable": {
-              "type": "boolean"
-            },
-            "sourceFilters": {
-              "type": "text"
-            },
-            "timeFieldName": {
-              "type": "keyword"
-            },
-            "title": {
-              "type": "text"
-            },
-            "type": {
-              "type": "keyword"
-            },
-            "typeMeta": {
-              "type": "keyword"
-            }
-          }
-        },
-        "infrastructure-ui-source": {
-          "properties": {
-            "description": {
-              "type": "text"
-            },
-            "fields": {
-              "properties": {
-                "container": {
-                  "type": "keyword"
-                },
-                "host": {
-                  "type": "keyword"
-                },
-                "pod": {
-                  "type": "keyword"
-                },
-                "tiebreaker": {
-                  "type": "keyword"
-                },
-                "timestamp": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "inventoryDefaultView": {
-              "type": "keyword"
-            },
-            "logAlias": {
-              "type": "keyword"
-            },
-            "logColumns": {
-              "properties": {
-                "fieldColumn": {
-                  "properties": {
-                    "field": {
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "messageColumn": {
-                  "properties": {
-                    "id": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "timestampColumn": {
-                  "properties": {
-                    "id": {
-                      "type": "keyword"
-                    }
-                  }
-                }
-              },
-              "type": "nested"
-            },
-            "metricAlias": {
-              "type": "keyword"
-            },
-            "metricsExplorerDefaultView": {
-              "type": "keyword"
-            },
-            "name": {
-              "type": "text"
-            }
-          }
-        },
-        "ingest-agent-configs": {
-          "properties": {
-            "description": {
-              "type": "text"
-            },
-            "id": {
-              "type": "keyword"
-            },
-            "is_default": {
-              "type": "boolean"
-            },
-            "monitoring_enabled": {
-              "index": false,
-              "type": "keyword"
-            },
-            "name": {
-              "type": "text"
-            },
-            "namespace": {
-              "type": "keyword"
-            },
-            "package_configs": {
-              "type": "keyword"
-            },
-            "revision": {
-              "type": "integer"
-            },
-            "status": {
-              "type": "keyword"
-            },
-            "updated_at": {
-              "type": "date"
-            },
-            "updated_by": {
-              "type": "keyword"
-            }
-          }
-        },
-        "ingest-outputs": {
-          "properties": {
-            "ca_sha256": {
-              "index": false,
-              "type": "keyword"
-            },
-            "config": {
-              "type": "flattened"
-            },
-            "fleet_enroll_password": {
-              "type": "binary"
-            },
-            "fleet_enroll_username": {
-              "type": "binary"
-            },
-            "hosts": {
-              "type": "keyword"
-            },
-            "is_default": {
-              "type": "boolean"
-            },
-            "name": {
-              "type": "keyword"
-            },
-            "type": {
-              "type": "keyword"
-            }
-          }
-        },
-        "ingest-package-configs": {
-          "properties": {
-            "config_id": {
-              "type": "keyword"
-            },
-            "created_at": {
-              "type": "date"
-            },
-            "created_by": {
-              "type": "keyword"
-            },
-            "description": {
-              "type": "text"
-            },
-            "enabled": {
-              "type": "boolean"
-            },
-            "inputs": {
-              "enabled": false,
-              "properties": {
-                "config": {
-                  "type": "flattened"
-                },
-                "enabled": {
-                  "type": "boolean"
-                },
-                "streams": {
-                  "properties": {
-                    "compiled_stream": {
-                      "type": "flattened"
-                    },
-                    "config": {
-                      "type": "flattened"
-                    },
-                    "dataset": {
-                      "properties": {
-                        "name": {
-                          "type": "keyword"
-                        },
-                        "type": {
-                          "type": "keyword"
-                        }
-                      }
-                    },
-                    "enabled": {
-                      "type": "boolean"
-                    },
-                    "id": {
-                      "type": "keyword"
-                    },
-                    "vars": {
-                      "type": "flattened"
-                    }
-                  },
-                  "type": "nested"
-                },
-                "type": {
-                  "type": "keyword"
-                },
-                "vars": {
-                  "type": "flattened"
-                }
-              },
-              "type": "nested"
-            },
-            "name": {
-              "type": "keyword"
-            },
-            "namespace": {
-              "type": "keyword"
-            },
-            "output_id": {
-              "type": "keyword"
-            },
-            "package": {
-              "properties": {
-                "name": {
-                  "type": "keyword"
-                },
-                "title": {
-                  "type": "keyword"
-                },
-                "version": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "revision": {
-              "type": "integer"
-            },
-            "updated_at": {
-              "type": "date"
-            },
-            "updated_by": {
-              "type": "keyword"
-            }
-          }
-        },
-        "ingest_manager_settings": {
-          "properties": {
-            "agent_auto_upgrade": {
-              "type": "keyword"
-            },
-            "kibana_ca_sha256": {
-              "type": "keyword"
-            },
-            "kibana_url": {
-              "type": "keyword"
-            },
-            "package_auto_upgrade": {
-              "type": "keyword"
-            }
-          }
-        },
-        "inventory-view": {
-          "properties": {
-            "accountId": {
-              "type": "keyword"
-            },
-            "autoBounds": {
-              "type": "boolean"
-            },
-            "autoReload": {
-              "type": "boolean"
-            },
-            "boundsOverride": {
-              "properties": {
-                "max": {
-                  "type": "integer"
-                },
-                "min": {
-                  "type": "integer"
-                }
-              }
-            },
-            "customMetrics": {
-              "properties": {
-                "aggregation": {
-                  "type": "keyword"
-                },
-                "field": {
-                  "type": "keyword"
-                },
-                "id": {
-                  "type": "keyword"
-                },
-                "label": {
-                  "type": "keyword"
-                },
-                "type": {
-                  "type": "keyword"
-                }
-              },
-              "type": "nested"
-            },
-            "customOptions": {
-              "properties": {
-                "field": {
-                  "type": "keyword"
-                },
-                "text": {
-                  "type": "keyword"
-                }
-              },
-              "type": "nested"
-            },
-            "filterQuery": {
-              "properties": {
-                "expression": {
-                  "type": "keyword"
-                },
-                "kind": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "groupBy": {
-              "properties": {
-                "field": {
-                  "type": "keyword"
-                },
-                "label": {
-                  "type": "keyword"
-                }
-              },
-              "type": "nested"
-            },
-            "legend": {
-              "properties": {
-                "palette": {
-                  "type": "keyword"
-                },
-                "reverseColors": {
-                  "type": "boolean"
-                },
-                "steps": {
-                  "type": "long"
-                }
-              }
-            },
-            "metric": {
-              "properties": {
-                "aggregation": {
-                  "type": "keyword"
-                },
-                "field": {
-                  "type": "keyword"
-                },
-                "id": {
-                  "type": "keyword"
-                },
-                "label": {
-                  "type": "keyword"
-                },
-                "type": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "type": "keyword"
-            },
-            "nodeType": {
-              "type": "keyword"
-            },
-            "region": {
-              "type": "keyword"
-            },
-            "sort": {
-              "properties": {
-                "by": {
-                  "type": "keyword"
-                },
-                "direction": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "time": {
-              "type": "long"
-            },
-            "view": {
-              "type": "keyword"
-            }
-          }
-        },
-        "kql-telemetry": {
-          "properties": {
-            "optInCount": {
-              "type": "long"
-            },
-            "optOutCount": {
-              "type": "long"
-            }
-          }
-        },
-        "lens": {
-          "properties": {
-            "description": {
-              "type": "text"
-            },
-            "expression": {
-              "index": false,
-              "type": "keyword"
-            },
-            "state": {
-              "type": "flattened"
-            },
-            "title": {
-              "type": "text"
-            },
-            "visualizationType": {
-              "type": "keyword"
-            }
-          }
-        },
-        "lens-ui-telemetry": {
-          "properties": {
-            "count": {
-              "type": "integer"
-            },
-            "date": {
-              "type": "date"
-            },
-            "name": {
-              "type": "keyword"
-            },
-            "type": {
-              "type": "keyword"
-            }
-          }
-        },
-        "map": {
-          "properties": {
-            "description": {
-              "type": "text"
-            },
-            "layerListJSON": {
-              "type": "text"
-            },
-            "mapStateJSON": {
-              "type": "text"
-            },
-            "title": {
-              "type": "text"
-            },
-            "uiStateJSON": {
-              "type": "text"
-            },
-            "version": {
-              "type": "integer"
-            }
-          }
-        },
-        "maps-telemetry": {
-          "enabled": false,
-          "type": "object"
-        },
-        "metrics-explorer-view": {
-          "properties": {
-            "chartOptions": {
-              "properties": {
-                "stack": {
-                  "type": "boolean"
-                },
-                "type": {
-                  "type": "keyword"
-                },
-                "yAxisMode": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "currentTimerange": {
-              "properties": {
-                "from": {
-                  "type": "keyword"
-                },
-                "interval": {
-                  "type": "keyword"
-                },
-                "to": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "type": "keyword"
-            },
-            "options": {
-              "properties": {
-                "aggregation": {
-                  "type": "keyword"
-                },
-                "filterQuery": {
-                  "type": "keyword"
-                },
-                "forceInterval": {
-                  "type": "boolean"
-                },
-                "groupBy": {
-                  "type": "keyword"
-                },
-                "limit": {
-                  "type": "integer"
-                },
-                "metrics": {
-                  "properties": {
-                    "aggregation": {
-                      "type": "keyword"
-                    },
-                    "color": {
-                      "type": "keyword"
-                    },
-                    "field": {
-                      "type": "keyword"
-                    },
-                    "label": {
-                      "type": "keyword"
-                    }
-                  },
-                  "type": "nested"
-                },
-                "source": {
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "migrationVersion": {
-          "dynamic": "true",
-          "properties": {
-            "alert": {
-              "fields": {
-                "keyword": {
-                  "ignore_above": 256,
-                  "type": "keyword"
-                }
-              },
-              "type": "text"
-            },
-            "config": {
-              "fields": {
-                "keyword": {
-                  "ignore_above": 256,
-                  "type": "keyword"
-                }
-              },
-              "type": "text"
-            },
-            "dashboard": {
-              "fields": {
-                "keyword": {
-                  "ignore_above": 256,
-                  "type": "keyword"
-                }
-              },
-              "type": "text"
-            },
-            "index-pattern": {
-              "fields": {
-                "keyword": {
-                  "ignore_above": 256,
-                  "type": "keyword"
-                }
-              },
-              "type": "text"
-            },
-            "map": {
-              "fields": {
-                "keyword": {
-                  "ignore_above": 256,
-                  "type": "keyword"
-                }
-              },
-              "type": "text"
-            },
-            "search": {
-              "fields": {
-                "keyword": {
-                  "ignore_above": 256,
-                  "type": "keyword"
-                }
-              },
-              "type": "text"
-            },
-            "space": {
-              "fields": {
-                "keyword": {
-                  "ignore_above": 256,
-                  "type": "keyword"
-                }
-              },
-              "type": "text"
-            },
-            "visualization": {
-              "fields": {
-                "keyword": {
-                  "ignore_above": 256,
-                  "type": "keyword"
-                }
-              },
-              "type": "text"
-            }
-          }
-        },
-        "ml-telemetry": {
-          "properties": {
-            "file_data_visualizer": {
-              "properties": {
-                "index_creation_count": {
-                  "type": "long"
-                }
-              }
-            }
-          }
-        },
-        "namespace": {
-          "type": "keyword"
-        },
-        "namespaces": {
-          "type": "keyword"
-        },
-        "query": {
-          "properties": {
-            "description": {
-              "type": "text"
-            },
-            "filters": {
-              "enabled": false,
-              "type": "object"
-            },
-            "query": {
-              "properties": {
-                "language": {
-                  "type": "keyword"
-                },
-                "query": {
-                  "index": false,
-                  "type": "keyword"
-                }
-              }
-            },
-            "timefilter": {
-              "enabled": false,
-              "type": "object"
-            },
-            "title": {
-              "type": "text"
-            }
-          }
-        },
-        "references": {
-          "properties": {
-            "id": {
-              "type": "keyword"
-            },
-            "name": {
-              "type": "keyword"
-            },
-            "type": {
-              "type": "keyword"
-            }
-          },
-          "type": "nested"
-        },
-        "sample-data-telemetry": {
-          "properties": {
-            "installCount": {
-              "type": "long"
-            },
-            "unInstallCount": {
-              "type": "long"
-            }
-          }
-        },
-        "search": {
-          "properties": {
-            "columns": {
-              "type": "keyword"
-            },
-            "description": {
-              "type": "text"
-            },
-            "hits": {
-              "type": "integer"
-            },
-            "kibanaSavedObjectMeta": {
-              "properties": {
-                "searchSourceJSON": {
-                  "type": "text"
-                }
-              }
-            },
-            "sort": {
-              "type": "keyword"
-            },
-            "title": {
-              "type": "text"
-            },
-            "version": {
-              "type": "integer"
-            }
-          }
-        },
-        "server": {
-          "dynamic": "strict",
-          "properties": {
-            "uuid": {
-              "type": "keyword"
-            }
-          }
-        },
-        "siem-detection-engine-rule-actions": {
-          "properties": {
-            "actions": {
-              "properties": {
-                "action_type_id": {
-                  "type": "keyword"
-                },
-                "group": {
-                  "type": "keyword"
-                },
-                "id": {
-                  "type": "keyword"
-                },
-                "params": {
-                  "enabled": false,
-                  "type": "object"
-                }
-              }
-            },
-            "alertThrottle": {
-              "type": "keyword"
-            },
-            "ruleAlertId": {
-              "type": "keyword"
-            },
-            "ruleThrottle": {
-              "type": "keyword"
-            }
-          }
-        },
-        "siem-detection-engine-rule-status": {
-          "properties": {
-            "alertId": {
-              "type": "keyword"
-            },
-            "bulkCreateTimeDurations": {
-              "type": "float"
-            },
-            "gap": {
-              "type": "text"
-            },
-            "lastFailureAt": {
-              "type": "date"
-            },
-            "lastFailureMessage": {
-              "type": "text"
-            },
-            "lastLookBackDate": {
-              "type": "date"
-            },
-            "lastSuccessAt": {
-              "type": "date"
-            },
-            "lastSuccessMessage": {
-              "type": "text"
-            },
-            "searchAfterTimeDurations": {
-              "type": "float"
-            },
-            "status": {
-              "type": "keyword"
-            },
-            "statusDate": {
-              "type": "date"
-            }
-          }
-        },
-        "siem-ui-timeline": {
-          "properties": {
-            "columns": {
-              "properties": {
-                "aggregatable": {
-                  "type": "boolean"
-                },
-                "category": {
-                  "type": "keyword"
-                },
-                "columnHeaderType": {
-                  "type": "keyword"
-                },
-                "description": {
-                  "type": "text"
-                },
-                "example": {
-                  "type": "text"
-                },
-                "id": {
-                  "type": "keyword"
-                },
-                "indexes": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "text"
-                },
-                "placeholder": {
-                  "type": "text"
-                },
-                "searchable": {
-                  "type": "boolean"
-                },
-                "type": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "created": {
-              "type": "date"
-            },
-            "createdBy": {
-              "type": "text"
-            },
-            "dataProviders": {
-              "properties": {
-                "and": {
-                  "properties": {
-                    "enabled": {
-                      "type": "boolean"
-                    },
-                    "excluded": {
-                      "type": "boolean"
-                    },
-                    "id": {
-                      "type": "keyword"
-                    },
-                    "kqlQuery": {
-                      "type": "text"
-                    },
-                    "name": {
-                      "type": "text"
-                    },
-                    "queryMatch": {
-                      "properties": {
-                        "displayField": {
-                          "type": "text"
-                        },
-                        "displayValue": {
-                          "type": "text"
-                        },
-                        "field": {
-                          "type": "text"
-                        },
-                        "operator": {
-                          "type": "text"
-                        },
-                        "value": {
-                          "type": "text"
-                        }
-                      }
-                    }
-                  }
-                },
-                "enabled": {
-                  "type": "boolean"
-                },
-                "excluded": {
-                  "type": "boolean"
-                },
-                "id": {
-                  "type": "keyword"
-                },
-                "kqlQuery": {
-                  "type": "text"
-                },
-                "name": {
-                  "type": "text"
-                },
-                "queryMatch": {
-                  "properties": {
-                    "displayField": {
-                      "type": "text"
-                    },
-                    "displayValue": {
-                      "type": "text"
-                    },
-                    "field": {
-                      "type": "text"
-                    },
-                    "operator": {
-                      "type": "text"
-                    },
-                    "value": {
-                      "type": "text"
-                    }
-                  }
-                }
-              }
-            },
-            "dateRange": {
-              "properties": {
-                "end": {
-                  "type": "date"
-                },
-                "start": {
-                  "type": "date"
-                }
-              }
-            },
-            "description": {
-              "type": "text"
-            },
-            "eventType": {
-              "type": "keyword"
-            },
-            "favorite": {
-              "properties": {
-                "favoriteDate": {
-                  "type": "date"
-                },
-                "fullName": {
-                  "type": "text"
-                },
-                "keySearch": {
-                  "type": "text"
-                },
-                "userName": {
-                  "type": "text"
-                }
-              }
-            },
-            "filters": {
-              "properties": {
-                "exists": {
-                  "type": "text"
-                },
-                "match_all": {
-                  "type": "text"
-                },
-                "meta": {
-                  "properties": {
-                    "alias": {
-                      "type": "text"
-                    },
-                    "controlledBy": {
-                      "type": "text"
-                    },
-                    "disabled": {
-                      "type": "boolean"
-                    },
-                    "field": {
-                      "type": "text"
-                    },
-                    "formattedValue": {
-                      "type": "text"
-                    },
-                    "index": {
-                      "type": "keyword"
-                    },
-                    "key": {
-                      "type": "keyword"
-                    },
-                    "negate": {
-                      "type": "boolean"
-                    },
-                    "params": {
-                      "type": "text"
-                    },
-                    "type": {
-                      "type": "keyword"
-                    },
-                    "value": {
-                      "type": "text"
-                    }
-                  }
-                },
-                "missing": {
-                  "type": "text"
-                },
-                "query": {
-                  "type": "text"
-                },
-                "range": {
-                  "type": "text"
-                },
-                "script": {
-                  "type": "text"
-                }
-              }
-            },
-            "kqlMode": {
-              "type": "keyword"
-            },
-            "kqlQuery": {
-              "properties": {
-                "filterQuery": {
-                  "properties": {
-                    "kuery": {
-                      "properties": {
-                        "expression": {
-                          "type": "text"
-                        },
-                        "kind": {
-                          "type": "keyword"
-                        }
-                      }
-                    },
-                    "serializedQuery": {
-                      "type": "text"
-                    }
-                  }
-                }
-              }
-            },
-            "savedQueryId": {
-              "type": "keyword"
-            },
-            "sort": {
-              "properties": {
-                "columnId": {
-                  "type": "keyword"
-                },
-                "sortDirection": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "status": {
-              "type": "keyword"
-            },
-            "templateTimelineId": {
-              "type": "text"
-            },
-            "templateTimelineVersion": {
-              "type": "integer"
-            },
-            "timelineType": {
-              "type": "keyword"
-            },
-            "title": {
-              "type": "text"
-            },
-            "updated": {
-              "type": "date"
-            },
-            "updatedBy": {
-              "type": "text"
-            }
-          }
-        },
-        "siem-ui-timeline-note": {
-          "properties": {
-            "created": {
-              "type": "date"
-            },
-            "createdBy": {
-              "type": "text"
-            },
-            "eventId": {
-              "type": "keyword"
-            },
-            "note": {
-              "type": "text"
-            },
-            "timelineId": {
-              "type": "keyword"
-            },
-            "updated": {
-              "type": "date"
-            },
-            "updatedBy": {
-              "type": "text"
-            }
-          }
-        },
-        "siem-ui-timeline-pinned-event": {
-          "properties": {
-            "created": {
-              "type": "date"
-            },
-            "createdBy": {
-              "type": "text"
-            },
-            "eventId": {
-              "type": "keyword"
-            },
-            "timelineId": {
-              "type": "keyword"
-            },
-            "updated": {
-              "type": "date"
-            },
-            "updatedBy": {
-              "type": "text"
-            }
-          }
-        },
-        "space": {
-          "properties": {
-            "_reserved": {
-              "type": "boolean"
-            },
-            "color": {
-              "type": "keyword"
-            },
-            "description": {
-              "type": "text"
-            },
-            "disabledFeatures": {
-              "type": "keyword"
-            },
-            "imageUrl": {
-              "index": false,
-              "type": "text"
-            },
-            "initials": {
-              "type": "keyword"
-            },
-            "name": {
-              "fields": {
-                "keyword": {
-                  "ignore_above": 2048,
-                  "type": "keyword"
-                }
-              },
-              "type": "text"
-            }
-          }
-        },
-        "spaceId": {
-          "type": "keyword"
-        },
-        "telemetry": {
-          "properties": {
-            "allowChangingOptInStatus": {
-              "type": "boolean"
-            },
-            "enabled": {
-              "type": "boolean"
-            },
-            "lastReported": {
-              "type": "date"
-            },
-            "lastVersionChecked": {
-              "type": "keyword"
-            },
-            "reportFailureCount": {
-              "type": "integer"
-            },
-            "reportFailureVersion": {
-              "type": "keyword"
-            },
-            "sendUsageFrom": {
-              "type": "keyword"
-            },
-            "userHasSeenNotice": {
-              "type": "boolean"
-            }
-          }
-        },
-        "timelion-sheet": {
-          "properties": {
-            "description": {
-              "type": "text"
-            },
-            "hits": {
-              "type": "integer"
-            },
-            "kibanaSavedObjectMeta": {
-              "properties": {
-                "searchSourceJSON": {
-                  "type": "text"
-                }
-              }
-            },
-            "timelion_chart_height": {
-              "type": "integer"
-            },
-            "timelion_columns": {
-              "type": "integer"
-            },
-            "timelion_interval": {
-              "type": "keyword"
-            },
-            "timelion_other_interval": {
-              "type": "keyword"
-            },
-            "timelion_rows": {
-              "type": "integer"
-            },
-            "timelion_sheet": {
-              "type": "text"
-            },
-            "title": {
-              "type": "text"
-            },
-            "version": {
-              "type": "integer"
-            }
-          }
-        },
-        "tsvb-validation-telemetry": {
-          "properties": {
-            "failedRequests": {
-              "type": "long"
-            }
-          }
-        },
-        "type": {
-          "type": "keyword"
-        },
-        "ui-metric": {
-          "properties": {
-            "count": {
-              "type": "integer"
-            }
-          }
-        },
-        "updated_at": {
-          "type": "date"
-        },
-        "upgrade-assistant-reindex-operation": {
-          "properties": {
-            "errorMessage": {
-              "type": "keyword"
-            },
-            "indexName": {
-              "type": "keyword"
-            },
-            "lastCompletedStep": {
-              "type": "integer"
-            },
-            "locked": {
-              "type": "date"
-            },
-            "newIndexName": {
-              "type": "keyword"
-            },
-            "reindexOptions": {
-              "properties": {
-                "openAndClose": {
-                  "type": "boolean"
-                },
-                "queueSettings": {
-                  "properties": {
-                    "queuedAt": {
-                      "type": "long"
-                    },
-                    "startedAt": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "reindexTaskId": {
-              "type": "keyword"
-            },
-            "reindexTaskPercComplete": {
-              "type": "float"
-            },
-            "runningReindexCount": {
-              "type": "integer"
-            },
-            "status": {
-              "type": "integer"
-            }
-          }
-        },
-        "upgrade-assistant-telemetry": {
-          "properties": {
-            "features": {
-              "properties": {
-                "deprecation_logging": {
-                  "properties": {
-                    "enabled": {
-                      "null_value": true,
-                      "type": "boolean"
-                    }
-                  }
-                }
-              }
-            },
-            "ui_open": {
-              "properties": {
-                "cluster": {
-                  "null_value": 0,
-                  "type": "long"
-                },
-                "indices": {
-                  "null_value": 0,
-                  "type": "long"
-                },
-                "overview": {
-                  "null_value": 0,
-                  "type": "long"
-                }
-              }
-            },
-            "ui_reindex": {
-              "properties": {
-                "close": {
-                  "null_value": 0,
-                  "type": "long"
-                },
-                "open": {
-                  "null_value": 0,
-                  "type": "long"
-                },
-                "start": {
-                  "null_value": 0,
-                  "type": "long"
-                },
-                "stop": {
-                  "null_value": 0,
-                  "type": "long"
-                }
-              }
-            }
-          }
-        },
-        "uptime-dynamic-settings": {
-          "properties": {
-            "certAgeThreshold": {
-              "type": "long"
-            },
-            "certExpirationThreshold": {
-              "type": "long"
-            },
-            "heartbeatIndices": {
-              "type": "keyword"
-            }
-          }
-        },
-        "url": {
-          "properties": {
-            "accessCount": {
-              "type": "long"
-            },
-            "accessDate": {
-              "type": "date"
-            },
-            "createDate": {
-              "type": "date"
-            },
-            "url": {
-              "fields": {
-                "keyword": {
-                  "ignore_above": 2048,
-                  "type": "keyword"
-                }
-              },
-              "type": "text"
-            }
-          }
-        },
-        "visualization": {
-          "properties": {
-            "description": {
-              "type": "text"
-            },
-            "kibanaSavedObjectMeta": {
-              "properties": {
-                "searchSourceJSON": {
-                  "type": "text"
-                }
-              }
-            },
-            "savedSearchRefName": {
-              "type": "keyword"
-            },
-            "title": {
-              "type": "text"
-            },
-            "uiStateJSON": {
-              "type": "text"
-            },
-            "version": {
-              "type": "integer"
-            },
-            "visState": {
-              "type": "text"
-            }
-          }
-        }
-      }
-    },
-    "settings": {
-      "index": {
-        "auto_expand_replicas": "0-1",
-        "number_of_replicas": "0",
-        "number_of_shards": "1"
-      }
-    }
-  }
-}
-
-{
-  "type": "index",
-  "value": {
-    "aliases": {
-      ".siem-signals-default": {
-        "is_write_index": true
-      }
-    },
-    "index": ".siem-signals-default-000001",
-    "mappings": {
-      "dynamic": "false",
-      "properties": {
-        "@timestamp": {
-          "type": "date"
-        },
-        "agent": {
-          "properties": {
-            "ephemeral_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "as": {
-          "properties": {
-            "number": {
-              "type": "long"
-            },
-            "organization": {
-              "properties": {
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "client": {
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "cloud": {
-          "properties": {
-            "account": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "availability_zone": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "instance": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "machine": {
-              "properties": {
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "provider": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "code_signature": {
-          "properties": {
-            "exists": {
-              "type": "boolean"
-            },
-            "status": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "subject_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "trusted": {
-              "type": "boolean"
-            },
-            "valid": {
-              "type": "boolean"
-            }
-          }
-        },
-        "container": {
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "image": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "tag": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "labels": {
-              "type": "object"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "runtime": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "destination": {
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "dll": {
-          "properties": {
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "dns": {
-          "properties": {
-            "answers": {
-              "properties": {
-                "class": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "data": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ttl": {
-                  "type": "long"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "header_flags": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "op_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "question": {
-              "properties": {
-                "class": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "registered_domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subdomain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "top_level_domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "resolved_ip": {
-              "type": "ip"
-            },
-            "response_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "ecs": {
-          "properties": {
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "error": {
-          "properties": {
-            "code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "message": {
-              "norms": false,
-              "type": "text"
-            },
-            "stack_trace": {
-              "doc_values": false,
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "index": false,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "event": {
-          "properties": {
-            "action": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "created": {
-              "type": "date"
-            },
-            "dataset": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "duration": {
-              "type": "long"
-            },
-            "end": {
-              "type": "date"
-            },
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ingested": {
-              "type": "date"
-            },
-            "kind": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "module": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "doc_values": false,
-              "ignore_above": 1024,
-              "index": false,
-              "type": "keyword"
-            },
-            "outcome": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "provider": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "risk_score": {
-              "type": "float"
-            },
-            "risk_score_norm": {
-              "type": "float"
-            },
-            "sequence": {
-              "type": "long"
-            },
-            "severity": {
-              "type": "long"
-            },
-            "start": {
-              "type": "date"
-            },
-            "timezone": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "url": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "file": {
-          "properties": {
-            "accessed": {
-              "type": "date"
-            },
-            "attributes": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "created": {
-              "type": "date"
-            },
-            "ctime": {
-              "type": "date"
-            },
-            "device": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "directory": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "drive_letter": {
-              "ignore_above": 1,
-              "type": "keyword"
-            },
-            "extension": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "gid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "group": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "inode": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mime_type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mode": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mtime": {
-              "type": "date"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "owner": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "size": {
-              "type": "long"
-            },
-            "target_path": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "geo": {
-          "properties": {
-            "city_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "continent_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "country_iso_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "country_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "location": {
-              "type": "geo_point"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region_iso_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "group": {
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "hash": {
-          "properties": {
-            "md5": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha1": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha256": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha512": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "host": {
-          "properties": {
-            "architecture": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uptime": {
-              "type": "long"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "http": {
-          "properties": {
-            "request": {
-              "properties": {
-                "body": {
-                  "properties": {
-                    "bytes": {
-                      "type": "long"
-                    },
-                    "content": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "bytes": {
-                  "type": "long"
-                },
-                "method": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "referrer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "response": {
-              "properties": {
-                "body": {
-                  "properties": {
-                    "bytes": {
-                      "type": "long"
-                    },
-                    "content": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "bytes": {
-                  "type": "long"
-                },
-                "status_code": {
-                  "type": "long"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "interface": {
-          "properties": {
-            "alias": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "labels": {
-          "type": "object"
-        },
-        "log": {
-          "properties": {
-            "level": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "logger": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "origin": {
-              "properties": {
-                "file": {
-                  "properties": {
-                    "line": {
-                      "type": "integer"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "original": {
-              "doc_values": false,
-              "ignore_above": 1024,
-              "index": false,
-              "type": "keyword"
-            },
-            "syslog": {
-              "properties": {
-                "facility": {
-                  "properties": {
-                    "code": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "priority": {
-                  "type": "long"
-                },
-                "severity": {
-                  "properties": {
-                    "code": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "message": {
-          "norms": false,
-          "type": "text"
-        },
-        "network": {
-          "properties": {
-            "application": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "community_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "direction": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "forwarded_ip": {
-              "type": "ip"
-            },
-            "iana_number": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "inner": {
-              "properties": {
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "packets": {
-              "type": "long"
-            },
-            "protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "transport": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "vlan": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "observer": {
-          "properties": {
-            "egress": {
-              "properties": {
-                "interface": {
-                  "properties": {
-                    "alias": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "zone": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ingress": {
-              "properties": {
-                "interface": {
-                  "properties": {
-                    "alias": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "zone": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "product": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "serial_number": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "vendor": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "organization": {
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "os": {
-          "properties": {
-            "family": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "kernel": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "platform": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "package": {
-          "properties": {
-            "architecture": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "build_version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "checksum": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "install_scope": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "installed": {
-              "type": "date"
-            },
-            "license": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "size": {
-              "type": "long"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "pe": {
-          "properties": {
-            "company": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "file_version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original_file_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "product": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "process": {
-          "properties": {
-            "args": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "args_count": {
-              "type": "long"
-            },
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "command_line": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "entity_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "executable": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "exit_code": {
-              "type": "long"
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "parent": {
-              "properties": {
-                "args": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "args_count": {
-                  "type": "long"
-                },
-                "code_signature": {
-                  "properties": {
-                    "exists": {
-                      "type": "boolean"
-                    },
-                    "status": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "subject_name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "trusted": {
-                      "type": "boolean"
-                    },
-                    "valid": {
-                      "type": "boolean"
-                    }
-                  }
-                },
-                "command_line": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "entity_id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "executable": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "exit_code": {
-                  "type": "long"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha512": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "pgid": {
-                  "type": "long"
-                },
-                "pid": {
-                  "type": "long"
-                },
-                "ppid": {
-                  "type": "long"
-                },
-                "start": {
-                  "type": "date"
-                },
-                "thread": {
-                  "properties": {
-                    "id": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "title": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "uptime": {
-                  "type": "long"
-                },
-                "working_directory": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pgid": {
-              "type": "long"
-            },
-            "pid": {
-              "type": "long"
-            },
-            "ppid": {
-              "type": "long"
-            },
-            "start": {
-              "type": "date"
-            },
-            "thread": {
-              "properties": {
-                "id": {
-                  "type": "long"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "title": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uptime": {
-              "type": "long"
-            },
-            "working_directory": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "registry": {
-          "properties": {
-            "data": {
-              "properties": {
-                "bytes": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "strings": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hive": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "key": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "value": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "related": {
-          "properties": {
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "user": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "rule": {
-          "properties": {
-            "author": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "license": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ruleset": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uuid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "server": {
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "service": {
-          "properties": {
-            "ephemeral_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "node": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "state": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "signal": {
-          "properties": {
-            "ancestors": {
-              "properties": {
-                "depth": {
-                  "type": "long"
-                },
-                "id": {
-                  "type": "keyword"
-                },
-                "rule": {
-                  "type": "keyword"
-                },
-                "type": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "original_event": {
-              "properties": {
-                "action": {
-                  "type": "keyword"
-                },
-                "category": {
-                  "type": "keyword"
-                },
-                "code": {
-                  "type": "keyword"
-                },
-                "created": {
-                  "type": "date"
-                },
-                "dataset": {
-                  "type": "keyword"
-                },
-                "duration": {
-                  "type": "long"
-                },
-                "end": {
-                  "type": "date"
-                },
-                "hash": {
-                  "type": "keyword"
-                },
-                "id": {
-                  "type": "keyword"
-                },
-                "kind": {
-                  "type": "keyword"
-                },
-                "module": {
-                  "type": "keyword"
-                },
-                "original": {
-                  "doc_values": false,
-                  "index": false,
-                  "type": "keyword"
-                },
-                "outcome": {
-                  "type": "keyword"
-                },
-                "provider": {
-                  "type": "keyword"
-                },
-                "risk_score": {
-                  "type": "float"
-                },
-                "risk_score_norm": {
-                  "type": "float"
-                },
-                "sequence": {
-                  "type": "long"
-                },
-                "severity": {
-                  "type": "long"
-                },
-                "start": {
-                  "type": "date"
-                },
-                "timezone": {
-                  "type": "keyword"
-                },
-                "type": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "original_time": {
-              "type": "date"
-            },
-            "parent": {
-              "properties": {
-                "depth": {
-                  "type": "long"
-                },
-                "id": {
-                  "type": "keyword"
-                },
-                "index": {
-                  "type": "keyword"
-                },
-                "rule": {
-                  "type": "keyword"
-                },
-                "type": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "rule": {
-              "properties": {
-                "author": {
-                  "type": "keyword"
-                },
-                "building_block_type": {
-                  "type": "keyword"
-                },
-                "created_at": {
-                  "type": "date"
-                },
-                "created_by": {
-                  "type": "keyword"
-                },
-                "description": {
-                  "type": "keyword"
-                },
-                "enabled": {
-                  "type": "keyword"
-                },
-                "false_positives": {
-                  "type": "keyword"
-                },
-                "filters": {
-                  "type": "object"
-                },
-                "from": {
-                  "type": "keyword"
-                },
-                "id": {
-                  "type": "keyword"
-                },
-                "immutable": {
-                  "type": "keyword"
-                },
-                "index": {
-                  "type": "keyword"
-                },
-                "interval": {
-                  "type": "keyword"
-                },
-                "language": {
-                  "type": "keyword"
-                },
-                "license": {
-                  "type": "keyword"
-                },
-                "max_signals": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "note": {
-                  "type": "text"
-                },
-                "output_index": {
-                  "type": "keyword"
-                },
-                "query": {
-                  "type": "keyword"
-                },
-                "references": {
-                  "type": "keyword"
-                },
-                "risk_score": {
-                  "type": "keyword"
-                },
-                "risk_score_mapping": {
-                  "properties": {
-                    "field": {
-                      "type": "keyword"
-                    },
-                    "operator": {
-                      "type": "keyword"
-                    },
-                    "value": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "rule_id": {
-                  "type": "keyword"
-                },
-                "rule_name_override": {
-                  "type": "keyword"
-                },
-                "saved_id": {
-                  "type": "keyword"
-                },
-                "severity": {
-                  "type": "keyword"
-                },
-                "severity_mapping": {
-                  "properties": {
-                    "field": {
-                      "type": "keyword"
-                    },
-                    "operator": {
-                      "type": "keyword"
-                    },
-                    "severity": {
-                      "type": "keyword"
-                    },
-                    "value": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "size": {
-                  "type": "keyword"
-                },
-                "tags": {
-                  "type": "keyword"
-                },
-                "threat": {
-                  "properties": {
-                    "framework": {
-                      "type": "keyword"
-                    },
-                    "tactic": {
-                      "properties": {
-                        "id": {
-                          "type": "keyword"
-                        },
-                        "name": {
-                          "type": "keyword"
-                        },
-                        "reference": {
-                          "type": "keyword"
-                        }
-                      }
-                    },
-                    "technique": {
-                      "properties": {
-                        "id": {
-                          "type": "keyword"
-                        },
-                        "name": {
-                          "type": "keyword"
-                        },
-                        "reference": {
-                          "type": "keyword"
-                        }
-                      }
-                    }
-                  }
-                },
-                "timeline_id": {
-                  "type": "keyword"
-                },
-                "timeline_title": {
-                  "type": "keyword"
-                },
-                "timestamp_override": {
-                  "type": "keyword"
-                },
-                "to": {
-                  "type": "keyword"
-                },
-                "type": {
-                  "type": "keyword"
-                },
-                "updated_at": {
-                  "type": "date"
-                },
-                "updated_by": {
-                  "type": "keyword"
-                },
-                "version": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "status": {
-              "type": "keyword"
-            }
-          }
-        },
-        "source": {
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "tags": {
-          "ignore_above": 1024,
-          "type": "keyword"
-        },
-        "threat": {
-          "properties": {
-            "framework": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "tactic": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "reference": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "technique": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "reference": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "tls": {
-          "properties": {
-            "cipher": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "client": {
-              "properties": {
-                "certificate": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "certificate_chain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "issuer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ja3": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "not_after": {
-                  "type": "date"
-                },
-                "not_before": {
-                  "type": "date"
-                },
-                "server_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "supported_ciphers": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "curve": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "established": {
-              "type": "boolean"
-            },
-            "next_protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "resumed": {
-              "type": "boolean"
-            },
-            "server": {
-              "properties": {
-                "certificate": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "certificate_chain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "issuer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ja3s": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "not_after": {
-                  "type": "date"
-                },
-                "not_before": {
-                  "type": "date"
-                },
-                "subject": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version_protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "trace": {
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "transaction": {
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "url": {
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "extension": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "fragment": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "password": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "port": {
-              "type": "long"
-            },
-            "query": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "scheme": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "username": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "user": {
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "email": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full_name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "group": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "user_agent": {
-          "properties": {
-            "device": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "vlan": {
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "vulnerability": {
-          "properties": {
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "classification": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "enumeration": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "report_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "scanner": {
-              "properties": {
-                "vendor": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "score": {
-              "properties": {
-                "base": {
-                  "type": "float"
-                },
-                "environmental": {
-                  "type": "float"
-                },
-                "temporal": {
-                  "type": "float"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "severity": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        }
-      }
-    },
-    "settings": {
-      "index": {
-        "lifecycle": {
-          "name": ".siem-signals-default",
-          "rollover_alias": ".siem-signals-default"
-        },
-        "mapping": {
-          "total_fields": {
-            "limit": "10000"
-          }
-        },
-        "number_of_replicas": "1",
-        "number_of_shards": "1"
-      }
-    }
-  }
-}
\ No newline at end of file
diff --git a/x-pack/test/security_solution_cypress/es_archives/export_rule/data.json.gz b/x-pack/test/security_solution_cypress/es_archives/export_rule/data.json.gz
index 8c981e0012daf..3c1a0f663a8ee 100644
Binary files a/x-pack/test/security_solution_cypress/es_archives/export_rule/data.json.gz and b/x-pack/test/security_solution_cypress/es_archives/export_rule/data.json.gz differ
diff --git a/x-pack/test/security_solution_cypress/es_archives/export_rule/mappings.json b/x-pack/test/security_solution_cypress/es_archives/export_rule/mappings.json
index 6d7c1777d1e7d..2cfa0bde4e977 100644
--- a/x-pack/test/security_solution_cypress/es_archives/export_rule/mappings.json
+++ b/x-pack/test/security_solution_cypress/es_archives/export_rule/mappings.json
@@ -13,7 +13,8 @@
           "action_task_params": "a9d49f184ee89641044be0ca2950fa3a",
           "alert": "7b44fba6773e37c806ce290ea9b7024e",
           "apm-indices": "9bb9b2bf1fa636ed8619cbab5ce6a1dd",
-          "apm-telemetry": "3525d7c22c42bc80f5e6e9cb3f2b26a2",
+          "apm-telemetry": "3d1b76c39bfb2cc8296b024d73854724",
+          "app_search_telemetry": "3d1b76c39bfb2cc8296b024d73854724",
           "application_usage_totals": "3d1b76c39bfb2cc8296b024d73854724",
           "application_usage_transactional": "43b8830d5d0df85a6823d290885fc9fd",
           "canvas-element": "7390014e1091044523666d97247392fc",
@@ -25,21 +26,23 @@
           "cases-user-actions": "32277330ec6b721abe3b846cfd939a71",
           "config": "c63748b75f39d0c54de12d12c1ccbc20",
           "dashboard": "d00f614b29a80360e1190193fd333bab",
-          "endpoint:exceptions-artifact": "053713a6b91811c7de078ead17384914",
-          "endpoint:exceptions-manifest": "67c28185da541c1404e7852d30498cd6",
-          "epm-packages": "04696e7dba1b9597f7d6ed78a4a76658",
+          "endpoint:user-artifact": "4a11183eee21e6fbad864f7a30b39ad0",
+          "endpoint:user-artifact-manifest": "67c28185da541c1404e7852d30498cd6",
+          "epm-packages": "8f6e0b09ea0374c4ffe98c3755373cff",
+          "exception-list": "4818e7dfc3e538562c80ec34eb6f841b",
+          "exception-list-agnostic": "4818e7dfc3e538562c80ec34eb6f841b",
           "file-upload-telemetry": "0ed4d3e1983d1217a30982630897092e",
-          "fleet-agent-actions": "00fe5651ed2da16b7f8159bbf0f7d910",
+          "fleet-agent-actions": "e520c855577170c24481be05c3ae14ec",
           "fleet-agent-events": "3231653fafe4ef3196fe3b32ab774bf2",
-          "fleet-agents": "578bbfa81650206927683ebde0c85409",
-          "fleet-enrollment-api-keys": "451e5c329b3ae9722dc7bc8f5921e05d",
+          "fleet-agents": "034346488514b7058a79140b19ddf631",
+          "fleet-enrollment-api-keys": "28b91e20b105b6f928e2012600085d8f",
           "graph-workspace": "cd7ba1330e6682e9cc00b78850874be1",
           "index-pattern": "66eccb05066c5a89924f48a9e9736499",
           "infrastructure-ui-source": "2b2809653635caf490c93f090502d04c",
           "ingest-agent-configs": "9326f99c977fd2ef5ab24b6336a0675c",
-          "ingest-outputs": "87da6a0e27b3a61ad389fb7a7e2da293",
+          "ingest-outputs": "8aa988c376e65443fefc26f1075e93a3",
           "ingest-package-configs": "48e8bd97e488008e21c0b5a2367b83ad",
-          "ingest_manager_settings": "c5b0749b4ab03c582efd4c14cb8f132c",
+          "ingest_manager_settings": "012cf278ec84579495110bb827d1ed09",
           "inventory-view": "88fc7e12fd1b45b6f0787323ce4f18d2",
           "kql-telemetry": "d12a98a6f19a2d273696597547e064ee",
           "lens": "d33c68a69ff1e78c9888dedd2164ac22",
@@ -54,10 +57,10 @@
           "query": "11aaeb7f5f7fa5bb43f25e18ce26e7d9",
           "references": "7997cf5a56cc02bdc9c93361bde732b0",
           "sample-data-telemetry": "7d3cfeb915303c9641c59681967ffeb4",
-          "search": "181661168bbadd1eff5902361e2a0d5c",
+          "search": "5c4b9a6effceb17ae8a0ab22d0c49767",
           "siem-detection-engine-rule-actions": "6569b288c169539db10cb262bf79de18",
           "siem-detection-engine-rule-status": "ae783f41c6937db6b7a2ef5c93a9e9b0",
-          "siem-ui-timeline": "17ec409954864e592ceec0c5eae29ad9",
+          "siem-ui-timeline": "94bc38c7a421d15fbfe8ea565370a421",
           "siem-ui-timeline-note": "8874706eedc49059d4cf0f5094559084",
           "siem-ui-timeline-pinned-event": "20638091112f0e14f0e443d512301c29",
           "space": "c5ca8acafa0beaa4d08d014a97b6bc6b",
@@ -67,11 +70,12 @@
           "type": "2f4316de49999235636386fe51dc06c1",
           "ui-metric": "0d409297dc5ebe1e3a1da691c6ee32e3",
           "updated_at": "00da57df13e94e9d98437d13ace4bfe0",
-          "upgrade-assistant-reindex-operation": "296a89039fc4260292be36b1b005d8f2",
+          "upgrade-assistant-reindex-operation": "215107c281839ea9b3ad5f6419819763",
           "upgrade-assistant-telemetry": "56702cec857e0a9dacfb696655b4ff7b",
           "uptime-dynamic-settings": "fcdb453a30092f022f2642db29523d80",
           "url": "c7f66a0df8b1b52f17c28c4adb111105",
-          "visualization": "52d7a13ad68a150c4525b292d23e12cc"
+          "visualization": "52d7a13ad68a150c4525b292d23e12cc",
+          "workplace_search_telemetry": "3d1b76c39bfb2cc8296b024d73854724"
         }
       },
       "dynamic": "strict",
@@ -219,913 +223,12 @@
           }
         },
         "apm-telemetry": {
-          "properties": {
-            "agents": {
-              "properties": {
-                "dotnet": {
-                  "properties": {
-                    "agent": {
-                      "properties": {
-                        "version": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        }
-                      }
-                    },
-                    "service": {
-                      "properties": {
-                        "framework": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        },
-                        "language": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        },
-                        "runtime": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "go": {
-                  "properties": {
-                    "agent": {
-                      "properties": {
-                        "version": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        }
-                      }
-                    },
-                    "service": {
-                      "properties": {
-                        "framework": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        },
-                        "language": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        },
-                        "runtime": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "java": {
-                  "properties": {
-                    "agent": {
-                      "properties": {
-                        "version": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        }
-                      }
-                    },
-                    "service": {
-                      "properties": {
-                        "framework": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        },
-                        "language": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        },
-                        "runtime": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "js-base": {
-                  "properties": {
-                    "agent": {
-                      "properties": {
-                        "version": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        }
-                      }
-                    },
-                    "service": {
-                      "properties": {
-                        "framework": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        },
-                        "language": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        },
-                        "runtime": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "nodejs": {
-                  "properties": {
-                    "agent": {
-                      "properties": {
-                        "version": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        }
-                      }
-                    },
-                    "service": {
-                      "properties": {
-                        "framework": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        },
-                        "language": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        },
-                        "runtime": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "python": {
-                  "properties": {
-                    "agent": {
-                      "properties": {
-                        "version": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        }
-                      }
-                    },
-                    "service": {
-                      "properties": {
-                        "framework": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        },
-                        "language": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        },
-                        "runtime": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "ruby": {
-                  "properties": {
-                    "agent": {
-                      "properties": {
-                        "version": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        }
-                      }
-                    },
-                    "service": {
-                      "properties": {
-                        "framework": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        },
-                        "language": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        },
-                        "runtime": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "rum-js": {
-                  "properties": {
-                    "agent": {
-                      "properties": {
-                        "version": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        }
-                      }
-                    },
-                    "service": {
-                      "properties": {
-                        "framework": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        },
-                        "language": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        },
-                        "runtime": {
-                          "properties": {
-                            "composite": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "version": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
-            "cardinality": {
-              "properties": {
-                "transaction": {
-                  "properties": {
-                    "name": {
-                      "properties": {
-                        "all_agents": {
-                          "properties": {
-                            "1d": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "rum": {
-                          "properties": {
-                            "1d": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "user_agent": {
-                  "properties": {
-                    "original": {
-                      "properties": {
-                        "all_agents": {
-                          "properties": {
-                            "1d": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "rum": {
-                          "properties": {
-                            "1d": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
-            "counts": {
-              "properties": {
-                "agent_configuration": {
-                  "properties": {
-                    "all": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "error": {
-                  "properties": {
-                    "1d": {
-                      "type": "long"
-                    },
-                    "all": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "max_error_groups_per_service": {
-                  "properties": {
-                    "1d": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "max_transaction_groups_per_service": {
-                  "properties": {
-                    "1d": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "metric": {
-                  "properties": {
-                    "1d": {
-                      "type": "long"
-                    },
-                    "all": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "onboarding": {
-                  "properties": {
-                    "1d": {
-                      "type": "long"
-                    },
-                    "all": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "services": {
-                  "properties": {
-                    "1d": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "sourcemap": {
-                  "properties": {
-                    "1d": {
-                      "type": "long"
-                    },
-                    "all": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "span": {
-                  "properties": {
-                    "1d": {
-                      "type": "long"
-                    },
-                    "all": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "traces": {
-                  "properties": {
-                    "1d": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "transaction": {
-                  "properties": {
-                    "1d": {
-                      "type": "long"
-                    },
-                    "all": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "has_any_services": {
-              "type": "boolean"
-            },
-            "indices": {
-              "properties": {
-                "all": {
-                  "properties": {
-                    "total": {
-                      "properties": {
-                        "docs": {
-                          "properties": {
-                            "count": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "store": {
-                          "properties": {
-                            "size_in_bytes": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "shards": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "integrations": {
-              "properties": {
-                "ml": {
-                  "properties": {
-                    "all_jobs_count": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "retainment": {
-              "properties": {
-                "error": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "metric": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "onboarding": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "span": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "transaction": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "services_per_agent": {
-              "properties": {
-                "dotnet": {
-                  "null_value": 0,
-                  "type": "long"
-                },
-                "go": {
-                  "null_value": 0,
-                  "type": "long"
-                },
-                "java": {
-                  "null_value": 0,
-                  "type": "long"
-                },
-                "js-base": {
-                  "null_value": 0,
-                  "type": "long"
-                },
-                "nodejs": {
-                  "null_value": 0,
-                  "type": "long"
-                },
-                "python": {
-                  "null_value": 0,
-                  "type": "long"
-                },
-                "ruby": {
-                  "null_value": 0,
-                  "type": "long"
-                },
-                "rum-js": {
-                  "null_value": 0,
-                  "type": "long"
-                }
-              }
-            },
-            "tasks": {
-              "properties": {
-                "agent_configuration": {
-                  "properties": {
-                    "took": {
-                      "properties": {
-                        "ms": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                },
-                "agents": {
-                  "properties": {
-                    "took": {
-                      "properties": {
-                        "ms": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                },
-                "cardinality": {
-                  "properties": {
-                    "took": {
-                      "properties": {
-                        "ms": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                },
-                "groupings": {
-                  "properties": {
-                    "took": {
-                      "properties": {
-                        "ms": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                },
-                "indices_stats": {
-                  "properties": {
-                    "took": {
-                      "properties": {
-                        "ms": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                },
-                "integrations": {
-                  "properties": {
-                    "took": {
-                      "properties": {
-                        "ms": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                },
-                "processor_events": {
-                  "properties": {
-                    "took": {
-                      "properties": {
-                        "ms": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                },
-                "services": {
-                  "properties": {
-                    "took": {
-                      "properties": {
-                        "ms": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                },
-                "versions": {
-                  "properties": {
-                    "took": {
-                      "properties": {
-                        "ms": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
-            "version": {
-              "properties": {
-                "apm_server": {
-                  "properties": {
-                    "major": {
-                      "type": "long"
-                    },
-                    "minor": {
-                      "type": "long"
-                    },
-                    "patch": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            }
-          }
+          "dynamic": "false",
+          "type": "object"
+        },
+        "app_search_telemetry": {
+          "dynamic": "false",
+          "type": "object"
         },
         "application_usage_totals": {
           "dynamic": "false",
@@ -1493,91 +596,342 @@
                   "type": "integer"
                 },
                 "value": {
-                  "type": "integer"
+                  "type": "integer"
+                }
+              }
+            },
+            "timeFrom": {
+              "type": "keyword"
+            },
+            "timeRestore": {
+              "type": "boolean"
+            },
+            "timeTo": {
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            }
+          }
+        },
+        "endpoint:user-artifact": {
+          "properties": {
+            "body": {
+              "type": "binary"
+            },
+            "compressionAlgorithm": {
+              "index": false,
+              "type": "keyword"
+            },
+            "created": {
+              "index": false,
+              "type": "date"
+            },
+            "decodedSha256": {
+              "index": false,
+              "type": "keyword"
+            },
+            "decodedSize": {
+              "index": false,
+              "type": "long"
+            },
+            "encodedSha256": {
+              "type": "keyword"
+            },
+            "encodedSize": {
+              "index": false,
+              "type": "long"
+            },
+            "encryptionAlgorithm": {
+              "index": false,
+              "type": "keyword"
+            },
+            "identifier": {
+              "type": "keyword"
+            }
+          }
+        },
+        "endpoint:user-artifact-manifest": {
+          "properties": {
+            "created": {
+              "index": false,
+              "type": "date"
+            },
+            "ids": {
+              "index": false,
+              "type": "keyword"
+            }
+          }
+        },
+        "epm-packages": {
+          "properties": {
+            "es_index_patterns": {
+              "enabled": false,
+              "type": "object"
+            },
+            "installed_es": {
+              "properties": {
+                "id": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "installed_kibana": {
+              "properties": {
+                "id": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "internal": {
+              "type": "boolean"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "removable": {
+              "type": "boolean"
+            },
+            "version": {
+              "type": "keyword"
+            }
+          }
+        },
+        "exception-list": {
+          "properties": {
+            "_tags": {
+              "type": "keyword"
+            },
+            "comments": {
+              "properties": {
+                "comment": {
+                  "type": "keyword"
+                },
+                "created_at": {
+                  "type": "keyword"
+                },
+                "created_by": {
+                  "type": "keyword"
+                },
+                "updated_at": {
+                  "type": "keyword"
+                },
+                "updated_by": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "created_at": {
+              "type": "keyword"
+            },
+            "created_by": {
+              "type": "keyword"
+            },
+            "description": {
+              "type": "keyword"
+            },
+            "entries": {
+              "properties": {
+                "entries": {
+                  "properties": {
+                    "field": {
+                      "type": "keyword"
+                    },
+                    "operator": {
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "type": "keyword"
+                    },
+                    "value": {
+                      "fields": {
+                        "text": {
+                          "type": "text"
+                        }
+                      },
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "field": {
+                  "type": "keyword"
+                },
+                "list": {
+                  "properties": {
+                    "id": {
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "operator": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                },
+                "value": {
+                  "fields": {
+                    "text": {
+                      "type": "text"
+                    }
+                  },
+                  "type": "keyword"
                 }
               }
             },
-            "timeFrom": {
+            "item_id": {
               "type": "keyword"
             },
-            "timeRestore": {
-              "type": "boolean"
-            },
-            "timeTo": {
+            "list_id": {
               "type": "keyword"
             },
-            "title": {
-              "type": "text"
+            "list_type": {
+              "type": "keyword"
             },
-            "version": {
-              "type": "integer"
-            }
-          }
-        },
-        "endpoint:exceptions-artifact": {
-          "properties": {
-            "body": {
-              "type": "binary"
+            "meta": {
+              "type": "keyword"
             },
-            "created": {
-              "index": false,
-              "type": "date"
+            "name": {
+              "type": "keyword"
             },
-            "encoding": {
-              "index": false,
+            "tags": {
               "type": "keyword"
             },
-            "identifier": {
+            "tie_breaker_id": {
               "type": "keyword"
             },
-            "sha256": {
+            "type": {
               "type": "keyword"
             },
-            "size": {
-              "index": false,
-              "type": "long"
+            "updated_by": {
+              "type": "keyword"
             }
           }
         },
-        "endpoint:exceptions-manifest": {
+        "exception-list-agnostic": {
           "properties": {
-            "created": {
-              "index": false,
-              "type": "date"
+            "_tags": {
+              "type": "keyword"
             },
-            "ids": {
-              "index": false,
+            "comments": {
+              "properties": {
+                "comment": {
+                  "type": "keyword"
+                },
+                "created_at": {
+                  "type": "keyword"
+                },
+                "created_by": {
+                  "type": "keyword"
+                },
+                "updated_at": {
+                  "type": "keyword"
+                },
+                "updated_by": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "created_at": {
               "type": "keyword"
-            }
-          }
-        },
-        "epm-packages": {
-          "properties": {
-            "es_index_patterns": {
-              "enabled": false,
-              "type": "object"
             },
-            "installed": {
+            "created_by": {
+              "type": "keyword"
+            },
+            "description": {
+              "type": "keyword"
+            },
+            "entries": {
               "properties": {
-                "id": {
+                "entries": {
+                  "properties": {
+                    "field": {
+                      "type": "keyword"
+                    },
+                    "operator": {
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "type": "keyword"
+                    },
+                    "value": {
+                      "fields": {
+                        "text": {
+                          "type": "text"
+                        }
+                      },
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "field": {
+                  "type": "keyword"
+                },
+                "list": {
+                  "properties": {
+                    "id": {
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "operator": {
                   "type": "keyword"
                 },
                 "type": {
                   "type": "keyword"
+                },
+                "value": {
+                  "fields": {
+                    "text": {
+                      "type": "text"
+                    }
+                  },
+                  "type": "keyword"
                 }
-              },
-              "type": "nested"
+              }
             },
-            "internal": {
-              "type": "boolean"
+            "item_id": {
+              "type": "keyword"
+            },
+            "list_id": {
+              "type": "keyword"
+            },
+            "list_type": {
+              "type": "keyword"
+            },
+            "meta": {
+              "type": "keyword"
             },
             "name": {
               "type": "keyword"
             },
-            "removable": {
-              "type": "boolean"
+            "tags": {
+              "type": "keyword"
             },
-            "version": {
+            "tie_breaker_id": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            },
+            "updated_by": {
               "type": "keyword"
             }
           }
@@ -1653,9 +1007,6 @@
             "config_id": {
               "type": "keyword"
             },
-            "config_newest_revision": {
-              "type": "integer"
-            },
             "config_revision": {
               "type": "integer"
             },
@@ -1675,6 +1026,9 @@
             "last_checkin": {
               "type": "date"
             },
+            "last_checkin_status": {
+              "type": "keyword"
+            },
             "last_updated": {
               "type": "date"
             },
@@ -1690,6 +1044,12 @@
             "type": {
               "type": "keyword"
             },
+            "unenrolled_at": {
+              "type": "date"
+            },
+            "unenrollment_started_at": {
+              "type": "date"
+            },
             "updated_at": {
               "type": "date"
             },
@@ -2029,6 +1389,10 @@
             "agent_auto_upgrade": {
               "type": "keyword"
             },
+            "has_seen_add_data_notice": {
+              "index": false,
+              "type": "boolean"
+            },
             "kibana_ca_sha256": {
               "type": "keyword"
             },
@@ -2337,42 +1701,6 @@
               },
               "type": "text"
             },
-            "dashboard": {
-              "fields": {
-                "keyword": {
-                  "ignore_above": 256,
-                  "type": "keyword"
-                }
-              },
-              "type": "text"
-            },
-            "index-pattern": {
-              "fields": {
-                "keyword": {
-                  "ignore_above": 256,
-                  "type": "keyword"
-                }
-              },
-              "type": "text"
-            },
-            "map": {
-              "fields": {
-                "keyword": {
-                  "ignore_above": 256,
-                  "type": "keyword"
-                }
-              },
-              "type": "text"
-            },
-            "search": {
-              "fields": {
-                "keyword": {
-                  "ignore_above": 256,
-                  "type": "keyword"
-                }
-              },
-              "type": "text"
-            },
             "space": {
               "fields": {
                 "keyword": {
@@ -2381,15 +1709,6 @@
                 }
               },
               "type": "text"
-            },
-            "visualization": {
-              "fields": {
-                "keyword": {
-                  "ignore_above": 256,
-                  "type": "keyword"
-                }
-              },
-              "type": "text"
             }
           }
         },
@@ -2466,22 +1785,26 @@
         "search": {
           "properties": {
             "columns": {
+              "index": false,
               "type": "keyword"
             },
             "description": {
               "type": "text"
             },
             "hits": {
+              "index": false,
               "type": "integer"
             },
             "kibanaSavedObjectMeta": {
               "properties": {
                 "searchSourceJSON": {
+                  "index": false,
                   "type": "text"
                 }
               }
             },
             "sort": {
+              "index": false,
               "type": "keyword"
             },
             "title": {
@@ -2493,12 +1816,8 @@
           }
         },
         "server": {
-          "dynamic": "strict",
-          "properties": {
-            "uuid": {
-              "type": "keyword"
-            }
-          }
+          "dynamic": "false",
+          "type": "object"
         },
         "siem-detection-engine-rule-actions": {
           "properties": {
@@ -2649,6 +1968,9 @@
                           "type": "text"
                         }
                       }
+                    },
+                    "type": {
+                      "type": "text"
                     }
                   }
                 },
@@ -2685,6 +2007,9 @@
                       "type": "text"
                     }
                   }
+                },
+                "type": {
+                  "type": "text"
                 }
               }
             },
@@ -2704,6 +2029,9 @@
             "eventType": {
               "type": "keyword"
             },
+            "excludedRowRendererIds": {
+              "type": "text"
+            },
             "favorite": {
               "properties": {
                 "favoriteDate": {
@@ -3013,19 +2341,31 @@
         "upgrade-assistant-reindex-operation": {
           "properties": {
             "errorMessage": {
-              "type": "keyword"
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
             },
             "indexName": {
               "type": "keyword"
             },
             "lastCompletedStep": {
-              "type": "integer"
+              "type": "long"
             },
             "locked": {
               "type": "date"
             },
             "newIndexName": {
-              "type": "keyword"
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
             },
             "reindexOptions": {
               "properties": {
@@ -3045,7 +2385,13 @@
               }
             },
             "reindexTaskId": {
-              "type": "keyword"
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
             },
             "reindexTaskPercComplete": {
               "type": "float"
@@ -3173,6 +2519,10 @@
               "type": "text"
             }
           }
+        },
+        "workplace_search_telemetry": {
+          "dynamic": "false",
+          "type": "object"
         }
       }
     },
@@ -5655,7 +5005,7 @@
                   "type": "keyword"
                 },
                 "risk_score": {
-                  "type": "keyword"
+                  "type": "float"
                 },
                 "risk_score_mapping": {
                   "properties": {
@@ -5737,6 +5087,16 @@
                     }
                   }
                 },
+                "threshold": {
+                  "properties": {
+                    "field": {
+                      "type": "keyword"
+                    },
+                    "value": {
+                      "type": "float"
+                    }
+                  }
+                },
                 "timeline_id": {
                   "type": "keyword"
                 },
@@ -5765,6 +5125,9 @@
             },
             "status": {
               "type": "keyword"
+            },
+            "threshold_count": {
+              "type": "float"
             }
           }
         },
diff --git a/x-pack/test/security_solution_endpoint/apps/endpoint/policy_details.ts b/x-pack/test/security_solution_endpoint/apps/endpoint/policy_details.ts
index 0c9a86449506b..cf76f297d83be 100644
--- a/x-pack/test/security_solution_endpoint/apps/endpoint/policy_details.ts
+++ b/x-pack/test/security_solution_endpoint/apps/endpoint/policy_details.ts
@@ -19,9 +19,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
   const testSubjects = getService('testSubjects');
   const policyTestResources = getService('policyTestResources');
 
-  // Temporarily skipped to promote snapshot
-  // Re-enabled in https://github.com/elastic/kibana/pull/71727
-  describe.skip('When on the Endpoint Policy Details Page', function () {
+  describe('When on the Endpoint Policy Details Page', function () {
     this.tags(['ciGroup7']);
 
     describe('with an invalid policy id', () => {
diff --git a/x-pack/test/security_solution_endpoint/apps/endpoint/policy_list.ts b/x-pack/test/security_solution_endpoint/apps/endpoint/policy_list.ts
index 5b4a5cca108f9..57321ab4cd911 100644
--- a/x-pack/test/security_solution_endpoint/apps/endpoint/policy_list.ts
+++ b/x-pack/test/security_solution_endpoint/apps/endpoint/policy_list.ts
@@ -19,9 +19,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
   const policyTestResources = getService('policyTestResources');
   const RELATIVE_DATE_FORMAT = /\d (?:seconds|minutes) ago/i;
 
-  // Temporarily skipped to promote snapshot
-  // Re-enabled in https://github.com/elastic/kibana/pull/71727
-  describe.skip('When on the Endpoint Policy List', function () {
+  describe('When on the Endpoint Policy List', function () {
     this.tags(['ciGroup7']);
     before(async () => {
       await pageObjects.policy.navigateToPolicyList();
diff --git a/yarn.lock b/yarn.lock
index 8e04560bd303e..e5975efe0b7d5 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2172,10 +2172,10 @@
     redux-immutable-state-invariant "^2.1.0"
     redux-logger "^3.0.6"
 
-"@elastic/elasticsearch@7.8.0":
-  version "7.8.0"
-  resolved "https://registry.yarnpkg.com/@elastic/elasticsearch/-/elasticsearch-7.8.0.tgz#3f9ee54fe8ef79874ebd231db03825fa500a7111"
-  integrity sha512-rUOTNN1At0KoN0Fcjd6+J7efghuURnoMTB/od9EMK6Mcdebi6N3z5ulShTsKRn6OanS9Eq3l/OmheQY1Y+WLcg==
+"@elastic/elasticsearch@7.9.0-rc.1":
+  version "7.9.0-rc.1"
+  resolved "https://registry.yarnpkg.com/@elastic/elasticsearch/-/elasticsearch-7.9.0-rc.1.tgz#50205507ec84ccb95cb7a6d36e5570808749fee9"
+  integrity sha512-rVjiVj7VPLCusJPfywpb3gvcaA99uylYSum1Frcq4vi2Iqg118KXgYW6GOis2Y70oDZ6w6XRlT0ze5NA6SBa+g==
   dependencies:
     debug "^4.1.1"
     decompress-response "^4.2.0"
@@ -2183,18 +2183,6 @@
     pump "^3.0.0"
     secure-json-parse "^2.1.0"
 
-"@elastic/elasticsearch@^7.4.0":
-  version "7.4.0"
-  resolved "https://registry.yarnpkg.com/@elastic/elasticsearch/-/elasticsearch-7.4.0.tgz#57f4066acf25e9d4e9b4f6376088433aae6f25d4"
-  integrity sha512-HpEKHH6mHQRvea3lw4NNJw9ZUS1KmkpwWKHucaHi1svDn+/fEAwY0wD8egL1vZJo4ZmWfCQMjVqGL+Hoy1HYRw==
-  dependencies:
-    debug "^4.1.1"
-    decompress-response "^4.2.0"
-    into-stream "^5.1.0"
-    ms "^2.1.1"
-    once "^1.4.0"
-    pump "^3.0.0"
-
 "@elastic/ems-client@7.9.3":
   version "7.9.3"
   resolved "https://registry.yarnpkg.com/@elastic/ems-client/-/ems-client-7.9.3.tgz#71b79914f76e347f050ead8474ad65d761e94a8a"
@@ -5153,6 +5141,11 @@
   resolved "https://registry.yarnpkg.com/@types/has-ansi/-/has-ansi-3.0.0.tgz#636403dc4e0b2649421c4158e5c404416f3f0330"
   integrity sha512-H3vFOwfLlFEC0MOOrcSkus8PCnMCzz4N0EqUbdJZCdDhBTfkAu86aRYA+MTxjKW6jCpUvxcn4715US8g+28BMA==
 
+"@types/he@^1.1.1":
+  version "1.1.1"
+  resolved "https://registry.yarnpkg.com/@types/he/-/he-1.1.1.tgz#19e14033c4ee8f1a702c74dcc6182664839ac2b7"
+  integrity sha512-jpzrsR1ns0n3kyWt92QfOUQhIuJGQ9+QGa7M62rO6toe98woQjnsnzjdMtsQXCdvjjmqjS2ZBCC7xKw0cdzU+Q==
+
 "@types/history@*":
   version "4.7.2"
   resolved "https://registry.yarnpkg.com/@types/history/-/history-4.7.2.tgz#0e670ea254d559241b6eeb3894f8754991e73220"
@@ -15294,7 +15287,7 @@ fresh@0.5.2:
   resolved "https://registry.yarnpkg.com/fresh/-/fresh-0.5.2.tgz#3d8cadd90d976569fa835ab1f8e4b23a105605a7"
   integrity sha1-PYyt2Q2XZWn6g1qx+OSyOhBWBac=
 
-from2@^2.1.0, from2@^2.1.1, from2@^2.3.0:
+from2@^2.1.0, from2@^2.1.1:
   version "2.3.0"
   resolved "https://registry.yarnpkg.com/from2/-/from2-2.3.0.tgz#8bfb5502bde4a4d36cfdeea007fcca21d7e382af"
   integrity sha1-i/tVAr3kpNNs/e6gB/zKIdfjgq8=
@@ -16274,7 +16267,7 @@ graceful-fs@^4.2.0:
   resolved "https://registry.yarnpkg.com/graceful-fs/-/graceful-fs-4.2.2.tgz#6f0952605d0140c1cfdb138ed005775b92d67b02"
   integrity sha512-IItsdsea19BoLC7ELy13q1iJFNmd7ofZH5+X/pJr90/nRoPEX0DJo1dHDbgtYWOhJhcCgMDTOw84RZ72q6lB+Q==
 
-graceful-fs@^4.2.4:
+graceful-fs@^4.2.3, graceful-fs@^4.2.4:
   version "4.2.4"
   resolved "https://registry.yarnpkg.com/graceful-fs/-/graceful-fs-4.2.4.tgz#2256bde14d3632958c465ebc96dc467ca07a29fb"
   integrity sha512-WjKPNJF79dtJAVniUlGGWHYGz2jWxT6VhN/4m1NdkbZ2nOsEF+cI1Edgql5zCRhs/VsQYRvrXctxktVXZUkixw==
@@ -17075,7 +17068,7 @@ hawk@~6.0.2:
     hoek "4.x.x"
     sntp "2.x.x"
 
-he@1.2.0, he@1.2.x, he@^1.1.1:
+he@1.2.0, he@1.2.x, he@^1.1.1, he@^1.2.0:
   version "1.2.0"
   resolved "https://registry.yarnpkg.com/he/-/he-1.2.0.tgz#84ae65fa7eafb165fddb61566ae14baf05664f0f"
   integrity sha512-F/1DnUGPopORZi0ni+CvrCgHQ5FyEAHRLSApuYWMmrbSwoN2Mn/7k+Gl38gJnR7yyDZk6WLXwiGod1JOWNDKGw==
@@ -18026,6 +18019,11 @@ insight@0.10.1:
     tough-cookie "^2.0.0"
     uuid "^3.0.0"
 
+install-artifact-from-github@^1.0.2:
+  version "1.0.2"
+  resolved "https://registry.yarnpkg.com/install-artifact-from-github/-/install-artifact-from-github-1.0.2.tgz#e1e478dd29880b9112ecd684a84029603e234a9d"
+  integrity sha512-yuMFBSVIP3vD0SDBGUqeIpgOAIlFx8eQFknQObpkYEM5gsl9hy6R9Ms3aV+Vw9MMyYsoPMeex0XDnfgY7uzc+Q==
+
 internal-ip@^4.3.0:
   version "4.3.0"
   resolved "https://registry.yarnpkg.com/internal-ip/-/internal-ip-4.3.0.tgz#845452baad9d2ca3b69c635a137acb9a0dad0907"
@@ -18076,14 +18074,6 @@ into-stream@^3.1.0:
     from2 "^2.1.1"
     p-is-promise "^1.1.0"
 
-into-stream@^5.1.0:
-  version "5.1.0"
-  resolved "https://registry.yarnpkg.com/into-stream/-/into-stream-5.1.0.tgz#b05f37d8fed05c06a0b43b556d74e53e5af23878"
-  integrity sha512-cbDhb8qlxKMxPBk/QxTtYg1DQ4CwXmadu7quG3B7nrJsgSncEreF2kwWKZFdnjc/lSNNIkFPsjI7SM0Cx/QXPw==
-  dependencies:
-    from2 "^2.3.0"
-    p-is-promise "^2.0.0"
-
 invariant@2.2.4, invariant@^2.1.0, invariant@^2.1.1, invariant@^2.2.3, invariant@^2.2.4:
   version "2.2.4"
   resolved "https://registry.yarnpkg.com/invariant/-/invariant-2.2.4.tgz#610f3c92c9359ce1db616e538008d23ff35158e6"
@@ -22708,22 +22698,21 @@ node-gyp@^3.8.0:
     tar "^2.0.0"
     which "1"
 
-node-gyp@^6.1.0:
-  version "6.1.0"
-  resolved "https://registry.yarnpkg.com/node-gyp/-/node-gyp-6.1.0.tgz#64e31c61a4695ad304c1d5b82cf6b7c79cc79f3f"
-  integrity sha512-h4A2zDlOujeeaaTx06r4Vy+8MZ1679lU+wbCKDS4ZtvY2A37DESo37oejIw0mtmR3+rvNwts5B6Kpt1KrNYdNw==
+node-gyp@^7.0.0:
+  version "7.0.0"
+  resolved "https://registry.yarnpkg.com/node-gyp/-/node-gyp-7.0.0.tgz#2e88425ce84e9b1a4433958ed55d74c70fffb6be"
+  integrity sha512-ZW34qA3CJSPKDz2SJBHKRvyNQN0yWO5EGKKksJc+jElu9VA468gwJTyTArC1iOXU7rN3Wtfg/CMt/dBAOFIjvg==
   dependencies:
     env-paths "^2.2.0"
     glob "^7.1.4"
-    graceful-fs "^4.2.2"
-    mkdirp "^0.5.1"
-    nopt "^4.0.1"
+    graceful-fs "^4.2.3"
+    nopt "^4.0.3"
     npmlog "^4.1.2"
-    request "^2.88.0"
+    request "^2.88.2"
     rimraf "^2.6.3"
-    semver "^5.7.1"
-    tar "^4.4.12"
-    which "^1.3.1"
+    semver "^7.3.2"
+    tar "^6.0.1"
+    which "^2.0.2"
 
 node-int64@^0.4.0:
   version "0.4.0"
@@ -22945,7 +22934,7 @@ nopt@^2.2.0:
   dependencies:
     abbrev "1"
 
-nopt@^4.0.1:
+nopt@^4.0.1, nopt@^4.0.3:
   version "4.0.3"
   resolved "https://registry.yarnpkg.com/nopt/-/nopt-4.0.3.tgz#a375cad9d02fd921278d954c2254d5aa57e15e48"
   integrity sha512-CvaGwVMztSMJLOeXPrez7fyfObdZqNUK1cPAEzLHrTybIua9pMdmmPR5YwtfNftIOMv3DPUhFaxsZMNTQO20Kg==
@@ -23772,11 +23761,6 @@ p-is-promise@^1.1.0:
   resolved "https://registry.yarnpkg.com/p-is-promise/-/p-is-promise-1.1.0.tgz#9c9456989e9f6588017b0434d56097675c3da05e"
   integrity sha1-nJRWmJ6fZYgBewQ01WCXZ1w9oF4=
 
-p-is-promise@^2.0.0:
-  version "2.1.0"
-  resolved "https://registry.yarnpkg.com/p-is-promise/-/p-is-promise-2.1.0.tgz#918cebaea248a62cf7ffab8e3bca8c5f882fc42e"
-  integrity sha512-Y3W0wlRPK8ZMRbNq97l4M5otioeA5lm1z7bkNkxCka8HSPjR0xRWmpCmc9utiaLP9Jb1eD8BgeIxTW4AIF45Pg==
-
 p-limit@^1.1.0:
   version "1.3.0"
   resolved "https://registry.yarnpkg.com/p-limit/-/p-limit-1.3.0.tgz#b86bd5f0c25690911c7590fcbfc2010d54b3ccb8"
@@ -25557,13 +25541,14 @@ re-resizable@^6.1.1:
   dependencies:
     fast-memoize "^2.5.1"
 
-re2@1.14.0:
-  version "1.14.0"
-  resolved "https://registry.yarnpkg.com/re2/-/re2-1.14.0.tgz#727076590acfe868cf04e115a3a3f6c373ddd63b"
-  integrity sha512-TYogJmzni8zNVaw4gNOVORRTUaggLZwnMhJoTD0POKeACEoCxTWa9BAYehRnh3S1JUXIMEfcEUa7piiGEn71Zg==
+re2@^1.15.4:
+  version "1.15.4"
+  resolved "https://registry.yarnpkg.com/re2/-/re2-1.15.4.tgz#2ffc3e4894fb60430393459978197648be01a0a9"
+  integrity sha512-7w3K+Daq/JjbX/dz5voMt7B9wlprVBQnMiypyCojAZ99kcAL+3LiJ5uBoX/u47l8eFTVq3Wj+V0pmvU+CT8tOg==
   dependencies:
+    install-artifact-from-github "^1.0.2"
     nan "^2.14.1"
-    node-gyp "^6.1.0"
+    node-gyp "^7.0.0"
 
 react-ace@^5.5.0:
   version "5.10.0"
@@ -27259,6 +27244,32 @@ request@^2.87.0:
     tunnel-agent "^0.6.0"
     uuid "^3.1.0"
 
+request@^2.88.2:
+  version "2.88.2"
+  resolved "https://registry.yarnpkg.com/request/-/request-2.88.2.tgz#d73c918731cb5a87da047e207234146f664d12b3"
+  integrity sha512-MsvtOrfG9ZcrOwAW+Qi+F6HbD0CWXEh9ou77uOb7FM2WPhwT7smM833PzanhJLsgXjN89Ir6V2PczXNnMpwKhw==
+  dependencies:
+    aws-sign2 "~0.7.0"
+    aws4 "^1.8.0"
+    caseless "~0.12.0"
+    combined-stream "~1.0.6"
+    extend "~3.0.2"
+    forever-agent "~0.6.1"
+    form-data "~2.3.2"
+    har-validator "~5.1.3"
+    http-signature "~1.2.0"
+    is-typedarray "~1.0.0"
+    isstream "~0.1.2"
+    json-stringify-safe "~5.0.1"
+    mime-types "~2.1.19"
+    oauth-sign "~0.9.0"
+    performance-now "^2.1.0"
+    qs "~6.5.2"
+    safe-buffer "^5.1.2"
+    tough-cookie "~2.5.0"
+    tunnel-agent "^0.6.0"
+    uuid "^3.3.2"
+
 require-ancestors@^1.0.0:
   version "1.0.0"
   resolved "https://registry.yarnpkg.com/require-ancestors/-/require-ancestors-1.0.0.tgz#807831f8f8081fb12863da81ddb15c8f2a73a004"
@@ -30043,7 +30054,7 @@ tar-stream@^2.1.0:
     inherits "^2.0.3"
     readable-stream "^3.1.1"
 
-tar@4.4.13, tar@^4, tar@^4.4.12:
+tar@4.4.13, tar@^4:
   version "4.4.13"
   resolved "https://registry.yarnpkg.com/tar/-/tar-4.4.13.tgz#43b364bc52888d555298637b10d60790254ab525"
   integrity sha512-w2VwSrBoHa5BsSyH+KxEqeQBAllHhccyMFVHtGtdMpF4W7IRWfZjFiQceJPChOeTsSDVUpER2T8FA93pr0L+QA==
@@ -30078,7 +30089,7 @@ tar@^2.0.0:
     fstream "^1.0.12"
     inherits "2"
 
-tar@^6.0.2:
+tar@^6.0.1, tar@^6.0.2:
   version "6.0.2"
   resolved "https://registry.yarnpkg.com/tar/-/tar-6.0.2.tgz#5df17813468a6264ff14f766886c622b84ae2f39"
   integrity sha512-Glo3jkRtPcvpDlAs/0+hozav78yoXKFr+c4wgw62NNMO3oo4AaJdCo21Uu7lcwr55h39W2XD1LMERc64wtbItg==