From 28b1cf16166cfae35240ca625785288c0d529e66 Mon Sep 17 00:00:00 2001
From: Garrett Spong <garrett.spong@elastic.co>
Date: Wed, 31 Mar 2021 20:06:32 -0600
Subject: [PATCH 01/54] Swaps out alerting for rule-registry within
 SecuritySolution and adds reference rule type via rule-registry

---
 x-pack/plugins/rule_registry/server/plugin.ts |  14 ++-
 .../server/rule_registry/index.ts             |   5 +
 .../security_solution/common/constants.ts     |   5 +
 x-pack/plugins/security_solution/kibana.json  |   1 +
 .../common/store/sourcerer/selectors.ts       |   5 +-
 .../alerts_table/default_config.tsx           | 119 +++++++-----------
 .../reference_rules/reference_rule.ts         |  59 +++++++++
 .../scripts/create_reference_rule.sh          |  33 +++++
 .../security_solution/server/plugin.ts        |  40 +++++-
 9 files changed, 197 insertions(+), 84 deletions(-)
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/reference_rule.ts
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule.sh

diff --git a/x-pack/plugins/rule_registry/server/plugin.ts b/x-pack/plugins/rule_registry/server/plugin.ts
index 09df47c40a394..961b947e3f556 100644
--- a/x-pack/plugins/rule_registry/server/plugin.ts
+++ b/x-pack/plugins/rule_registry/server/plugin.ts
@@ -5,8 +5,11 @@
  * 2.0.
  */
 
-import { PluginInitializerContext, Plugin, CoreSetup } from 'src/core/server';
-import { PluginSetupContract as AlertingPluginSetupContract } from '../../alerting/server';
+import { PluginInitializerContext, Plugin, CoreSetup, CoreStart } from 'src/core/server';
+import {
+  PluginSetupContract as AlertingPluginSetupContract,
+  PluginStartContract as AlertPluginStartContract,
+} from '../../alerting/server';
 import { RuleRegistry } from './rule_registry';
 import { defaultIlmPolicy } from './rule_registry/defaults/ilm_policy';
 import { BaseRuleFieldMap, baseRuleFieldMap } from '../common';
@@ -43,7 +46,12 @@ export class RuleRegistryPlugin implements Plugin<RuleRegistryPluginSetupContrac
     return rootRegistry;
   }
 
-  public start() {}
+  // Temporarily exposing alerting client as passthrough
+  public start(core: CoreStart, plugins: { alerting: AlertPluginStartContract }) {
+    return {
+      alerting: plugins.alerting,
+    };
+  }
 
   public stop() {}
 }
diff --git a/x-pack/plugins/rule_registry/server/rule_registry/index.ts b/x-pack/plugins/rule_registry/server/rule_registry/index.ts
index bbc381f60a809..b3f9684044f72 100644
--- a/x-pack/plugins/rule_registry/server/rule_registry/index.ts
+++ b/x-pack/plugins/rule_registry/server/rule_registry/index.ts
@@ -53,6 +53,7 @@ export class RuleRegistry<TFieldMap extends BaseRuleFieldMap> {
   private readonly types: Array<RuleType<TFieldMap, any, any>> = [];
 
   private readonly fieldmapType: FieldMapType<TFieldMap>;
+  public readonly alertingPluginSetupContract: AlertingPluginSetupContract;
 
   constructor(private readonly options: RuleRegistryOptions<TFieldMap>) {
     const { logger, coreSetup } = options;
@@ -61,6 +62,10 @@ export class RuleRegistry<TFieldMap extends BaseRuleFieldMap> {
 
     const { wait, signal } = createReadySignal<boolean>();
 
+    // Exposing alerting client temporarily to allow consumers to register rules
+    // both against the registry and alerting client directly
+    this.alertingPluginSetupContract = options.alertingPluginSetupContract;
+
     this.esAdapter = new ClusterClientAdapter<{
       body: TypeOfFieldMap<TFieldMap>;
       index: string;
diff --git a/x-pack/plugins/security_solution/common/constants.ts b/x-pack/plugins/security_solution/common/constants.ts
index effefdd438c5c..706318b44f628 100644
--- a/x-pack/plugins/security_solution/common/constants.ts
+++ b/x-pack/plugins/security_solution/common/constants.ts
@@ -148,6 +148,11 @@ export const DEFAULT_TRANSFORMS_SETTING = JSON.stringify(defaultTransformsSettin
  */
 export const SIGNALS_ID = `siem.signals`;
 
+/**
+ * Id's for reference rule types
+ */
+export const REFERENCE_RULE_ALERT_TYPE_ID = `siem.referenceRule`;
+
 /**
  * Id for the notifications alerting type
  */
diff --git a/x-pack/plugins/security_solution/kibana.json b/x-pack/plugins/security_solution/kibana.json
index 50a5f62740271..02dbc56bd3397 100644
--- a/x-pack/plugins/security_solution/kibana.json
+++ b/x-pack/plugins/security_solution/kibana.json
@@ -8,6 +8,7 @@
     "actions",
     "alerting",
     "cases",
+    "ruleRegistry",
     "data",
     "dataEnhanced",
     "embeddable",
diff --git a/x-pack/plugins/security_solution/public/common/store/sourcerer/selectors.ts b/x-pack/plugins/security_solution/public/common/store/sourcerer/selectors.ts
index 53702bcf23b89..9b89c112f7d87 100644
--- a/x-pack/plugins/security_solution/public/common/store/sourcerer/selectors.ts
+++ b/x-pack/plugins/security_solution/public/common/store/sourcerer/selectors.ts
@@ -82,14 +82,15 @@ export const getAllExistingIndexNamesSelector = () => {
 };
 
 const EXCLUDE_ELASTIC_CLOUD_INDEX = '-*elastic-cloud-logs-*';
+const ALERTS_AS_DATA_INDEX = '*alert-history-security-solution*';
 
 export const getSourcererScopeSelector = () => {
   const getScopeIdSelector = scopeIdSelector();
   const getSelectedPatterns = memoizeOne((selectedPatternsStr: string): string[] => {
     const selectedPatterns = selectedPatternsStr.length > 0 ? selectedPatternsStr.split(',') : [];
     return selectedPatterns.some((index) => index === 'logs-*')
-      ? [...selectedPatterns, EXCLUDE_ELASTIC_CLOUD_INDEX]
-      : selectedPatterns;
+      ? [...selectedPatterns, EXCLUDE_ELASTIC_CLOUD_INDEX, ALERTS_AS_DATA_INDEX]
+      : [...selectedPatterns, ALERTS_AS_DATA_INDEX];
   });
 
   const getIndexPattern = memoizeOne(
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/default_config.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/default_config.tsx
index 478c8930b8dd3..a6b0a9726c21b 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/default_config.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/default_config.tsx
@@ -14,23 +14,23 @@ import { timelineDefaults } from '../../../timelines/store/timeline/defaults';
 import { columns } from '../../configurations/security_solution_detections/columns';
 
 export const buildAlertStatusFilter = (status: Status): Filter[] => [
-  {
-    meta: {
-      alias: null,
-      negate: false,
-      disabled: false,
-      type: 'phrase',
-      key: 'signal.status',
-      params: {
-        query: status,
-      },
-    },
-    query: {
-      term: {
-        'signal.status': status,
-      },
-    },
-  },
+  // {
+  //   meta: {
+  //     alias: null,
+  //     negate: false,
+  //     disabled: false,
+  //     type: 'phrase',
+  //     key: 'signal.status',
+  //     params: {
+  //       query: status,
+  //     },
+  //   },
+  //   query: {
+  //     term: {
+  //       'signal.status': status,
+  //     },
+  //   },
+  // },
 ];
 
 export const buildAlertsRuleIdFilter = (ruleId: string | null): Filter[] =>
@@ -60,37 +60,36 @@ export const buildShowBuildingBlockFilter = (showBuildingBlockAlerts: boolean):
   showBuildingBlockAlerts
     ? []
     : [
-        {
-          meta: {
-            alias: null,
-            negate: true,
-            disabled: false,
-            type: 'exists',
-            key: 'signal.rule.building_block_type',
-            value: 'exists',
-          },
-          // @ts-expect-error TODO: Rework parent typings to support ExistsFilter[]
-          exists: { field: 'signal.rule.building_block_type' },
-        },
-      ];
+        // {
+        //   meta: {
+        //     alias: null,
+        //     negate: true,
+        //     disabled: false,
+        //     type: 'exists',
+        //     key: 'signal.rule.building_block_type',
+        //     value: 'exists',
+        //   },
+        //   // @ts-expect-error TODO: Rework parent typings to support ExistsFilter[]
+        //   exists: { field: 'signal.rule.building_block_type' },
+        // },
+];
 
-export const buildThreatMatchFilter = (showOnlyThreatIndicatorAlerts: boolean): Filter[] =>
-  showOnlyThreatIndicatorAlerts
-    ? [
-        {
-          meta: {
-            alias: null,
-            disabled: false,
-            negate: false,
-            key: 'signal.rule.threat_mapping',
-            type: 'exists',
-            value: 'exists',
-          },
-          // @ts-expect-error TODO: Rework parent typings to support ExistsFilter[]
-          exists: { field: 'signal.rule.threat_mapping' },
-        },
-      ]
-    : [];
+export const requiredFieldsForActions = [
+  'alert.id',
+  '@timestamp',
+  'event.kind',
+  'alert.start',
+  'alert.uuid',
+  'event.action',
+  'alert.status',
+  'alert.duration.us',
+  'rule.uuid',
+  'rule.id',
+  'rule.name',
+  'rule.category',
+  'producer',
+  'tags',
+];
 
 export const alertsDefaultModel: SubsetTimelineModel = {
   ...timelineDefaults,
@@ -98,29 +97,3 @@ export const alertsDefaultModel: SubsetTimelineModel = {
   showCheckboxes: true,
   excludedRowRendererIds: Object.values(RowRendererId),
 };
-
-export const requiredFieldsForActions = [
-  '@timestamp',
-  'signal.status',
-  'signal.group.id',
-  'signal.original_time',
-  'signal.rule.building_block_type',
-  'signal.rule.filters',
-  'signal.rule.from',
-  'signal.rule.language',
-  'signal.rule.query',
-  'signal.rule.name',
-  'signal.rule.to',
-  'signal.rule.id',
-  'signal.rule.index',
-  'signal.rule.type',
-  'signal.original_event.kind',
-  'signal.original_event.module',
-  // Endpoint exception fields
-  'file.path',
-  'file.Ext.code_signature.subject_name',
-  'file.Ext.code_signature.trusted',
-  'file.hash.sha256',
-  'host.os.family',
-  'event.code',
-];
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/reference_rule.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/reference_rule.ts
new file mode 100644
index 0000000000000..4d9ed4feefe46
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/reference_rule.ts
@@ -0,0 +1,59 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { schema } from '@kbn/config-schema';
+
+import { v4 as uuidv4 } from 'uuid';
+
+import { createLifecycleRuleTypeFactory } from '../../../../../rule_registry/server';
+import { REFERENCE_RULE_ALERT_TYPE_ID } from '../../../../common/constants';
+import { SecurityRuleRegistry } from '../../../plugin';
+
+const createSecurityLifecycleRuleType = createLifecycleRuleTypeFactory<SecurityRuleRegistry>();
+
+export const referenceRuleAlertType = createSecurityLifecycleRuleType({
+  id: REFERENCE_RULE_ALERT_TYPE_ID,
+  name: 'ReferenceRule alert type',
+  validate: {
+    params: schema.object({
+      server: schema.string(),
+      threshold: schema.number({ min: 0, max: 1 }),
+    }),
+  },
+  actionGroups: [
+    {
+      id: 'default',
+      name: 'Default',
+    },
+    {
+      id: 'warning',
+      name: 'Warning',
+    },
+  ],
+  defaultActionGroupId: 'default',
+  actionVariables: {
+    context: [
+      { name: 'server', description: 'the server' },
+      {
+        name: 'hasCpuUsageIncreased',
+        description: 'boolean indicating if the cpu usage has increased',
+      },
+    ],
+  },
+  minimumLicenseRequired: 'basic',
+  producer: 'security-solution',
+  async executor({ services, params }) {
+    services.alertWithLifecycle({
+      id: `${uuidv4()}`,
+      fields: {},
+    });
+
+    return {
+      lastChecked: new Date(),
+    };
+  },
+});
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule.sh b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule.sh
new file mode 100644
index 0000000000000..193478419ffcb
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule.sh
@@ -0,0 +1,33 @@
+#!/bin/sh
+#
+# Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+# or more contributor license agreements. Licensed under the Elastic License
+# 2.0; you may not use this file except in compliance with the Elastic License
+# 2.0.
+#
+
+curl -X POST http://localhost:5601/${BASE_PATH}/api/alerts/alert \
+     -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
+     -H 'kbn-xsrf: true' \
+     -H 'Content-Type: application/json' \
+     --verbose \
+     -d '
+{
+  "params":{
+      "server":"howdy",
+      "threshold": 0.90
+   },
+   "consumer":"alerts",
+   "alertTypeId":"siem.referenceRule",
+   "schedule":{
+      "interval":"1m"
+   },
+   "actions":[],
+   "tags":[
+      "cpu"
+   ],
+   "notifyWhen":"onActionGroupChange",
+   "name":"Oh hai world!"
+}'
+
+
diff --git a/x-pack/plugins/security_solution/server/plugin.ts b/x-pack/plugins/security_solution/server/plugin.ts
index 158c2e94b2d7a..4d2d72ef35269 100644
--- a/x-pack/plugins/security_solution/server/plugin.ts
+++ b/x-pack/plugins/security_solution/server/plugin.ts
@@ -27,6 +27,11 @@ import {
   PluginSetupContract as AlertingSetup,
   PluginStartContract as AlertPluginStartContract,
 } from '../../alerting/server';
+import {
+  ecsFieldMap,
+  pickWithPatterns,
+  RuleRegistryPluginSetupContract,
+} from '../../rule_registry/server';
 import { SecurityPluginSetup as SecuritySetup, SecurityPluginStart } from '../../security/server';
 import { PluginSetupContract as FeaturesSetup } from '../../features/server';
 import { MlPluginSetup as MlSetup } from '../../ml/server';
@@ -37,6 +42,7 @@ import { ILicense, LicensingPluginStart } from '../../licensing/server';
 import { FleetStartContract } from '../../fleet/server';
 import { TaskManagerSetupContract, TaskManagerStartContract } from '../../task_manager/server';
 import { compose } from './lib/compose/kibana';
+import { referenceRuleAlertType } from './lib/detection_engine/reference_rules/reference_rule';
 import { initRoutes } from './routes';
 import { isAlertExecutor } from './lib/detection_engine/signals/types';
 import { signalRulesAlertType } from './lib/detection_engine/signals/signal_rule_alert_type';
@@ -53,6 +59,7 @@ import {
   SecurityPageName,
   SIGNALS_ID,
   NOTIFICATIONS_ID,
+  REFERENCE_RULE_ALERT_TYPE_ID,
 } from '../common/constants';
 import { registerEndpointRoutes } from './endpoint/routes/metadata';
 import { registerLimitedConcurrencyRoutes } from './endpoint/routes/limited_concurrency';
@@ -79,6 +86,8 @@ import { securitySolutionTimelineEqlSearchStrategyProvider } from './search_stra
 import { parseExperimentalConfigValue } from '../common/experimental_features';
 import { migrateArtifactsToFleet } from './endpoint/lib/artifacts/migrate_artifacts_to_fleet';
 
+export type SecurityRuleRegistry = SetupPlugins['ruleRegistry'];
+
 export interface SetupPlugins {
   alerting: AlertingSetup;
   data: DataPluginSetup;
@@ -86,6 +95,7 @@ export interface SetupPlugins {
   features: FeaturesSetup;
   lists?: ListPluginSetup;
   ml?: MlSetup;
+  ruleRegistry: RuleRegistryPluginSetupContract;
   security?: SecuritySetup;
   spaces?: SpacesSetup;
   taskManager?: TaskManagerSetupContract;
@@ -98,6 +108,7 @@ export interface StartPlugins {
   data: DataPluginStart;
   fleet?: FleetStartContract;
   licensing: LicensingPluginStart;
+  ruleRegistry: RuleRegistryPluginSetupContract;
   taskManager?: TaskManagerStartContract;
   telemetry?: TelemetryPluginStart;
   security: SecurityPluginStart;
@@ -208,6 +219,9 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
     registerTrustedAppsRoutes(router, endpointContext);
     registerHostIsolationRoutes(router, endpointContext);
 
+    const referenceRuleTypes = [REFERENCE_RULE_ALERT_TYPE_ID];
+    const ruleTypes = [SIGNALS_ID, NOTIFICATIONS_ID, ...referenceRuleTypes];
+
     plugins.features.registerKibanaFeature({
       id: SERVER_APP_ID,
       name: i18n.translate('xpack.securitySolution.featureRegistry.linkSecuritySolutionTitle', {
@@ -220,7 +234,7 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
       management: {
         insightsAndAlerting: ['triggersActions'],
       },
-      alerting: [SIGNALS_ID, NOTIFICATIONS_ID],
+      alerting: ruleTypes,
       privileges: {
         all: {
           app: [...securitySubPlugins, 'kibana'],
@@ -237,7 +251,7 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
             read: ['config'],
           },
           alerting: {
-            all: [SIGNALS_ID, NOTIFICATIONS_ID],
+            all: ruleTypes,
           },
           management: {
             insightsAndAlerting: ['triggersActions'],
@@ -259,7 +273,7 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
             ],
           },
           alerting: {
-            read: [SIGNALS_ID, NOTIFICATIONS_ID],
+            read: ruleTypes,
           },
           management: {
             insightsAndAlerting: ['triggersActions'],
@@ -269,7 +283,21 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
       },
     });
 
-    if (plugins.alerting != null) {
+    // Create rule-registry scoped to security-solution (APP_ID uses caps, not supported)
+    this.setupPlugins.ruleRegistry = plugins.ruleRegistry.create({
+      namespace: 'security-solution',
+      fieldMap: {
+        ...pickWithPatterns(ecsFieldMap, 'host.name', 'service.name'),
+      },
+    });
+    // Temporarily exposing alerting client from rule-registry to allow registering of legacy rules
+    this.setupPlugins.alerting = this.setupPlugins.ruleRegistry.alertingPluginSetupContract;
+
+    // Register reference rule types via rule-registry
+    this.setupPlugins.ruleRegistry.registerType(referenceRuleAlertType);
+
+    // Continue to register legacy rules against alerting client exposed through rule-registry
+    if (this.setupPlugins.alerting != null) {
       const signalRuleType = signalRulesAlertType({
         logger: this.logger,
         eventsTelemetry: this.telemetryEventsSender,
@@ -282,11 +310,11 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
       });
 
       if (isAlertExecutor(signalRuleType)) {
-        plugins.alerting.registerType(signalRuleType);
+        this.setupPlugins.alerting.registerType(signalRuleType);
       }
 
       if (isNotificationAlertExecutor(ruleNotificationType)) {
-        plugins.alerting.registerType(ruleNotificationType);
+        this.setupPlugins.alerting.registerType(ruleNotificationType);
       }
     }
 

From 80206f5b2fb0f4adc695463681559a3a767231d5 Mon Sep 17 00:00:00 2001
From: Garrett Spong <garrett.spong@elastic.co>
Date: Thu, 8 Apr 2021 16:21:34 -0600
Subject: [PATCH 02/54] Fixes security reference rule to write alerts again

---
 x-pack/plugins/rule_registry/server/rule_registry/index.ts      | 1 +
 .../public/common/store/sourcerer/selectors.ts                  | 2 +-
 .../reference_rules/scripts/create_reference_rule.sh            | 0
 x-pack/plugins/security_solution/server/plugin.ts               | 2 +-
 4 files changed, 3 insertions(+), 2 deletions(-)
 mode change 100644 => 100755 x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule.sh

diff --git a/x-pack/plugins/rule_registry/server/rule_registry/index.ts b/x-pack/plugins/rule_registry/server/rule_registry/index.ts
index b3f9684044f72..2930dcb4640ee 100644
--- a/x-pack/plugins/rule_registry/server/rule_registry/index.ts
+++ b/x-pack/plugins/rule_registry/server/rule_registry/index.ts
@@ -323,6 +323,7 @@ export class RuleRegistry<TFieldMap extends BaseRuleFieldMap> {
       name: [this.options.name, name].filter(Boolean).join('-'),
       fieldMap: mergedFieldMap,
       ...(ilmPolicy ? { ilmPolicy } : {}),
+      writeEnabled: true,
     });
 
     this.children.push(child);
diff --git a/x-pack/plugins/security_solution/public/common/store/sourcerer/selectors.ts b/x-pack/plugins/security_solution/public/common/store/sourcerer/selectors.ts
index 9b89c112f7d87..aebc61f29490f 100644
--- a/x-pack/plugins/security_solution/public/common/store/sourcerer/selectors.ts
+++ b/x-pack/plugins/security_solution/public/common/store/sourcerer/selectors.ts
@@ -82,7 +82,7 @@ export const getAllExistingIndexNamesSelector = () => {
 };
 
 const EXCLUDE_ELASTIC_CLOUD_INDEX = '-*elastic-cloud-logs-*';
-const ALERTS_AS_DATA_INDEX = '*alert-history-security-solution*';
+const ALERTS_AS_DATA_INDEX = '*alerts-security-solution*';
 
 export const getSourcererScopeSelector = () => {
   const getScopeIdSelector = scopeIdSelector();
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule.sh b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule.sh
old mode 100644
new mode 100755
diff --git a/x-pack/plugins/security_solution/server/plugin.ts b/x-pack/plugins/security_solution/server/plugin.ts
index 4d2d72ef35269..0b13f8a579bd6 100644
--- a/x-pack/plugins/security_solution/server/plugin.ts
+++ b/x-pack/plugins/security_solution/server/plugin.ts
@@ -285,7 +285,7 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
 
     // Create rule-registry scoped to security-solution (APP_ID uses caps, not supported)
     this.setupPlugins.ruleRegistry = plugins.ruleRegistry.create({
-      namespace: 'security-solution',
+      name: 'security-solution',
       fieldMap: {
         ...pickWithPatterns(ecsFieldMap, 'host.name', 'service.name'),
       },

From cf558d860c24b9ab2c939f7444174d18c652bcb8 Mon Sep 17 00:00:00 2001
From: Garrett Spong <garrett.spong@elastic.co>
Date: Thu, 8 Apr 2021 16:54:17 -0600
Subject: [PATCH 03/54] Fixes alerting passthrough so routes relying on
 alerting client function

---
 x-pack/plugins/security_solution/server/plugin.ts | 2 --
 1 file changed, 2 deletions(-)

diff --git a/x-pack/plugins/security_solution/server/plugin.ts b/x-pack/plugins/security_solution/server/plugin.ts
index 0b13f8a579bd6..a2bcbf4979596 100644
--- a/x-pack/plugins/security_solution/server/plugin.ts
+++ b/x-pack/plugins/security_solution/server/plugin.ts
@@ -290,8 +290,6 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
         ...pickWithPatterns(ecsFieldMap, 'host.name', 'service.name'),
       },
     });
-    // Temporarily exposing alerting client from rule-registry to allow registering of legacy rules
-    this.setupPlugins.alerting = this.setupPlugins.ruleRegistry.alertingPluginSetupContract;
 
     // Register reference rule types via rule-registry
     this.setupPlugins.ruleRegistry.registerType(referenceRuleAlertType);

From bdffdd5ffb098170725d04e0eeac03fa2967f738 Mon Sep 17 00:00:00 2001
From: Madison Caldwell <madison.caldwell@elastic.co>
Date: Sun, 4 Apr 2021 14:49:41 +0000
Subject: [PATCH 04/54] Initial commit - persistence + hierarchical ref rules

---
 x-pack/plugins/rule_registry/README.md        |   2 +
 x-pack/plugins/rule_registry/server/index.ts  |   4 +
 .../types.ts                                  |   2 +-
 .../rule_registry/defaults/field_map.ts       |  36 +++
 .../create_persistence_rule_type_factory.ts   | 118 +++++++++
 .../create_threshold_rule_type_factory.ts     | 234 ++++++++++++++++++
 x-pack/plugins/rule_registry/server/types.ts  |  12 +-
 .../security_solution/common/constants.ts     |   2 +
 .../reference_rules/reference_rule.ts         |  10 +-
 .../reference_rule_persistence.ts             |  74 ++++++
 .../create_reference_rule_hierarchical.sh     |  35 +++
 .../create_reference_rule_persistence.sh      |  32 +++
 .../security_solution/server/plugin.ts        |  16 +-
 13 files changed, 570 insertions(+), 7 deletions(-)
 create mode 100644 x-pack/plugins/rule_registry/server/rule_registry/defaults/field_map.ts
 create mode 100644 x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_persistence_rule_type_factory.ts
 create mode 100644 x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_threshold_rule_type_factory.ts
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/reference_rule_persistence.ts
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_hierarchical.sh
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_persistence.sh

diff --git a/x-pack/plugins/rule_registry/README.md b/x-pack/plugins/rule_registry/README.md
index 2c8f534a63d6b..a01bffc27d395 100644
--- a/x-pack/plugins/rule_registry/README.md
+++ b/x-pack/plugins/rule_registry/README.md
@@ -76,5 +76,7 @@ The following fields are available in the root rule registry:
 - `kibana.rac.alert.duration.us`: the duration of the alert, in microseconds. This is always the difference between either the current time, or the time when the alert recovered.
 - `kibana.rac.alert.severity.level`: the severity of the alert, as a keyword (e.g. critical).
 - `kibana.rac.alert.severity.value`: the severity of the alert, as a numerical value, which allows sorting.
+- `kibana.rac.alert.ancestors`: the array of ancestors (if any) for the alert.
+- `kibana.rac.alert.depth`: the depth of the alert in the ancestral tree (default 0).
 
 This list is not final - just a start. Field names might change or moved to a scoped registry. If we implement log and sequence based rule types the list of fields will grow. If a rule type needs additional fields, the recommendation would be to have the field in its own registry first (or in its producer’s registry), and if usage is more broadly adopted, it can be moved to the root registry.
diff --git a/x-pack/plugins/rule_registry/server/index.ts b/x-pack/plugins/rule_registry/server/index.ts
index 9fd1408fcdb21..667fdf4756511 100644
--- a/x-pack/plugins/rule_registry/server/index.ts
+++ b/x-pack/plugins/rule_registry/server/index.ts
@@ -11,6 +11,10 @@ import { RuleRegistryPlugin } from './plugin';
 
 export { RuleRegistryPluginSetupContract } from './plugin';
 export { createLifecycleRuleTypeFactory } from './rule_registry/rule_type_helpers/create_lifecycle_rule_type_factory';
+export { createPersistenceRuleTypeFactory } from './rule_registry/rule_type_helpers/create_persistence_rule_type_factory';
+export { createThresholdRuleTypeFactory } from './rule_registry/rule_type_helpers/create_threshold_rule_type_factory';
+export { ecsFieldMap } from './generated/ecs_field_map';
+export { pickWithPatterns } from './rule_registry/field_map/pick_with_patterns';
 export { FieldMapOf } from './types';
 export { ScopedRuleRegistryClient } from './rule_registry/create_scoped_rule_registry_client/types';
 
diff --git a/x-pack/plugins/rule_registry/server/rule_registry/create_scoped_rule_registry_client/types.ts b/x-pack/plugins/rule_registry/server/rule_registry/create_scoped_rule_registry_client/types.ts
index f7b2394fe3a32..0075064fe8990 100644
--- a/x-pack/plugins/rule_registry/server/rule_registry/create_scoped_rule_registry_client/types.ts
+++ b/x-pack/plugins/rule_registry/server/rule_registry/create_scoped_rule_registry_client/types.ts
@@ -25,7 +25,7 @@ type FieldsOf<TFieldMap extends BaseRuleFieldMap> =
 
 type Fields<TPattern extends string> = Array<{ field: TPattern } | TPattern> | TPattern;
 
-type FieldsESSearchRequest<TFieldMap extends BaseRuleFieldMap> = ESSearchRequest & {
+export type FieldsESSearchRequest<TFieldMap extends BaseRuleFieldMap> = ESSearchRequest & {
   body?: { fields: FieldsOf<TFieldMap> };
 };
 
diff --git a/x-pack/plugins/rule_registry/server/rule_registry/defaults/field_map.ts b/x-pack/plugins/rule_registry/server/rule_registry/defaults/field_map.ts
new file mode 100644
index 0000000000000..acdc915321a97
--- /dev/null
+++ b/x-pack/plugins/rule_registry/server/rule_registry/defaults/field_map.ts
@@ -0,0 +1,36 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ecsFieldMap } from '../../generated/ecs_field_map';
+import { pickWithPatterns } from '../field_map/pick_with_patterns';
+
+export const defaultFieldMap = {
+  ...pickWithPatterns(
+    ecsFieldMap,
+    '@timestamp',
+    'event.kind',
+    'event.action',
+    'rule.uuid',
+    'rule.id',
+    'rule.name',
+    'rule.category',
+    'tags'
+  ),
+  'kibana.rac.producer': { type: 'keyword' },
+  'kibana.rac.alert.uuid': { type: 'keyword' },
+  'kibana.rac.alert.id': { type: 'keyword' },
+  'kibana.rac.alert.start': { type: 'date' },
+  'kibana.rac.alert.end': { type: 'date' },
+  'kibana.rac.alert.duration.us': { type: 'long' },
+  'kibana.rac.alert.severity.level': { type: 'keyword' },
+  'kibana.rac.alert.severity.value': { type: 'long' },
+  'kibana.rac.alert.status': { type: 'keyword' },
+  'kibana.rac.alert.ancestors': { array: true, type: 'keyword' },
+  'kibana.rac.alert.depth': { type: 'long' },
+} as const;
+
+export type DefaultFieldMap = typeof defaultFieldMap;
diff --git a/x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_persistence_rule_type_factory.ts b/x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_persistence_rule_type_factory.ts
new file mode 100644
index 0000000000000..5caa493764cbb
--- /dev/null
+++ b/x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_persistence_rule_type_factory.ts
@@ -0,0 +1,118 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import v4 from 'uuid/v4';
+import { AlertInstance } from '../../../../alerting/server';
+import { ActionVariable, AlertInstanceState } from '../../../../alerting/common';
+import { RuleParams, RuleType } from '../../types';
+import { DefaultFieldMap, defaultFieldMap } from '../defaults/field_map';
+import { OutputOfFieldMap } from '../field_map/runtime_type_from_fieldmap';
+import { PrepopulatedRuleEventFields } from '../create_scoped_rule_registry_client/types';
+import { RuleRegistry } from '..';
+
+type UserDefinedAlertFields<TFieldMap extends DefaultFieldMap> = Omit<
+  OutputOfFieldMap<TFieldMap>,
+  | PrepopulatedRuleEventFields
+  | 'kibana.rac.alert.id'
+  | 'kibana.rac.alert.uuid'
+  | 'kibana.rac.alert.ancestors'
+  | 'kibana.rac.alert.depth'
+  | '@timestamp'
+>;
+
+type PersistenceAlertService<
+  TFieldMap extends DefaultFieldMap,
+  TActionVariable extends ActionVariable
+> = (
+  alerts: Array<UserDefinedAlertFields<TFieldMap>>
+) => Array<AlertInstance<AlertInstanceState, { [key in TActionVariable['name']]: any }, string>>;
+
+type CreatePersistenceRuleType<TFieldMap extends DefaultFieldMap> = <
+  TRuleParams extends RuleParams,
+  TActionVariable extends ActionVariable
+>(
+  type: RuleType<
+    TFieldMap,
+    TRuleParams,
+    TActionVariable,
+    { alertWithPersistence: PersistenceAlertService<TFieldMap, TActionVariable> }
+  >
+) => RuleType<TFieldMap, TRuleParams, TActionVariable>;
+
+export function createPersistenceRuleTypeFactory<
+  TRuleRegistry extends RuleRegistry<DefaultFieldMap>
+>(): TRuleRegistry extends RuleRegistry<infer TFieldMap>
+  ? CreatePersistenceRuleType<TFieldMap>
+  : never;
+
+export function createPersistenceRuleTypeFactory(): CreatePersistenceRuleType<DefaultFieldMap> {
+  return (type) => {
+    return {
+      ...type,
+      executor: async (options) => {
+        const {
+          services: { scopedRuleRegistryClient, alertInstanceFactory, logger },
+        } = options;
+
+        const currentAlerts: Array<
+          UserDefinedAlertFields<DefaultFieldMap> & {
+            'kibana.rac.alert.id': string;
+            'kibana.rac.alert.uuid': string;
+            'kibana.rac.alert.ancestors': string[];
+            'kibana.rac.alert.depth': number;
+            '@timestamp': string;
+          }
+        > = [];
+
+        const timestamp = options.startedAt.toISOString();
+
+        const query = type.query!(options);
+
+        const { events } = await scopedRuleRegistryClient!.search({
+          ...query,
+          body: {
+            ...query.body,
+            fields: Object.keys(defaultFieldMap),
+            // fields: query.body?.fields ?? ['*'],
+          },
+        });
+
+        // console.log('EVENTS');
+        // console.log(JSON.stringify(events));
+        events.forEach((event) => {
+          const alertUuid = event['kibana.rac.alert.uuid'];
+          const isAlert = alertUuid != null;
+
+          currentAlerts.push({
+            ...event,
+            'kibana.rac.alert.id': '???',
+            'kibana.rac.alert.uuid': v4(),
+            'kibana.rac.alert.ancestors': isAlert
+              ? (event['kibana.rac.alert.ancestors'] ?? []).concat([alertUuid!])
+              : [],
+            'kibana.rac.alert.depth': isAlert ? event['kibana.rac.alert.depth']! + 1 : 0,
+            'event.kind': 'signal',
+            '@timestamp': timestamp,
+          });
+        });
+
+        const alertInstances = currentAlerts.map((alert) =>
+          alertInstanceFactory(alert['kibana.rac.alert.uuid']!)
+        );
+        // TODO: schedule actions
+
+        const numAlerts = Object.keys(currentAlerts).length;
+        logger.debug(`Found ${numAlerts} alerts.`);
+
+        if (scopedRuleRegistryClient && numAlerts) {
+          await scopedRuleRegistryClient.bulkIndex(Object.values(currentAlerts));
+        }
+
+        return currentAlerts;
+      },
+    };
+  };
+}
diff --git a/x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_threshold_rule_type_factory.ts b/x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_threshold_rule_type_factory.ts
new file mode 100644
index 0000000000000..aeb5b3968e020
--- /dev/null
+++ b/x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_threshold_rule_type_factory.ts
@@ -0,0 +1,234 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import * as t from 'io-ts';
+import { isLeft } from 'fp-ts/lib/Either';
+import v4 from 'uuid/v4';
+import { AlertInstance } from '../../../../alerting/server';
+import { ActionVariable, AlertInstanceState } from '../../../../alerting/common';
+import { RuleParams, RuleType } from '../../types';
+import { DefaultFieldMap } from '../defaults/field_map';
+import { OutputOfFieldMap } from '../field_map/runtime_type_from_fieldmap';
+import { PrepopulatedRuleEventFields } from '../create_scoped_rule_registry_client/types';
+import { RuleRegistry } from '..';
+
+type UserDefinedAlertFields<TFieldMap extends DefaultFieldMap> = Omit<
+  OutputOfFieldMap<TFieldMap>,
+  PrepopulatedRuleEventFields | 'alert.id' | 'alert.uuid' | '@timestamp'
+>;
+
+type ThresholdAlertService<
+  TFieldMap extends DefaultFieldMap,
+  TActionVariable extends ActionVariable
+> = (alert: {
+  id: string;
+  fields: UserDefinedAlertFields<TFieldMap>;
+}) => AlertInstance<AlertInstanceState, { [key in TActionVariable['name']]: any }, string>;
+
+type CreateThresholdRuleType<TFieldMap extends DefaultFieldMap> = <
+  TRuleParams extends RuleParams,
+  TActionVariable extends ActionVariable
+>(
+  type: RuleType<
+    TFieldMap,
+    TRuleParams,
+    TActionVariable,
+    { alertWithThreshold: ThresholdAlertService<TFieldMap, TActionVariable> }
+  >
+) => RuleType<TFieldMap, TRuleParams, TActionVariable>;
+
+const trackedAlertStateRt = t.type({
+  alertId: t.string,
+  alertUuid: t.string,
+  started: t.string,
+});
+
+const wrappedStateRt = t.type({
+  wrapped: t.record(t.string, t.unknown),
+  trackedAlerts: t.record(t.string, trackedAlertStateRt),
+});
+
+export function createThresholdRuleTypeFactory<
+  TRuleRegistry extends RuleRegistry<DefaultFieldMap>
+>(): TRuleRegistry extends RuleRegistry<infer TFieldMap>
+  ? CreateThresholdRuleType<TFieldMap>
+  : never;
+
+export function createThresholdRuleTypeFactory(): CreateThresholdRuleType<DefaultFieldMap> {
+  return (type) => {
+    return {
+      ...type,
+      executor: async (options) => {
+        const {
+          services: { scopedRuleRegistryClient, alertInstanceFactory, logger },
+          state: previousState,
+          rule,
+        } = options;
+
+        const decodedState = wrappedStateRt.decode(previousState);
+
+        const state = isLeft(decodedState)
+          ? {
+              wrapped: previousState,
+              trackedAlerts: {},
+            }
+          : decodedState.right;
+
+        const currentAlerts: Record<
+          string,
+          UserDefinedAlertFields<DefaultFieldMap> & { 'alert.id': string }
+        > = {};
+
+        const timestamp = options.startedAt.toISOString();
+
+        const nextWrappedState = await type.executor({
+          ...options,
+          state: state.wrapped,
+          services: {
+            ...options.services,
+            alertWithThreshold: ({ id, fields }) => {
+              currentAlerts[id] = {
+                ...fields,
+                'alert.id': id,
+              };
+              return alertInstanceFactory(id);
+            },
+          },
+        });
+
+        const currentAlertIds = Object.keys(currentAlerts);
+        const trackedAlertIds = Object.keys(state.trackedAlerts);
+        const newAlertIds = currentAlertIds.filter((alertId) => !trackedAlertIds.includes(alertId));
+
+        const allAlertIds = [...new Set(currentAlertIds.concat(trackedAlertIds))];
+
+        const trackedAlertStatesOfRecovered = Object.values(state.trackedAlerts).filter(
+          (trackedAlertState) => !currentAlerts[trackedAlertState.alertId]
+        );
+
+        logger.debug(
+          `Tracking ${allAlertIds.length} alerts (${newAlertIds.length} new, ${trackedAlertStatesOfRecovered.length} recovered)`
+        );
+
+        const alertsDataMap: Record<string, UserDefinedAlertFields<DefaultFieldMap>> = {
+          ...currentAlerts,
+        };
+
+        if (trackedAlertStatesOfRecovered.length) {
+          const { events } = await scopedRuleRegistryClient.search({
+            body: {
+              query: {
+                bool: {
+                  filter: [
+                    {
+                      term: {
+                        'rule.uuid': rule.uuid,
+                      },
+                    },
+                    {
+                      terms: {
+                        'alert.uuid': trackedAlertStatesOfRecovered.map(
+                          (trackedAlertState) => trackedAlertState.alertUuid
+                        ),
+                      },
+                    },
+                  ],
+                },
+              },
+              size: trackedAlertStatesOfRecovered.length,
+              collapse: {
+                field: 'alert.uuid',
+              },
+              _source: false,
+              fields: ['*'],
+              sort: {
+                '@timestamp': 'desc' as const,
+              },
+            },
+          });
+
+          events.forEach((event) => {
+            const alertId = event['alert.id']!;
+            alertsDataMap[alertId] = event;
+          });
+        }
+
+        const eventsToIndex: Array<OutputOfFieldMap<DefaultFieldMap>> = allAlertIds.map(
+          (alertId) => {
+            const alertData = alertsDataMap[alertId];
+
+            if (!alertData) {
+              logger.warn(`Could not find alert data for ${alertId}`);
+            }
+
+            const event: OutputOfFieldMap<DefaultFieldMap> = {
+              ...alertData,
+              '@timestamp': timestamp,
+              'event.kind': 'state',
+              'alert.id': alertId,
+            };
+
+            const isNew = !state.trackedAlerts[alertId];
+            const isRecovered = !currentAlerts[alertId];
+            const isActiveButNotNew = !isNew && !isRecovered;
+            const isActive = !isRecovered;
+
+            const { alertUuid, started } = state.trackedAlerts[alertId] ?? {
+              alertUuid: v4(),
+              started: timestamp,
+            };
+
+            event['alert.start'] = started;
+            event['alert.uuid'] = alertUuid;
+
+            if (isNew) {
+              event['event.action'] = 'open';
+            }
+
+            if (isRecovered) {
+              event['alert.end'] = timestamp;
+              event['event.action'] = 'close';
+              event['alert.status'] = 'closed';
+            }
+
+            if (isActiveButNotNew) {
+              event['event.action'] = 'active';
+            }
+
+            if (isActive) {
+              event['alert.status'] = 'open';
+            }
+
+            event['alert.duration.us'] =
+              (options.startedAt.getTime() - new Date(event['alert.start']!).getTime()) * 1000;
+
+            return event;
+          }
+        );
+
+        if (eventsToIndex.length) {
+          await scopedRuleRegistryClient.bulkIndex(eventsToIndex);
+        }
+
+        const nextTrackedAlerts = Object.fromEntries(
+          eventsToIndex
+            .filter((event) => event['alert.status'] !== 'closed')
+            .map((event) => {
+              const alertId = event['alert.id']!;
+              const alertUuid = event['alert.uuid']!;
+              const started = new Date(event['alert.start']!).toISOString();
+              return [alertId, { alertId, alertUuid, started }];
+            })
+        );
+
+        return {
+          wrapped: nextWrappedState,
+          trackedAlerts: nextTrackedAlerts,
+        };
+      },
+    };
+  };
+}
diff --git a/x-pack/plugins/rule_registry/server/types.ts b/x-pack/plugins/rule_registry/server/types.ts
index dd54046365d98..afe497baa2ce4 100644
--- a/x-pack/plugins/rule_registry/server/types.ts
+++ b/x-pack/plugins/rule_registry/server/types.ts
@@ -15,8 +15,12 @@ import {
 } from '../../alerting/common';
 import { ActionGroup, AlertExecutorOptions } from '../../alerting/server';
 import { RuleRegistry } from './rule_registry';
-import { ScopedRuleRegistryClient } from './rule_registry/create_scoped_rule_registry_client/types';
 import { BaseRuleFieldMap } from '../common';
+import {
+  FieldsESSearchRequest,
+  ScopedRuleRegistryClient,
+} from './rule_registry/create_scoped_rule_registry_client/types';
+import { DefaultFieldMap } from './rule_registry/defaults/field_map';
 
 export type RuleParams = Type<any>;
 
@@ -66,6 +70,11 @@ type RuleExecutorFunction<
   }
 ) => Promise<Record<string, any>>;
 
+type RuleQueryFunction<
+  TFieldMap extends DefaultFieldMap,
+  TRuleParams extends RuleParams
+> = (options: { params: TypeOfRuleParams<TRuleParams> }) => FieldsESSearchRequest<TFieldMap>;
+
 interface RuleTypeBase {
   id: string;
   name: string;
@@ -93,6 +102,7 @@ export type RuleType<
     TActionVariable,
     TAdditionalRuleExecutorServices
   >;
+  query?: RuleQueryFunction<TFieldMap, TRuleParams>;
 };
 
 export type FieldMapOf<
diff --git a/x-pack/plugins/security_solution/common/constants.ts b/x-pack/plugins/security_solution/common/constants.ts
index 706318b44f628..eb934b62f3a87 100644
--- a/x-pack/plugins/security_solution/common/constants.ts
+++ b/x-pack/plugins/security_solution/common/constants.ts
@@ -152,6 +152,8 @@ export const SIGNALS_ID = `siem.signals`;
  * Id's for reference rule types
  */
 export const REFERENCE_RULE_ALERT_TYPE_ID = `siem.referenceRule`;
+export const REFERENCE_RULE_HIERARCHICAL_ALERT_TYPE_ID = `siem.referenceRuleHierarchical`;
+export const REFERENCE_RULE_PERSISTENCE_ALERT_TYPE_ID = `siem.referenceRulePersistence`;
 
 /**
  * Id for the notifications alerting type
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/reference_rule.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/reference_rule.ts
index 4d9ed4feefe46..74dd4f93f064c 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/reference_rule.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/reference_rule.ts
@@ -9,8 +9,12 @@ import { schema } from '@kbn/config-schema';
 
 import { v4 as uuidv4 } from 'uuid';
 
-import { createLifecycleRuleTypeFactory } from '../../../../../rule_registry/server';
-import { REFERENCE_RULE_ALERT_TYPE_ID } from '../../../../common/constants';
+import {
+  createLifecycleRuleTypeFactory,
+} from '../../../../../rule_registry/server';
+import {
+  REFERENCE_RULE_ALERT_TYPE_ID,
+} from '../../../../common/constants';
 import { SecurityRuleRegistry } from '../../../plugin';
 
 const createSecurityLifecycleRuleType = createLifecycleRuleTypeFactory<SecurityRuleRegistry>();
@@ -56,4 +60,4 @@ export const referenceRuleAlertType = createSecurityLifecycleRuleType({
       lastChecked: new Date(),
     };
   },
-});
+});
\ No newline at end of file
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/reference_rule_persistence.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/reference_rule_persistence.ts
new file mode 100644
index 0000000000000..775bf0c7c2f97
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/reference_rule_persistence.ts
@@ -0,0 +1,74 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { schema } from '@kbn/config-schema';
+
+import { buildEsQuery, IIndexPattern } from '../../../../../../../src/plugins/data/common';
+
+import { createPersistenceRuleTypeFactory } from '../../../../../rule_registry/server';
+import { REFERENCE_RULE_PERSISTENCE_ALERT_TYPE_ID } from '../../../../common/constants';
+import { SecurityRuleRegistry } from '../../../plugin';
+
+const createSecurityPersistenceRuleType = createPersistenceRuleTypeFactory<SecurityRuleRegistry>();
+
+export const referenceRulePersistenceAlertType = createSecurityPersistenceRuleType({
+  id: REFERENCE_RULE_PERSISTENCE_ALERT_TYPE_ID,
+  name: 'ReferenceRule persistence alert type',
+  validate: {
+    params: schema.object({
+      query: schema.string(),
+    }),
+  },
+  actionGroups: [
+    {
+      id: 'default',
+      name: 'Default',
+    },
+    {
+      id: 'warning',
+      name: 'Warning',
+    },
+  ],
+  defaultActionGroupId: 'default',
+  actionVariables: {
+    context: [
+      { name: 'server', description: 'the server' },
+      {
+        name: 'hasCpuUsageIncreased',
+        description: 'boolean indicating if the cpu usage has increased',
+      },
+    ],
+  },
+  minimumLicenseRequired: 'basic',
+  producer: 'security-solution',
+  query({ params: { query } }) {
+    const indexPattern: IIndexPattern = {
+      fields: [],
+      title: '*',
+    };
+
+    const esQuery = buildEsQuery(indexPattern, { query, language: 'kuery' }, []);
+    return {
+      index: ['*'],
+      body: {
+        query: {
+          bool: {
+            must: esQuery.bool.must,
+          },
+        },
+        fields: ['*'],
+        sort: {
+          '@timestamp': 'asc' as const,
+        },
+      },
+    };
+  },
+  // TODO: do we need a user-defined executor?
+  async executor({ services, params }) {
+    return {};
+  },
+});
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_hierarchical.sh b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_hierarchical.sh
new file mode 100644
index 0000000000000..fbd8829fb6324
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_hierarchical.sh
@@ -0,0 +1,35 @@
+#!/bin/sh
+#
+# Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+# or more contributor license agreements. Licensed under the Elastic License
+# 2.0; you may not use this file except in compliance with the Elastic License
+# 2.0.
+#
+
+# TODO: create a persistence rule matching against `signal.rule.id`
+# (the id of the rule type) or whatever the equivalent field is.
+# Have the persistence rule create those fields on the alert.
+curl -X POST http://localhost:5601/${BASE_PATH}/api/alerts/alert \
+     -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
+     -H 'kbn-xsrf: true' \
+     -H 'Content-Type: application/json' \
+     --verbose \
+     -d '
+{
+  "params":{
+      "query": "rule.id:siem.referenceRule"
+   },
+   "consumer":"alerts",
+   "alertTypeId":"siem.referenceRulePersistence",
+   "schedule":{
+      "interval":"1m"
+   },
+   "actions":[],
+   "tags":[
+      "cpu"
+   ],
+   "notifyWhen":"onActionGroupChange",
+   "name":"Oh hai world!"
+}'
+
+
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_persistence.sh b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_persistence.sh
new file mode 100644
index 0000000000000..8b6e01d10040a
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_persistence.sh
@@ -0,0 +1,32 @@
+#!/bin/sh
+#
+# Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+# or more contributor license agreements. Licensed under the Elastic License
+# 2.0; you may not use this file except in compliance with the Elastic License
+# 2.0.
+#
+
+curl -X POST http://localhost:5601/${BASE_PATH}/api/alerts/alert \
+     -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
+     -H 'kbn-xsrf: true' \
+     -H 'Content-Type: application/json' \
+     --verbose \
+     -d '
+{
+  "params":{
+     "query": "*:*"
+   },
+   "consumer":"alerts",
+   "alertTypeId":"siem.referenceRulePersistence",
+   "schedule":{
+      "interval":"1m"
+   },
+   "actions":[],
+   "tags":[
+      "cpu"
+   ],
+   "notifyWhen":"onActionGroupChange",
+   "name":"Oh hai world!"
+}'
+
+
diff --git a/x-pack/plugins/security_solution/server/plugin.ts b/x-pack/plugins/security_solution/server/plugin.ts
index a2bcbf4979596..b5e308fcef923 100644
--- a/x-pack/plugins/security_solution/server/plugin.ts
+++ b/x-pack/plugins/security_solution/server/plugin.ts
@@ -42,7 +42,12 @@ import { ILicense, LicensingPluginStart } from '../../licensing/server';
 import { FleetStartContract } from '../../fleet/server';
 import { TaskManagerSetupContract, TaskManagerStartContract } from '../../task_manager/server';
 import { compose } from './lib/compose/kibana';
-import { referenceRuleAlertType } from './lib/detection_engine/reference_rules/reference_rule';
+import {
+  referenceRuleAlertType,
+} from './lib/detection_engine/reference_rules/reference_rule';
+import {
+  referenceRulePersistenceAlertType,
+} from './lib/detection_engine/reference_rules/reference_rule_persistence';
 import { initRoutes } from './routes';
 import { isAlertExecutor } from './lib/detection_engine/signals/types';
 import { signalRulesAlertType } from './lib/detection_engine/signals/signal_rule_alert_type';
@@ -60,6 +65,8 @@ import {
   SIGNALS_ID,
   NOTIFICATIONS_ID,
   REFERENCE_RULE_ALERT_TYPE_ID,
+  REFERENCE_RULE_HIERARCHICAL_ALERT_TYPE_ID,
+  REFERENCE_RULE_PERSISTENCE_ALERT_TYPE_ID,
 } from '../common/constants';
 import { registerEndpointRoutes } from './endpoint/routes/metadata';
 import { registerLimitedConcurrencyRoutes } from './endpoint/routes/limited_concurrency';
@@ -219,7 +226,11 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
     registerTrustedAppsRoutes(router, endpointContext);
     registerHostIsolationRoutes(router, endpointContext);
 
-    const referenceRuleTypes = [REFERENCE_RULE_ALERT_TYPE_ID];
+    const referenceRuleTypes = [
+      REFERENCE_RULE_ALERT_TYPE_ID,
+      REFERENCE_RULE_HIERARCHICAL_ALERT_TYPE_ID,
+      REFERENCE_RULE_PERSISTENCE_ALERT_TYPE_ID,
+    ];
     const ruleTypes = [SIGNALS_ID, NOTIFICATIONS_ID, ...referenceRuleTypes];
 
     plugins.features.registerKibanaFeature({
@@ -293,6 +304,7 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
 
     // Register reference rule types via rule-registry
     this.setupPlugins.ruleRegistry.registerType(referenceRuleAlertType);
+    this.setupPlugins.ruleRegistry.registerType(referenceRulePersistenceAlertType);
 
     // Continue to register legacy rules against alerting client exposed through rule-registry
     if (this.setupPlugins.alerting != null) {

From 78b5d2ba8badc1b6f1dca27c25acd407468de8b8 Mon Sep 17 00:00:00 2001
From: Madison Caldwell <madison.caldwell@elastic.co>
Date: Mon, 12 Apr 2021 23:05:06 +0000
Subject: [PATCH 05/54] Remove threshold for now

---
 x-pack/plugins/rule_registry/server/index.ts  |   1 -
 .../create_threshold_rule_type_factory.ts     | 234 ------------------
 2 files changed, 235 deletions(-)
 delete mode 100644 x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_threshold_rule_type_factory.ts

diff --git a/x-pack/plugins/rule_registry/server/index.ts b/x-pack/plugins/rule_registry/server/index.ts
index 667fdf4756511..61d172bc63f90 100644
--- a/x-pack/plugins/rule_registry/server/index.ts
+++ b/x-pack/plugins/rule_registry/server/index.ts
@@ -12,7 +12,6 @@ import { RuleRegistryPlugin } from './plugin';
 export { RuleRegistryPluginSetupContract } from './plugin';
 export { createLifecycleRuleTypeFactory } from './rule_registry/rule_type_helpers/create_lifecycle_rule_type_factory';
 export { createPersistenceRuleTypeFactory } from './rule_registry/rule_type_helpers/create_persistence_rule_type_factory';
-export { createThresholdRuleTypeFactory } from './rule_registry/rule_type_helpers/create_threshold_rule_type_factory';
 export { ecsFieldMap } from './generated/ecs_field_map';
 export { pickWithPatterns } from './rule_registry/field_map/pick_with_patterns';
 export { FieldMapOf } from './types';
diff --git a/x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_threshold_rule_type_factory.ts b/x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_threshold_rule_type_factory.ts
deleted file mode 100644
index aeb5b3968e020..0000000000000
--- a/x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_threshold_rule_type_factory.ts
+++ /dev/null
@@ -1,234 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-import * as t from 'io-ts';
-import { isLeft } from 'fp-ts/lib/Either';
-import v4 from 'uuid/v4';
-import { AlertInstance } from '../../../../alerting/server';
-import { ActionVariable, AlertInstanceState } from '../../../../alerting/common';
-import { RuleParams, RuleType } from '../../types';
-import { DefaultFieldMap } from '../defaults/field_map';
-import { OutputOfFieldMap } from '../field_map/runtime_type_from_fieldmap';
-import { PrepopulatedRuleEventFields } from '../create_scoped_rule_registry_client/types';
-import { RuleRegistry } from '..';
-
-type UserDefinedAlertFields<TFieldMap extends DefaultFieldMap> = Omit<
-  OutputOfFieldMap<TFieldMap>,
-  PrepopulatedRuleEventFields | 'alert.id' | 'alert.uuid' | '@timestamp'
->;
-
-type ThresholdAlertService<
-  TFieldMap extends DefaultFieldMap,
-  TActionVariable extends ActionVariable
-> = (alert: {
-  id: string;
-  fields: UserDefinedAlertFields<TFieldMap>;
-}) => AlertInstance<AlertInstanceState, { [key in TActionVariable['name']]: any }, string>;
-
-type CreateThresholdRuleType<TFieldMap extends DefaultFieldMap> = <
-  TRuleParams extends RuleParams,
-  TActionVariable extends ActionVariable
->(
-  type: RuleType<
-    TFieldMap,
-    TRuleParams,
-    TActionVariable,
-    { alertWithThreshold: ThresholdAlertService<TFieldMap, TActionVariable> }
-  >
-) => RuleType<TFieldMap, TRuleParams, TActionVariable>;
-
-const trackedAlertStateRt = t.type({
-  alertId: t.string,
-  alertUuid: t.string,
-  started: t.string,
-});
-
-const wrappedStateRt = t.type({
-  wrapped: t.record(t.string, t.unknown),
-  trackedAlerts: t.record(t.string, trackedAlertStateRt),
-});
-
-export function createThresholdRuleTypeFactory<
-  TRuleRegistry extends RuleRegistry<DefaultFieldMap>
->(): TRuleRegistry extends RuleRegistry<infer TFieldMap>
-  ? CreateThresholdRuleType<TFieldMap>
-  : never;
-
-export function createThresholdRuleTypeFactory(): CreateThresholdRuleType<DefaultFieldMap> {
-  return (type) => {
-    return {
-      ...type,
-      executor: async (options) => {
-        const {
-          services: { scopedRuleRegistryClient, alertInstanceFactory, logger },
-          state: previousState,
-          rule,
-        } = options;
-
-        const decodedState = wrappedStateRt.decode(previousState);
-
-        const state = isLeft(decodedState)
-          ? {
-              wrapped: previousState,
-              trackedAlerts: {},
-            }
-          : decodedState.right;
-
-        const currentAlerts: Record<
-          string,
-          UserDefinedAlertFields<DefaultFieldMap> & { 'alert.id': string }
-        > = {};
-
-        const timestamp = options.startedAt.toISOString();
-
-        const nextWrappedState = await type.executor({
-          ...options,
-          state: state.wrapped,
-          services: {
-            ...options.services,
-            alertWithThreshold: ({ id, fields }) => {
-              currentAlerts[id] = {
-                ...fields,
-                'alert.id': id,
-              };
-              return alertInstanceFactory(id);
-            },
-          },
-        });
-
-        const currentAlertIds = Object.keys(currentAlerts);
-        const trackedAlertIds = Object.keys(state.trackedAlerts);
-        const newAlertIds = currentAlertIds.filter((alertId) => !trackedAlertIds.includes(alertId));
-
-        const allAlertIds = [...new Set(currentAlertIds.concat(trackedAlertIds))];
-
-        const trackedAlertStatesOfRecovered = Object.values(state.trackedAlerts).filter(
-          (trackedAlertState) => !currentAlerts[trackedAlertState.alertId]
-        );
-
-        logger.debug(
-          `Tracking ${allAlertIds.length} alerts (${newAlertIds.length} new, ${trackedAlertStatesOfRecovered.length} recovered)`
-        );
-
-        const alertsDataMap: Record<string, UserDefinedAlertFields<DefaultFieldMap>> = {
-          ...currentAlerts,
-        };
-
-        if (trackedAlertStatesOfRecovered.length) {
-          const { events } = await scopedRuleRegistryClient.search({
-            body: {
-              query: {
-                bool: {
-                  filter: [
-                    {
-                      term: {
-                        'rule.uuid': rule.uuid,
-                      },
-                    },
-                    {
-                      terms: {
-                        'alert.uuid': trackedAlertStatesOfRecovered.map(
-                          (trackedAlertState) => trackedAlertState.alertUuid
-                        ),
-                      },
-                    },
-                  ],
-                },
-              },
-              size: trackedAlertStatesOfRecovered.length,
-              collapse: {
-                field: 'alert.uuid',
-              },
-              _source: false,
-              fields: ['*'],
-              sort: {
-                '@timestamp': 'desc' as const,
-              },
-            },
-          });
-
-          events.forEach((event) => {
-            const alertId = event['alert.id']!;
-            alertsDataMap[alertId] = event;
-          });
-        }
-
-        const eventsToIndex: Array<OutputOfFieldMap<DefaultFieldMap>> = allAlertIds.map(
-          (alertId) => {
-            const alertData = alertsDataMap[alertId];
-
-            if (!alertData) {
-              logger.warn(`Could not find alert data for ${alertId}`);
-            }
-
-            const event: OutputOfFieldMap<DefaultFieldMap> = {
-              ...alertData,
-              '@timestamp': timestamp,
-              'event.kind': 'state',
-              'alert.id': alertId,
-            };
-
-            const isNew = !state.trackedAlerts[alertId];
-            const isRecovered = !currentAlerts[alertId];
-            const isActiveButNotNew = !isNew && !isRecovered;
-            const isActive = !isRecovered;
-
-            const { alertUuid, started } = state.trackedAlerts[alertId] ?? {
-              alertUuid: v4(),
-              started: timestamp,
-            };
-
-            event['alert.start'] = started;
-            event['alert.uuid'] = alertUuid;
-
-            if (isNew) {
-              event['event.action'] = 'open';
-            }
-
-            if (isRecovered) {
-              event['alert.end'] = timestamp;
-              event['event.action'] = 'close';
-              event['alert.status'] = 'closed';
-            }
-
-            if (isActiveButNotNew) {
-              event['event.action'] = 'active';
-            }
-
-            if (isActive) {
-              event['alert.status'] = 'open';
-            }
-
-            event['alert.duration.us'] =
-              (options.startedAt.getTime() - new Date(event['alert.start']!).getTime()) * 1000;
-
-            return event;
-          }
-        );
-
-        if (eventsToIndex.length) {
-          await scopedRuleRegistryClient.bulkIndex(eventsToIndex);
-        }
-
-        const nextTrackedAlerts = Object.fromEntries(
-          eventsToIndex
-            .filter((event) => event['alert.status'] !== 'closed')
-            .map((event) => {
-              const alertId = event['alert.id']!;
-              const alertUuid = event['alert.uuid']!;
-              const started = new Date(event['alert.start']!).toISOString();
-              return [alertId, { alertId, alertUuid, started }];
-            })
-        );
-
-        return {
-          wrapped: nextWrappedState,
-          trackedAlerts: nextTrackedAlerts,
-        };
-      },
-    };
-  };
-}

From f0c8a7a1db8b30b6031ee7442b8571a63575e910 Mon Sep 17 00:00:00 2001
From: Madison Caldwell <madison.caldwell@elastic.co>
Date: Tue, 13 Apr 2021 12:36:00 +0000
Subject: [PATCH 06/54] Remove hierarchical type

---
 x-pack/plugins/security_solution/common/constants.ts |  1 -
 x-pack/plugins/security_solution/server/plugin.ts    | 10 ++--------
 2 files changed, 2 insertions(+), 9 deletions(-)

diff --git a/x-pack/plugins/security_solution/common/constants.ts b/x-pack/plugins/security_solution/common/constants.ts
index eb934b62f3a87..5f376c1515126 100644
--- a/x-pack/plugins/security_solution/common/constants.ts
+++ b/x-pack/plugins/security_solution/common/constants.ts
@@ -152,7 +152,6 @@ export const SIGNALS_ID = `siem.signals`;
  * Id's for reference rule types
  */
 export const REFERENCE_RULE_ALERT_TYPE_ID = `siem.referenceRule`;
-export const REFERENCE_RULE_HIERARCHICAL_ALERT_TYPE_ID = `siem.referenceRuleHierarchical`;
 export const REFERENCE_RULE_PERSISTENCE_ALERT_TYPE_ID = `siem.referenceRulePersistence`;
 
 /**
diff --git a/x-pack/plugins/security_solution/server/plugin.ts b/x-pack/plugins/security_solution/server/plugin.ts
index b5e308fcef923..86537a48b3f30 100644
--- a/x-pack/plugins/security_solution/server/plugin.ts
+++ b/x-pack/plugins/security_solution/server/plugin.ts
@@ -42,12 +42,8 @@ import { ILicense, LicensingPluginStart } from '../../licensing/server';
 import { FleetStartContract } from '../../fleet/server';
 import { TaskManagerSetupContract, TaskManagerStartContract } from '../../task_manager/server';
 import { compose } from './lib/compose/kibana';
-import {
-  referenceRuleAlertType,
-} from './lib/detection_engine/reference_rules/reference_rule';
-import {
-  referenceRulePersistenceAlertType,
-} from './lib/detection_engine/reference_rules/reference_rule_persistence';
+import { referenceRuleAlertType } from './lib/detection_engine/reference_rules/reference_rule';
+import { referenceRulePersistenceAlertType } from './lib/detection_engine/reference_rules/reference_rule_persistence';
 import { initRoutes } from './routes';
 import { isAlertExecutor } from './lib/detection_engine/signals/types';
 import { signalRulesAlertType } from './lib/detection_engine/signals/signal_rule_alert_type';
@@ -65,7 +61,6 @@ import {
   SIGNALS_ID,
   NOTIFICATIONS_ID,
   REFERENCE_RULE_ALERT_TYPE_ID,
-  REFERENCE_RULE_HIERARCHICAL_ALERT_TYPE_ID,
   REFERENCE_RULE_PERSISTENCE_ALERT_TYPE_ID,
 } from '../common/constants';
 import { registerEndpointRoutes } from './endpoint/routes/metadata';
@@ -228,7 +223,6 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
 
     const referenceRuleTypes = [
       REFERENCE_RULE_ALERT_TYPE_ID,
-      REFERENCE_RULE_HIERARCHICAL_ALERT_TYPE_ID,
       REFERENCE_RULE_PERSISTENCE_ALERT_TYPE_ID,
     ];
     const ruleTypes = [SIGNALS_ID, NOTIFICATIONS_ID, ...referenceRuleTypes];

From fde5b14e5a1926d8a334900e4554796851391502 Mon Sep 17 00:00:00 2001
From: Madison Caldwell <madison.caldwell@elastic.co>
Date: Tue, 13 Apr 2021 19:33:05 +0000
Subject: [PATCH 07/54] First implementation of new design

---
 .../create_persistence_rule_type_factory.ts   | 105 ++++++++----------
 x-pack/plugins/rule_registry/server/types.ts  |  12 +-
 .../reference_rule_persistence.ts             |  21 ++--
 3 files changed, 61 insertions(+), 77 deletions(-)

diff --git a/x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_persistence_rule_type_factory.ts b/x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_persistence_rule_type_factory.ts
index 5caa493764cbb..d9d0ec935c115 100644
--- a/x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_persistence_rule_type_factory.ts
+++ b/x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_persistence_rule_type_factory.ts
@@ -8,28 +8,22 @@ import v4 from 'uuid/v4';
 import { AlertInstance } from '../../../../alerting/server';
 import { ActionVariable, AlertInstanceState } from '../../../../alerting/common';
 import { RuleParams, RuleType } from '../../types';
-import { DefaultFieldMap, defaultFieldMap } from '../defaults/field_map';
+import { DefaultFieldMap } from '../defaults/field_map';
 import { OutputOfFieldMap } from '../field_map/runtime_type_from_fieldmap';
-import { PrepopulatedRuleEventFields } from '../create_scoped_rule_registry_client/types';
+import { FieldsESSearchRequest } from '../create_scoped_rule_registry_client/types';
 import { RuleRegistry } from '..';
 
-type UserDefinedAlertFields<TFieldMap extends DefaultFieldMap> = Omit<
-  OutputOfFieldMap<TFieldMap>,
-  | PrepopulatedRuleEventFields
-  | 'kibana.rac.alert.id'
-  | 'kibana.rac.alert.uuid'
-  | 'kibana.rac.alert.ancestors'
-  | 'kibana.rac.alert.depth'
-  | '@timestamp'
->;
-
-type PersistenceAlertService<
+type PersistenceAlertPersistenceService<
   TFieldMap extends DefaultFieldMap,
   TActionVariable extends ActionVariable
 > = (
-  alerts: Array<UserDefinedAlertFields<TFieldMap>>
+  alerts: Array<OutputOfFieldMap<TFieldMap>>
 ) => Array<AlertInstance<AlertInstanceState, { [key in TActionVariable['name']]: any }, string>>;
 
+type PersistenceAlertQueryService<TFieldMap extends DefaultFieldMap> = (
+  query: FieldsESSearchRequest<TFieldMap>
+) => Promise<Array<OutputOfFieldMap<TFieldMap>>>;
+
 type CreatePersistenceRuleType<TFieldMap extends DefaultFieldMap> = <
   TRuleParams extends RuleParams,
   TActionVariable extends ActionVariable
@@ -38,7 +32,10 @@ type CreatePersistenceRuleType<TFieldMap extends DefaultFieldMap> = <
     TFieldMap,
     TRuleParams,
     TActionVariable,
-    { alertWithPersistence: PersistenceAlertService<TFieldMap, TActionVariable> }
+    {
+      alertWithPersistence: PersistenceAlertPersistenceService<TFieldMap, TActionVariable>;
+      findAlerts: PersistenceAlertQueryService<TFieldMap>;
+    }
   >
 ) => RuleType<TFieldMap, TRuleParams, TActionVariable>;
 
@@ -57,58 +54,50 @@ export function createPersistenceRuleTypeFactory(): CreatePersistenceRuleType<De
           services: { scopedRuleRegistryClient, alertInstanceFactory, logger },
         } = options;
 
-        const currentAlerts: Array<
-          UserDefinedAlertFields<DefaultFieldMap> & {
-            'kibana.rac.alert.id': string;
-            'kibana.rac.alert.uuid': string;
-            'kibana.rac.alert.ancestors': string[];
-            'kibana.rac.alert.depth': number;
-            '@timestamp': string;
-          }
-        > = [];
-
-        const timestamp = options.startedAt.toISOString();
-
-        const query = type.query!(options);
+        const currentAlerts: Array<OutputOfFieldMap<DefaultFieldMap>> = [];
 
-        const { events } = await scopedRuleRegistryClient!.search({
-          ...query,
-          body: {
-            ...query.body,
-            fields: Object.keys(defaultFieldMap),
-            // fields: query.body?.fields ?? ['*'],
+        await type.executor({
+          ...options,
+          services: {
+            ...options.services,
+            alertWithPersistence: (alerts) => {
+              alerts.forEach((alert) => currentAlerts.push(alert));
+              return alerts.map((alert) => alertInstanceFactory(alert['kibana.rac.alert.uuid']!));
+            },
+            findAlerts: async (query) => {
+              const { events } = await scopedRuleRegistryClient!.search({
+                ...query,
+                body: {
+                  ...query.body,
+                  fields: ['*'], // FIXME
+                },
+              });
+              return events.map((event) => {
+                const alertUuid = event['kibana.rac.alert.uuid'];
+                const isAlert = alertUuid != null;
+                return {
+                  ...event,
+                  'kibana.rac.alert.id': '???',
+                  'kibana.rac.alert.uuid': v4(),
+                  'kibana.rac.alert.ancestors': isAlert
+                    ? (event['kibana.rac.alert.ancestors'] ?? []).concat([alertUuid!])
+                    : [],
+                  'kibana.rac.alert.depth': isAlert ? event['kibana.rac.alert.depth']! + 1 : 0,
+                  'event.kind': 'signal',
+                  '@timestamp': timestamp,
+                };
+              });
+            },
           },
         });
 
-        // console.log('EVENTS');
-        // console.log(JSON.stringify(events));
-        events.forEach((event) => {
-          const alertUuid = event['kibana.rac.alert.uuid'];
-          const isAlert = alertUuid != null;
-
-          currentAlerts.push({
-            ...event,
-            'kibana.rac.alert.id': '???',
-            'kibana.rac.alert.uuid': v4(),
-            'kibana.rac.alert.ancestors': isAlert
-              ? (event['kibana.rac.alert.ancestors'] ?? []).concat([alertUuid!])
-              : [],
-            'kibana.rac.alert.depth': isAlert ? event['kibana.rac.alert.depth']! + 1 : 0,
-            'event.kind': 'signal',
-            '@timestamp': timestamp,
-          });
-        });
-
-        const alertInstances = currentAlerts.map((alert) =>
-          alertInstanceFactory(alert['kibana.rac.alert.uuid']!)
-        );
-        // TODO: schedule actions
+        const timestamp = options.startedAt.toISOString();
 
         const numAlerts = Object.keys(currentAlerts).length;
         logger.debug(`Found ${numAlerts} alerts.`);
 
         if (scopedRuleRegistryClient && numAlerts) {
-          await scopedRuleRegistryClient.bulkIndex(Object.values(currentAlerts));
+          await scopedRuleRegistryClient.bulkIndex(currentAlerts);
         }
 
         return currentAlerts;
diff --git a/x-pack/plugins/rule_registry/server/types.ts b/x-pack/plugins/rule_registry/server/types.ts
index afe497baa2ce4..0a207217eadb5 100644
--- a/x-pack/plugins/rule_registry/server/types.ts
+++ b/x-pack/plugins/rule_registry/server/types.ts
@@ -16,11 +16,7 @@ import {
 import { ActionGroup, AlertExecutorOptions } from '../../alerting/server';
 import { RuleRegistry } from './rule_registry';
 import { BaseRuleFieldMap } from '../common';
-import {
-  FieldsESSearchRequest,
-  ScopedRuleRegistryClient,
-} from './rule_registry/create_scoped_rule_registry_client/types';
-import { DefaultFieldMap } from './rule_registry/defaults/field_map';
+import { ScopedRuleRegistryClient } from './rule_registry/create_scoped_rule_registry_client/types';
 
 export type RuleParams = Type<any>;
 
@@ -70,11 +66,6 @@ type RuleExecutorFunction<
   }
 ) => Promise<Record<string, any>>;
 
-type RuleQueryFunction<
-  TFieldMap extends DefaultFieldMap,
-  TRuleParams extends RuleParams
-> = (options: { params: TypeOfRuleParams<TRuleParams> }) => FieldsESSearchRequest<TFieldMap>;
-
 interface RuleTypeBase {
   id: string;
   name: string;
@@ -102,7 +93,6 @@ export type RuleType<
     TActionVariable,
     TAdditionalRuleExecutorServices
   >;
-  query?: RuleQueryFunction<TFieldMap, TRuleParams>;
 };
 
 export type FieldMapOf<
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/reference_rule_persistence.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/reference_rule_persistence.ts
index 775bf0c7c2f97..76671207ba03c 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/reference_rule_persistence.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/reference_rule_persistence.ts
@@ -45,19 +45,19 @@ export const referenceRulePersistenceAlertType = createSecurityPersistenceRuleTy
   },
   minimumLicenseRequired: 'basic',
   producer: 'security-solution',
-  query({ params: { query } }) {
+  async executor({ services: { alertWithPersistence, findAlerts }, params }) {
     const indexPattern: IIndexPattern = {
       fields: [],
       title: '*',
     };
 
-    const esQuery = buildEsQuery(indexPattern, { query, language: 'kuery' }, []);
-    return {
+    const esQuery = buildEsQuery(indexPattern, { query: params.query, language: 'kuery' }, []);
+    const query = {
       index: ['*'],
       body: {
         query: {
           bool: {
-            must: esQuery.bool.must,
+            must: esQuery.bool.must, // FIXME
           },
         },
         fields: ['*'],
@@ -66,9 +66,14 @@ export const referenceRulePersistenceAlertType = createSecurityPersistenceRuleTy
         },
       },
     };
-  },
-  // TODO: do we need a user-defined executor?
-  async executor({ services, params }) {
-    return {};
+
+    const alerts = await findAlerts(query);
+    alertWithPersistence(alerts).forEach((alert) => {
+      alert.scheduleActions('action-group-tbd', {});
+    });
+
+    return {
+      lastChecked: new Date(),
+    };
   },
 });

From 29d39389a435d86320fc264179c09258dc3d003d Mon Sep 17 00:00:00 2001
From: Madison Caldwell <madison.caldwell@elastic.co>
Date: Wed, 14 Apr 2021 02:49:07 +0000
Subject: [PATCH 08/54] Use scopedClusterClient for query

---
 .../types.ts                                  |  2 +-
 .../create_persistence_rule_type_factory.ts   | 46 +++++++++----------
 .../reference_rule_persistence.ts             |  1 -
 3 files changed, 24 insertions(+), 25 deletions(-)

diff --git a/x-pack/plugins/rule_registry/server/rule_registry/create_scoped_rule_registry_client/types.ts b/x-pack/plugins/rule_registry/server/rule_registry/create_scoped_rule_registry_client/types.ts
index 0075064fe8990..f7b2394fe3a32 100644
--- a/x-pack/plugins/rule_registry/server/rule_registry/create_scoped_rule_registry_client/types.ts
+++ b/x-pack/plugins/rule_registry/server/rule_registry/create_scoped_rule_registry_client/types.ts
@@ -25,7 +25,7 @@ type FieldsOf<TFieldMap extends BaseRuleFieldMap> =
 
 type Fields<TPattern extends string> = Array<{ field: TPattern } | TPattern> | TPattern;
 
-export type FieldsESSearchRequest<TFieldMap extends BaseRuleFieldMap> = ESSearchRequest & {
+type FieldsESSearchRequest<TFieldMap extends BaseRuleFieldMap> = ESSearchRequest & {
   body?: { fields: FieldsOf<TFieldMap> };
 };
 
diff --git a/x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_persistence_rule_type_factory.ts b/x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_persistence_rule_type_factory.ts
index d9d0ec935c115..c5fcb01c25dcc 100644
--- a/x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_persistence_rule_type_factory.ts
+++ b/x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_persistence_rule_type_factory.ts
@@ -4,13 +4,14 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
+import { ESSearchRequest } from 'typings/elasticsearch';
 import v4 from 'uuid/v4';
+
 import { AlertInstance } from '../../../../alerting/server';
 import { ActionVariable, AlertInstanceState } from '../../../../alerting/common';
 import { RuleParams, RuleType } from '../../types';
 import { DefaultFieldMap } from '../defaults/field_map';
 import { OutputOfFieldMap } from '../field_map/runtime_type_from_fieldmap';
-import { FieldsESSearchRequest } from '../create_scoped_rule_registry_client/types';
 import { RuleRegistry } from '..';
 
 type PersistenceAlertPersistenceService<
@@ -21,7 +22,7 @@ type PersistenceAlertPersistenceService<
 ) => Array<AlertInstance<AlertInstanceState, { [key in TActionVariable['name']]: any }, string>>;
 
 type PersistenceAlertQueryService<TFieldMap extends DefaultFieldMap> = (
-  query: FieldsESSearchRequest<TFieldMap>
+  query: ESSearchRequest
 ) => Promise<Array<OutputOfFieldMap<TFieldMap>>>;
 
 type CreatePersistenceRuleType<TFieldMap extends DefaultFieldMap> = <
@@ -51,7 +52,7 @@ export function createPersistenceRuleTypeFactory(): CreatePersistenceRuleType<De
       ...type,
       executor: async (options) => {
         const {
-          services: { scopedRuleRegistryClient, alertInstanceFactory, logger },
+          services: { scopedClusterClient, scopedRuleRegistryClient, alertInstanceFactory, logger },
         } = options;
 
         const currentAlerts: Array<OutputOfFieldMap<DefaultFieldMap>> = [];
@@ -65,28 +66,27 @@ export function createPersistenceRuleTypeFactory(): CreatePersistenceRuleType<De
               return alerts.map((alert) => alertInstanceFactory(alert['kibana.rac.alert.uuid']!));
             },
             findAlerts: async (query) => {
-              const { events } = await scopedRuleRegistryClient!.search({
+              const { body } = await scopedClusterClient.asCurrentUser.search({
                 ...query,
-                body: {
-                  ...query.body,
-                  fields: ['*'], // FIXME
-                },
-              });
-              return events.map((event) => {
-                const alertUuid = event['kibana.rac.alert.uuid'];
-                const isAlert = alertUuid != null;
-                return {
-                  ...event,
-                  'kibana.rac.alert.id': '???',
-                  'kibana.rac.alert.uuid': v4(),
-                  'kibana.rac.alert.ancestors': isAlert
-                    ? (event['kibana.rac.alert.ancestors'] ?? []).concat([alertUuid!])
-                    : [],
-                  'kibana.rac.alert.depth': isAlert ? event['kibana.rac.alert.depth']! + 1 : 0,
-                  'event.kind': 'signal',
-                  '@timestamp': timestamp,
-                };
+                ignore_unavailable: true,
               });
+              return body.hits.hits
+                .map((event) => event._source as OutputOfFieldMap<DefaultFieldMap>)
+                .map((event) => {
+                  const alertUuid = event['kibana.rac.alert.uuid'];
+                  const isAlert = alertUuid != null;
+                  return {
+                    ...event,
+                    'kibana.rac.alert.id': '???',
+                    'kibana.rac.alert.uuid': v4(),
+                    'kibana.rac.alert.ancestors': isAlert
+                      ? (event['kibana.rac.alert.ancestors'] ?? []).concat([alertUuid!])
+                      : [],
+                    'kibana.rac.alert.depth': isAlert ? event['kibana.rac.alert.depth']! + 1 : 0,
+                    'event.kind': 'signal',
+                    '@timestamp': timestamp,
+                  };
+                });
             },
           },
         });
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/reference_rule_persistence.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/reference_rule_persistence.ts
index 76671207ba03c..14420be9ee9b3 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/reference_rule_persistence.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/reference_rule_persistence.ts
@@ -53,7 +53,6 @@ export const referenceRulePersistenceAlertType = createSecurityPersistenceRuleTy
 
     const esQuery = buildEsQuery(indexPattern, { query: params.query, language: 'kuery' }, []);
     const query = {
-      index: ['*'],
       body: {
         query: {
           bool: {

From 254b4a20403269f3af6a4e57e1a37e2b4489ac18 Mon Sep 17 00:00:00 2001
From: Madison Caldwell <madison.caldwell@elastic.co>
Date: Wed, 14 Apr 2021 17:06:39 +0000
Subject: [PATCH 09/54] Fixup

---
 .../create_persistence_rule_type_factory.ts   | 29 +++++++++++++------
 .../reference_rule_persistence.ts             | 14 ++-------
 .../scripts/create_reference_rule.sh          |  2 +-
 .../create_reference_rule_hierarchical.sh     |  4 +--
 .../create_reference_rule_persistence.sh      |  4 +--
 5 files changed, 27 insertions(+), 26 deletions(-)

diff --git a/x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_persistence_rule_type_factory.ts b/x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_persistence_rule_type_factory.ts
index c5fcb01c25dcc..97f135fd8a6cd 100644
--- a/x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_persistence_rule_type_factory.ts
+++ b/x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_persistence_rule_type_factory.ts
@@ -10,7 +10,7 @@ import v4 from 'uuid/v4';
 import { AlertInstance } from '../../../../alerting/server';
 import { ActionVariable, AlertInstanceState } from '../../../../alerting/common';
 import { RuleParams, RuleType } from '../../types';
-import { DefaultFieldMap } from '../defaults/field_map';
+import { DefaultFieldMap, defaultFieldMap } from '../defaults/field_map';
 import { OutputOfFieldMap } from '../field_map/runtime_type_from_fieldmap';
 import { RuleRegistry } from '..';
 
@@ -56,8 +56,9 @@ export function createPersistenceRuleTypeFactory(): CreatePersistenceRuleType<De
         } = options;
 
         const currentAlerts: Array<OutputOfFieldMap<DefaultFieldMap>> = [];
+        const timestamp = options.startedAt.toISOString();
 
-        await type.executor({
+        const state = await type.executor({
           ...options,
           services: {
             ...options.services,
@@ -66,24 +67,36 @@ export function createPersistenceRuleTypeFactory(): CreatePersistenceRuleType<De
               return alerts.map((alert) => alertInstanceFactory(alert['kibana.rac.alert.uuid']!));
             },
             findAlerts: async (query) => {
-              const { body } = await scopedClusterClient.asCurrentUser.search({
+              const { body } = await scopedClusterClient.asCurrentUser.search<
+                OutputOfFieldMap<DefaultFieldMap>
+              >({
                 ...query,
+                body: {
+                  ...query.body,
+                  _source: Object.keys(defaultFieldMap),
+                },
                 ignore_unavailable: true,
               });
+              // console.log('FOUND EVENT');
+              // console.log(JSON.stringify(body.hits.hits[0]));
               return body.hits.hits
-                .map((event) => event._source as OutputOfFieldMap<DefaultFieldMap>)
+                .map((event) => event._source!)
                 .map((event) => {
+                  // console.log(JSON.stringify(event));
                   const alertUuid = event['kibana.rac.alert.uuid'];
                   const isAlert = alertUuid != null;
                   return {
                     ...event,
+                    event: {
+                      action: event['event.action'],
+                      kind: 'signal',
+                    },
                     'kibana.rac.alert.id': '???',
                     'kibana.rac.alert.uuid': v4(),
                     'kibana.rac.alert.ancestors': isAlert
                       ? (event['kibana.rac.alert.ancestors'] ?? []).concat([alertUuid!])
                       : [],
                     'kibana.rac.alert.depth': isAlert ? event['kibana.rac.alert.depth']! + 1 : 0,
-                    'event.kind': 'signal',
                     '@timestamp': timestamp,
                   };
                 });
@@ -91,16 +104,14 @@ export function createPersistenceRuleTypeFactory(): CreatePersistenceRuleType<De
           },
         });
 
-        const timestamp = options.startedAt.toISOString();
-
-        const numAlerts = Object.keys(currentAlerts).length;
+        const numAlerts = currentAlerts.length;
         logger.debug(`Found ${numAlerts} alerts.`);
 
         if (scopedRuleRegistryClient && numAlerts) {
           await scopedRuleRegistryClient.bulkIndex(currentAlerts);
         }
 
-        return currentAlerts;
+        return state;
       },
     };
   };
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/reference_rule_persistence.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/reference_rule_persistence.ts
index 14420be9ee9b3..1e213bd58a1b3 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/reference_rule_persistence.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/reference_rule_persistence.ts
@@ -28,20 +28,10 @@ export const referenceRulePersistenceAlertType = createSecurityPersistenceRuleTy
       id: 'default',
       name: 'Default',
     },
-    {
-      id: 'warning',
-      name: 'Warning',
-    },
   ],
   defaultActionGroupId: 'default',
   actionVariables: {
-    context: [
-      { name: 'server', description: 'the server' },
-      {
-        name: 'hasCpuUsageIncreased',
-        description: 'boolean indicating if the cpu usage has increased',
-      },
-    ],
+    context: [{ name: 'server', description: 'the server' }],
   },
   minimumLicenseRequired: 'basic',
   producer: 'security-solution',
@@ -68,7 +58,7 @@ export const referenceRulePersistenceAlertType = createSecurityPersistenceRuleTy
 
     const alerts = await findAlerts(query);
     alertWithPersistence(alerts).forEach((alert) => {
-      alert.scheduleActions('action-group-tbd', {});
+      alert.scheduleActions('default', { server: 'server-test' });
     });
 
     return {
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule.sh b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule.sh
index 193478419ffcb..d547f295c5d0d 100755
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule.sh
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule.sh
@@ -27,7 +27,7 @@ curl -X POST http://localhost:5601/${BASE_PATH}/api/alerts/alert \
       "cpu"
    ],
    "notifyWhen":"onActionGroupChange",
-   "name":"Oh hai world!"
+   "name":"Basic lifecycle rule"
 }'
 
 
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_hierarchical.sh b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_hierarchical.sh
index fbd8829fb6324..09204926d3c0f 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_hierarchical.sh
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_hierarchical.sh
@@ -26,10 +26,10 @@ curl -X POST http://localhost:5601/${BASE_PATH}/api/alerts/alert \
    },
    "actions":[],
    "tags":[
-      "cpu"
+      "hierarchical"
    ],
    "notifyWhen":"onActionGroupChange",
-   "name":"Oh hai world!"
+   "name":"Hierarchical persistence rule"
 }'
 
 
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_persistence.sh b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_persistence.sh
index 8b6e01d10040a..1d72c0a5d98ca 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_persistence.sh
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_persistence.sh
@@ -23,10 +23,10 @@ curl -X POST http://localhost:5601/${BASE_PATH}/api/alerts/alert \
    },
    "actions":[],
    "tags":[
-      "cpu"
+      "persistence"
    ],
    "notifyWhen":"onActionGroupChange",
-   "name":"Oh hai world!"
+   "name":"Basic persistence rule"
 }'
 
 

From 7ac738d5ed93593422171e8ea8ffeecf284853db Mon Sep 17 00:00:00 2001
From: Madison Caldwell <madison.caldwell@elastic.co>
Date: Thu, 15 Apr 2021 13:37:20 +0000
Subject: [PATCH 10/54] Cleanup

---
 .../create_persistence_rule_type_factory.ts          | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_persistence_rule_type_factory.ts b/x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_persistence_rule_type_factory.ts
index 97f135fd8a6cd..ed1689ed20555 100644
--- a/x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_persistence_rule_type_factory.ts
+++ b/x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_persistence_rule_type_factory.ts
@@ -77,26 +77,22 @@ export function createPersistenceRuleTypeFactory(): CreatePersistenceRuleType<De
                 },
                 ignore_unavailable: true,
               });
-              // console.log('FOUND EVENT');
-              // console.log(JSON.stringify(body.hits.hits[0]));
               return body.hits.hits
                 .map((event) => event._source!)
                 .map((event) => {
-                  // console.log(JSON.stringify(event));
                   const alertUuid = event['kibana.rac.alert.uuid'];
                   const isAlert = alertUuid != null;
                   return {
                     ...event,
-                    event: {
-                      action: event['event.action'],
-                      kind: 'signal',
-                    },
+                    'event.kind': 'signal',
                     'kibana.rac.alert.id': '???',
                     'kibana.rac.alert.uuid': v4(),
                     'kibana.rac.alert.ancestors': isAlert
                       ? (event['kibana.rac.alert.ancestors'] ?? []).concat([alertUuid!])
                       : [],
-                    'kibana.rac.alert.depth': isAlert ? event['kibana.rac.alert.depth']! + 1 : 0,
+                    'kibana.rac.alert.depth': isAlert
+                      ? (event['kibana.rac.alert.depth'] ?? 0) + 1
+                      : 0,
                     '@timestamp': timestamp,
                   };
                 });

From c387f132d52fe3f1f7df92c4d53fa4ef21e8ad4d Mon Sep 17 00:00:00 2001
From: Madison Caldwell <madison.caldwell@elastic.co>
Date: Mon, 19 Apr 2021 03:05:25 +0000
Subject: [PATCH 11/54] Add 5 DE rule types (in progress)

---
 .../security_solution/common/constants.ts     |   6 +
 .../reference_rules/custom.ts                 |  74 ++++++++++++
 .../detection_engine/reference_rules/eql.ts   | 105 ++++++++++++++++++
 .../reference_rules/indicator.ts              |   6 +
 .../detection_engine/reference_rules/ml.ts    |   6 +
 .../reference_rules/threshold.ts              |   6 +
 6 files changed, 203 insertions(+)
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/custom.ts
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.ts
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/indicator.ts
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/ml.ts
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.ts

diff --git a/x-pack/plugins/security_solution/common/constants.ts b/x-pack/plugins/security_solution/common/constants.ts
index 5f376c1515126..5ebd35fc536ce 100644
--- a/x-pack/plugins/security_solution/common/constants.ts
+++ b/x-pack/plugins/security_solution/common/constants.ts
@@ -154,6 +154,12 @@ export const SIGNALS_ID = `siem.signals`;
 export const REFERENCE_RULE_ALERT_TYPE_ID = `siem.referenceRule`;
 export const REFERENCE_RULE_PERSISTENCE_ALERT_TYPE_ID = `siem.referenceRulePersistence`;
 
+export const CUSTOM_ALERT_TYPE_ID = `siem.customRule`;
+export const EQL_ALERT_TYPE_ID = `siem.eqlRule`;
+export const INDICATOR_ALERT_TYPE_ID = `siem.indicatorRule`;
+export const ML_ALERT_TYPE_ID = `siem.mlRule`;
+export const THRESHOLD_ALERT_TYPE_ID = `siem.thresholdRule`;
+
 /**
  * Id for the notifications alerting type
  */
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/custom.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/custom.ts
new file mode 100644
index 0000000000000..96e3f9b503893
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/custom.ts
@@ -0,0 +1,74 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { schema } from '@kbn/config-schema';
+
+import { buildEsQuery, IIndexPattern } from '../../../../../../../src/plugins/data/common';
+
+import { createPersistenceRuleTypeFactory } from '../../../../../rule_registry/server';
+import { CUSTOM_ALERT_TYPE_ID } from '../../../../common/constants';
+import { SecurityRuleRegistry } from '../../../plugin';
+
+const createSecurityCustomRuleType = createPersistenceRuleTypeFactory<SecurityRuleRegistry>();
+
+export const customAlertType = createSecurityCustomRuleType({
+  id: CUSTOM_ALERT_TYPE_ID,
+  name: 'Custom Query Rule',
+  validate: {
+    params: schema.object({
+      indexPatterns: schema.arrayOf(schema.string()),
+      customQuery: schema.string(),
+    }),
+  },
+  actionGroups: [
+    {
+      id: 'default',
+      name: 'Default',
+    },
+  ],
+  defaultActionGroupId: 'default',
+  actionVariables: {
+    context: [{ name: 'server', description: 'the server' }],
+  },
+  minimumLicenseRequired: 'basic',
+  producer: 'security-solution',
+  async executor({
+    services: { alertWithPersistence, findAlerts },
+    params: { indexPatterns, customQuery },
+  }) {
+    const indexPattern: IIndexPattern = {
+      fields: [],
+      title: indexPatterns.join(),
+    };
+
+    // TODO: kql or lucene?
+
+    const esQuery = buildEsQuery(indexPattern, { query: customQuery, language: 'kuery' }, []);
+    const query = {
+      body: {
+        query: {
+          bool: {
+            must: esQuery.bool.must, // FIXME
+          },
+        },
+        fields: ['*'],
+        sort: {
+          '@timestamp': 'asc' as const,
+        },
+      },
+    };
+
+    const alerts = await findAlerts(query);
+    alertWithPersistence(alerts).forEach((alert) => {
+      alert.scheduleActions('default', { server: 'server-test' });
+    });
+
+    return {
+      lastChecked: new Date(),
+    };
+  },
+});
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.ts
new file mode 100644
index 0000000000000..f9eae63cac5a9
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.ts
@@ -0,0 +1,105 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import moment from 'moment';
+
+import { ApiResponse } from '@elastic/elasticsearch';
+import { schema } from '@kbn/config-schema';
+
+import { IIndexPattern } from '../../../../../../../src/plugins/data/common';
+import { createPersistenceRuleTypeFactory } from '../../../../../rule_registry/server';
+import { EQL_ALERT_TYPE_ID } from '../../../../common/constants';
+import { buildEqlSearchRequest } from '../../../../common/detection_engine/get_query_filter';
+import { SecurityRuleRegistry } from '../../../plugin';
+import { buildSignalFromEvent, buildSignalGroupFromSequence } from '../signals/build_bulk_body';
+import { filterDuplicateSignals } from '../signals/single_bulk_create';
+import { EqlSignalSearchResponse, WrappedSignalHit } from '../signals/types';
+import { wrapSignal } from '../signals/utils';
+
+const createSecurityEQLRuleType = createPersistenceRuleTypeFactory<SecurityRuleRegistry>();
+
+export const eqlAlertType = createSecurityEQLRuleType({
+  id: EQL_ALERT_TYPE_ID,
+  name: 'EQL Rule',
+  validate: {
+    params: schema.object({
+      eqlQuery: schema.string(),
+      indexPatterns: schema.arrayOf(schema.string()),
+    }),
+  },
+  actionGroups: [
+    {
+      id: 'default',
+      name: 'Default',
+    },
+  ],
+  defaultActionGroupId: 'default',
+  actionVariables: {
+    context: [{ name: 'server', description: 'the server' }],
+  },
+  minimumLicenseRequired: 'basic',
+  producer: 'security-solution',
+  async executor({
+    // previousStartedAt,
+    rule,
+    startedAt,
+    services: { alertWithPersistence, findAlerts, scopedClusterClient },
+    params: { indexPatterns, eqlQuery },
+  }) {
+    const indexPattern: IIndexPattern = {
+      fields: [],
+      title: indexPatterns.join(),
+    };
+
+    const from = moment(startedAt).subtract(moment.duration(5, 'm')).toISOString(); // hardcoded 5-minute rule interval
+    const to = startedAt.toISOString();
+
+    const request = buildEqlSearchRequest(
+      eqlQuery,
+      indexPatterns,
+      from,
+      to,
+      10,
+      undefined,
+      [],
+      undefined
+    );
+    const { body: response } = (await scopedClusterClient.asCurrentUser.transport.request(
+      request
+    )) as ApiResponse<EqlSignalSearchResponse>;
+
+    let newSignals: WrappedSignalHit[] | undefined;
+    if (response.hits.sequences !== undefined) {
+      newSignals = response.hits.sequences.reduce(
+        (acc: WrappedSignalHit[], sequence) =>
+          acc.concat(buildSignalGroupFromSequence(sequence, rule, 'index-TBD')),
+        []
+      );
+    } else if (response.hits.events !== undefined) {
+      newSignals = filterDuplicateSignals(
+        rule.id,
+        response.hits.events.map((event) =>
+          wrapSignal(buildSignalFromEvent(event, rule, true), 'index-TBD')
+        )
+      );
+    } else {
+      throw new Error(
+        'eql query response should have either `sequences` or `events` but had neither'
+      );
+    }
+
+    if (newSignals.length > 0) {
+      alertWithPersistence(newSignals).forEach((alert) => {
+        alert.scheduleActions('default', { server: 'server-test' });
+      });
+    }
+
+    return {
+      lastChecked: new Date(),
+    };
+  },
+});
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/indicator.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/indicator.ts
new file mode 100644
index 0000000000000..1fec1c76430eb
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/indicator.ts
@@ -0,0 +1,6 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/ml.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/ml.ts
new file mode 100644
index 0000000000000..1fec1c76430eb
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/ml.ts
@@ -0,0 +1,6 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.ts
new file mode 100644
index 0000000000000..1fec1c76430eb
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.ts
@@ -0,0 +1,6 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */

From 9c2e0dcd14ad85270ac261a18a30fcbec0008442 Mon Sep 17 00:00:00 2001
From: Madison Caldwell <madison.caldwell@elastic.co>
Date: Mon, 19 Apr 2021 15:46:32 +0000
Subject: [PATCH 12/54] Add custom + eql

---
 .../reference_rules/custom.ts                 |  7 ++--
 .../detection_engine/reference_rules/eql.ts   | 33 +++++-------------
 ...nce.sh => create_reference_rule_custom.sh} |  8 +++--
 .../scripts/create_reference_rule_eql.sh      | 34 +++++++++++++++++++
 .../create_reference_rule_hierarchical.sh     |  9 +++--
 .../security_solution/server/plugin.ts        |  6 ++--
 6 files changed, 60 insertions(+), 37 deletions(-)
 rename x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/{create_reference_rule_persistence.sh => create_reference_rule_custom.sh} (82%)
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_eql.sh

diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/custom.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/custom.ts
index 96e3f9b503893..d4b88e1c4b26b 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/custom.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/custom.ts
@@ -50,11 +50,7 @@ export const customAlertType = createSecurityCustomRuleType({
     const esQuery = buildEsQuery(indexPattern, { query: customQuery, language: 'kuery' }, []);
     const query = {
       body: {
-        query: {
-          bool: {
-            must: esQuery.bool.must, // FIXME
-          },
-        },
+        query: esQuery,
         fields: ['*'],
         sort: {
           '@timestamp': 'asc' as const,
@@ -62,6 +58,7 @@ export const customAlertType = createSecurityCustomRuleType({
       },
     };
 
+    // @ts-expect-error Filter[] is not assignable to QueryContainer[]
     const alerts = await findAlerts(query);
     alertWithPersistence(alerts).forEach((alert) => {
       alert.scheduleActions('default', { server: 'server-test' });
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.ts
index f9eae63cac5a9..059f8ebfc49cd 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.ts
@@ -10,15 +10,11 @@ import moment from 'moment';
 import { ApiResponse } from '@elastic/elasticsearch';
 import { schema } from '@kbn/config-schema';
 
-import { IIndexPattern } from '../../../../../../../src/plugins/data/common';
 import { createPersistenceRuleTypeFactory } from '../../../../../rule_registry/server';
 import { EQL_ALERT_TYPE_ID } from '../../../../common/constants';
 import { buildEqlSearchRequest } from '../../../../common/detection_engine/get_query_filter';
 import { SecurityRuleRegistry } from '../../../plugin';
-import { buildSignalFromEvent, buildSignalGroupFromSequence } from '../signals/build_bulk_body';
-import { filterDuplicateSignals } from '../signals/single_bulk_create';
-import { EqlSignalSearchResponse, WrappedSignalHit } from '../signals/types';
-import { wrapSignal } from '../signals/utils';
+import { EqlSignalSearchResponse } from '../signals/types';
 
 const createSecurityEQLRuleType = createPersistenceRuleTypeFactory<SecurityRuleRegistry>();
 
@@ -50,11 +46,6 @@ export const eqlAlertType = createSecurityEQLRuleType({
     services: { alertWithPersistence, findAlerts, scopedClusterClient },
     params: { indexPatterns, eqlQuery },
   }) {
-    const indexPattern: IIndexPattern = {
-      fields: [],
-      title: indexPatterns.join(),
-    };
-
     const from = moment(startedAt).subtract(moment.duration(5, 'm')).toISOString(); // hardcoded 5-minute rule interval
     const to = startedAt.toISOString();
 
@@ -72,28 +63,22 @@ export const eqlAlertType = createSecurityEQLRuleType({
       request
     )) as ApiResponse<EqlSignalSearchResponse>;
 
-    let newSignals: WrappedSignalHit[] | undefined;
+    type ValueType<T> = T extends Promise<infer U> ? U : T;
+    type AlertList = ValueType<ReturnType<typeof findAlerts>>;
+
+    const alerts: AlertList = [];
     if (response.hits.sequences !== undefined) {
-      newSignals = response.hits.sequences.reduce(
-        (acc: WrappedSignalHit[], sequence) =>
-          acc.concat(buildSignalGroupFromSequence(sequence, rule, 'index-TBD')),
-        []
-      );
+      // TODO
     } else if (response.hits.events !== undefined) {
-      newSignals = filterDuplicateSignals(
-        rule.id,
-        response.hits.events.map((event) =>
-          wrapSignal(buildSignalFromEvent(event, rule, true), 'index-TBD')
-        )
-      );
+      // TODO
     } else {
       throw new Error(
         'eql query response should have either `sequences` or `events` but had neither'
       );
     }
 
-    if (newSignals.length > 0) {
-      alertWithPersistence(newSignals).forEach((alert) => {
+    if (alerts.length > 0) {
+      alertWithPersistence(alerts).forEach((alert) => {
         alert.scheduleActions('default', { server: 'server-test' });
       });
     }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_persistence.sh b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_custom.sh
similarity index 82%
rename from x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_persistence.sh
rename to x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_custom.sh
index 1d72c0a5d98ca..9c18998f40b42 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_persistence.sh
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_custom.sh
@@ -14,19 +14,21 @@ curl -X POST http://localhost:5601/${BASE_PATH}/api/alerts/alert \
      -d '
 {
   "params":{
-     "query": "*:*"
+     "indexPatterns: ["*"],
+     "customQuery": "*:*"
    },
    "consumer":"alerts",
-   "alertTypeId":"siem.referenceRulePersistence",
+   "alertTypeId":"siem.customRule",
    "schedule":{
       "interval":"1m"
    },
    "actions":[],
    "tags":[
+      "custom"
       "persistence"
    ],
    "notifyWhen":"onActionGroupChange",
-   "name":"Basic persistence rule"
+   "name":"Basic custom query rule"
 }'
 
 
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_eql.sh b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_eql.sh
new file mode 100644
index 0000000000000..b6199e04fd7e5
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_eql.sh
@@ -0,0 +1,34 @@
+#!/bin/sh
+#
+# Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+# or more contributor license agreements. Licensed under the Elastic License
+# 2.0; you may not use this file except in compliance with the Elastic License
+# 2.0.
+#
+
+curl -X POST http://localhost:5601/${BASE_PATH}/api/alerts/alert \
+     -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
+     -H 'kbn-xsrf: true' \
+     -H 'Content-Type: application/json' \
+     --verbose \
+     -d '
+{
+  "params":{
+     "indexPatterns: ["*"],
+     "eqlQuery": "sequence by hostname [network where true]"
+   },
+   "consumer":"alerts",
+   "alertTypeId":"siem.eqlRule",
+   "schedule":{
+      "interval":"1m"
+   },
+   "actions":[],
+   "tags":[
+      "eql"
+      "persistence"
+   ],
+   "notifyWhen":"onActionGroupChange",
+   "name":"Basic EQL rule"
+}'
+
+
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_hierarchical.sh b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_hierarchical.sh
index 09204926d3c0f..0c7e6db3dc348 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_hierarchical.sh
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_hierarchical.sh
@@ -17,19 +17,22 @@ curl -X POST http://localhost:5601/${BASE_PATH}/api/alerts/alert \
      -d '
 {
   "params":{
-      "query": "rule.id:siem.referenceRule"
+     "indexPatterns: ["*"],
+     "customQuery": "rule.id:siem.referenceRule"
    },
    "consumer":"alerts",
-   "alertTypeId":"siem.referenceRulePersistence",
+   "alertTypeId":"siem.customRule",
    "schedule":{
       "interval":"1m"
    },
    "actions":[],
    "tags":[
+      "custom"
       "hierarchical"
+      "persistence"
    ],
    "notifyWhen":"onActionGroupChange",
-   "name":"Hierarchical persistence rule"
+   "name":"Hierarchical custom query rule"
 }'
 
 
diff --git a/x-pack/plugins/security_solution/server/plugin.ts b/x-pack/plugins/security_solution/server/plugin.ts
index 86537a48b3f30..a0cea1acf6990 100644
--- a/x-pack/plugins/security_solution/server/plugin.ts
+++ b/x-pack/plugins/security_solution/server/plugin.ts
@@ -42,8 +42,9 @@ import { ILicense, LicensingPluginStart } from '../../licensing/server';
 import { FleetStartContract } from '../../fleet/server';
 import { TaskManagerSetupContract, TaskManagerStartContract } from '../../task_manager/server';
 import { compose } from './lib/compose/kibana';
+import { customAlertType } from './lib/detection_engine/reference_rules/custom';
+import { eqlAlertType } from './lib/detection_engine/reference_rules/eql';
 import { referenceRuleAlertType } from './lib/detection_engine/reference_rules/reference_rule';
-import { referenceRulePersistenceAlertType } from './lib/detection_engine/reference_rules/reference_rule_persistence';
 import { initRoutes } from './routes';
 import { isAlertExecutor } from './lib/detection_engine/signals/types';
 import { signalRulesAlertType } from './lib/detection_engine/signals/signal_rule_alert_type';
@@ -297,8 +298,9 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
     });
 
     // Register reference rule types via rule-registry
+    this.setupPlugins.ruleRegistry.registerType(customAlertType);
+    this.setupPlugins.ruleRegistry.registerType(eqlAlertType);
     this.setupPlugins.ruleRegistry.registerType(referenceRuleAlertType);
-    this.setupPlugins.ruleRegistry.registerType(referenceRulePersistenceAlertType);
 
     // Continue to register legacy rules against alerting client exposed through rule-registry
     if (this.setupPlugins.alerting != null) {

From 8c9070409828ba97fc04e87f4f1b8562751ddcd4 Mon Sep 17 00:00:00 2001
From: Madison Caldwell <madison.caldwell@elastic.co>
Date: Mon, 19 Apr 2021 17:27:05 +0000
Subject: [PATCH 13/54] Fix typos

---
 .../reference_rules/scripts/create_reference_rule_custom.sh | 4 ++--
 .../reference_rules/scripts/create_reference_rule_eql.sh    | 4 ++--
 .../scripts/create_reference_rule_hierarchical.sh           | 6 +++---
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_custom.sh b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_custom.sh
index 9c18998f40b42..c34af7dee4044 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_custom.sh
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_custom.sh
@@ -14,7 +14,7 @@ curl -X POST http://localhost:5601/${BASE_PATH}/api/alerts/alert \
      -d '
 {
   "params":{
-     "indexPatterns: ["*"],
+     "indexPatterns": ["*"],
      "customQuery": "*:*"
    },
    "consumer":"alerts",
@@ -24,7 +24,7 @@ curl -X POST http://localhost:5601/${BASE_PATH}/api/alerts/alert \
    },
    "actions":[],
    "tags":[
-      "custom"
+      "custom",
       "persistence"
    ],
    "notifyWhen":"onActionGroupChange",
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_eql.sh b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_eql.sh
index b6199e04fd7e5..e27702385fca5 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_eql.sh
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_eql.sh
@@ -14,7 +14,7 @@ curl -X POST http://localhost:5601/${BASE_PATH}/api/alerts/alert \
      -d '
 {
   "params":{
-     "indexPatterns: ["*"],
+     "indexPatterns": ["*"],
      "eqlQuery": "sequence by hostname [network where true]"
    },
    "consumer":"alerts",
@@ -24,7 +24,7 @@ curl -X POST http://localhost:5601/${BASE_PATH}/api/alerts/alert \
    },
    "actions":[],
    "tags":[
-      "eql"
+      "eql",
       "persistence"
    ],
    "notifyWhen":"onActionGroupChange",
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_hierarchical.sh b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_hierarchical.sh
index 0c7e6db3dc348..61e0fd206654e 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_hierarchical.sh
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_hierarchical.sh
@@ -17,7 +17,7 @@ curl -X POST http://localhost:5601/${BASE_PATH}/api/alerts/alert \
      -d '
 {
   "params":{
-     "indexPatterns: ["*"],
+     "indexPatterns": ["*"],
      "customQuery": "rule.id:siem.referenceRule"
    },
    "consumer":"alerts",
@@ -27,8 +27,8 @@ curl -X POST http://localhost:5601/${BASE_PATH}/api/alerts/alert \
    },
    "actions":[],
    "tags":[
-      "custom"
-      "hierarchical"
+      "custom",
+      "hierarchical",
       "persistence"
    ],
    "notifyWhen":"onActionGroupChange",

From 694cec4c6eaf3a6426cac20b7b3b0f3f6ffd1120 Mon Sep 17 00:00:00 2001
From: Madison Caldwell <madison.caldwell@elastic.co>
Date: Tue, 20 Apr 2021 13:25:51 +0000
Subject: [PATCH 14/54] Add EQL implementation

---
 x-pack/plugins/rule_registry/README.md        |  1 +
 .../rule_registry/defaults/field_map.ts       |  1 +
 .../detection_engine/reference_rules/eql.ts   | 42 ++++++++++++++++---
 3 files changed, 38 insertions(+), 6 deletions(-)

diff --git a/x-pack/plugins/rule_registry/README.md b/x-pack/plugins/rule_registry/README.md
index a01bffc27d395..26f5c780c10aa 100644
--- a/x-pack/plugins/rule_registry/README.md
+++ b/x-pack/plugins/rule_registry/README.md
@@ -78,5 +78,6 @@ The following fields are available in the root rule registry:
 - `kibana.rac.alert.severity.value`: the severity of the alert, as a numerical value, which allows sorting.
 - `kibana.rac.alert.ancestors`: the array of ancestors (if any) for the alert.
 - `kibana.rac.alert.depth`: the depth of the alert in the ancestral tree (default 0).
+- `kibana.rac.alert.building_block_type`: the building block type of the alert (default undefined).
 
 This list is not final - just a start. Field names might change or moved to a scoped registry. If we implement log and sequence based rule types the list of fields will grow. If a rule type needs additional fields, the recommendation would be to have the field in its own registry first (or in its producer’s registry), and if usage is more broadly adopted, it can be moved to the root registry.
diff --git a/x-pack/plugins/rule_registry/server/rule_registry/defaults/field_map.ts b/x-pack/plugins/rule_registry/server/rule_registry/defaults/field_map.ts
index acdc915321a97..82c62ae93fc6e 100644
--- a/x-pack/plugins/rule_registry/server/rule_registry/defaults/field_map.ts
+++ b/x-pack/plugins/rule_registry/server/rule_registry/defaults/field_map.ts
@@ -31,6 +31,7 @@ export const defaultFieldMap = {
   'kibana.rac.alert.status': { type: 'keyword' },
   'kibana.rac.alert.ancestors': { array: true, type: 'keyword' },
   'kibana.rac.alert.depth': { type: 'long' },
+  'kibana.rac.alert.building_block_type': { type: 'keyword' },
 } as const;
 
 export type DefaultFieldMap = typeof defaultFieldMap;
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.ts
index 059f8ebfc49cd..ff71a27ed549a 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.ts
@@ -6,6 +6,7 @@
  */
 
 import moment from 'moment';
+import v4 from 'uuid/v4';
 
 import { ApiResponse } from '@elastic/elasticsearch';
 import { schema } from '@kbn/config-schema';
@@ -14,7 +15,7 @@ import { createPersistenceRuleTypeFactory } from '../../../../../rule_registry/s
 import { EQL_ALERT_TYPE_ID } from '../../../../common/constants';
 import { buildEqlSearchRequest } from '../../../../common/detection_engine/get_query_filter';
 import { SecurityRuleRegistry } from '../../../plugin';
-import { EqlSignalSearchResponse } from '../signals/types';
+import { BaseSignalHit, EqlSignalSearchResponse } from '../signals/types';
 
 const createSecurityEQLRuleType = createPersistenceRuleTypeFactory<SecurityRuleRegistry>();
 
@@ -63,14 +64,43 @@ export const eqlAlertType = createSecurityEQLRuleType({
       request
     )) as ApiResponse<EqlSignalSearchResponse>;
 
-    type ValueType<T> = T extends Promise<infer U> ? U : T;
-    type AlertList = ValueType<ReturnType<typeof findAlerts>>;
+    type ValueFromArrayType<T> = T extends Array<infer U> ? U : T;
+    type ValueFromPromiseType<T> = T extends Promise<infer U> ? U : T;
+    type AlertListType = ValueFromPromiseType<ReturnType<typeof findAlerts>>;
+    type AlertType = ValueFromArrayType<AlertListType>;
 
-    const alerts: AlertList = [];
+    const buildSignalFromEvent = (event: BaseSignalHit): AlertType => {
+      return {
+        ...event,
+        'event.kind': 'signal',
+        'kibana.rac.alert.id': '???',
+        'kibana.rac.alert.uuid': v4(),
+        '@timestamp': new Date().toISOString(),
+      };
+    };
+
+    let alerts: AlertListType = [];
     if (response.hits.sequences !== undefined) {
-      // TODO
+      alerts = response.hits.sequences.reduce((allAlerts: AlertListType, sequence) => {
+        let previousAlertUuid: string | undefined;
+        return {
+          ...allAlerts,
+          ...sequence.events.map((event, idx) => {
+            const alert = {
+              ...buildSignalFromEvent(event),
+              'kibana.rac.alert.ancestors': previousAlertUuid != null ? [previousAlertUuid] : [],
+              'kibana.rac.alert.building_block_type': 'default',
+              'kibana.rac.alert.depth': idx,
+            };
+            previousAlertUuid = alert['kibana.rac.alert.uuid'];
+            return alert;
+          }),
+        };
+      }, []);
     } else if (response.hits.events !== undefined) {
-      // TODO
+      alerts = response.hits.events.map((event) => {
+        return buildSignalFromEvent(event);
+      }, []);
     } else {
       throw new Error(
         'eql query response should have either `sequences` or `events` but had neither'

From a751d7ffbd7c091f10a1d0699ddb5e161a1e20b5 Mon Sep 17 00:00:00 2001
From: Madison Caldwell <madison.caldwell@elastic.co>
Date: Mon, 26 Apr 2021 15:45:35 +0000
Subject: [PATCH 15/54] Finish initial threshold implementation

---
 .../reference_rules/reference_rule.ts         |  63 ------
 .../reference_rule_persistence.ts             |  68 ------
 .../create_reference_rule_threshold.sh        |  35 +++
 .../reference_rules/threshold.ts              | 208 ++++++++++++++++++
 .../security_solution/server/plugin.ts        |   5 +-
 5 files changed, 246 insertions(+), 133 deletions(-)
 delete mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/reference_rule.ts
 delete mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/reference_rule_persistence.ts
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_threshold.sh

diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/reference_rule.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/reference_rule.ts
deleted file mode 100644
index 74dd4f93f064c..0000000000000
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/reference_rule.ts
+++ /dev/null
@@ -1,63 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { schema } from '@kbn/config-schema';
-
-import { v4 as uuidv4 } from 'uuid';
-
-import {
-  createLifecycleRuleTypeFactory,
-} from '../../../../../rule_registry/server';
-import {
-  REFERENCE_RULE_ALERT_TYPE_ID,
-} from '../../../../common/constants';
-import { SecurityRuleRegistry } from '../../../plugin';
-
-const createSecurityLifecycleRuleType = createLifecycleRuleTypeFactory<SecurityRuleRegistry>();
-
-export const referenceRuleAlertType = createSecurityLifecycleRuleType({
-  id: REFERENCE_RULE_ALERT_TYPE_ID,
-  name: 'ReferenceRule alert type',
-  validate: {
-    params: schema.object({
-      server: schema.string(),
-      threshold: schema.number({ min: 0, max: 1 }),
-    }),
-  },
-  actionGroups: [
-    {
-      id: 'default',
-      name: 'Default',
-    },
-    {
-      id: 'warning',
-      name: 'Warning',
-    },
-  ],
-  defaultActionGroupId: 'default',
-  actionVariables: {
-    context: [
-      { name: 'server', description: 'the server' },
-      {
-        name: 'hasCpuUsageIncreased',
-        description: 'boolean indicating if the cpu usage has increased',
-      },
-    ],
-  },
-  minimumLicenseRequired: 'basic',
-  producer: 'security-solution',
-  async executor({ services, params }) {
-    services.alertWithLifecycle({
-      id: `${uuidv4()}`,
-      fields: {},
-    });
-
-    return {
-      lastChecked: new Date(),
-    };
-  },
-});
\ No newline at end of file
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/reference_rule_persistence.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/reference_rule_persistence.ts
deleted file mode 100644
index 1e213bd58a1b3..0000000000000
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/reference_rule_persistence.ts
+++ /dev/null
@@ -1,68 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { schema } from '@kbn/config-schema';
-
-import { buildEsQuery, IIndexPattern } from '../../../../../../../src/plugins/data/common';
-
-import { createPersistenceRuleTypeFactory } from '../../../../../rule_registry/server';
-import { REFERENCE_RULE_PERSISTENCE_ALERT_TYPE_ID } from '../../../../common/constants';
-import { SecurityRuleRegistry } from '../../../plugin';
-
-const createSecurityPersistenceRuleType = createPersistenceRuleTypeFactory<SecurityRuleRegistry>();
-
-export const referenceRulePersistenceAlertType = createSecurityPersistenceRuleType({
-  id: REFERENCE_RULE_PERSISTENCE_ALERT_TYPE_ID,
-  name: 'ReferenceRule persistence alert type',
-  validate: {
-    params: schema.object({
-      query: schema.string(),
-    }),
-  },
-  actionGroups: [
-    {
-      id: 'default',
-      name: 'Default',
-    },
-  ],
-  defaultActionGroupId: 'default',
-  actionVariables: {
-    context: [{ name: 'server', description: 'the server' }],
-  },
-  minimumLicenseRequired: 'basic',
-  producer: 'security-solution',
-  async executor({ services: { alertWithPersistence, findAlerts }, params }) {
-    const indexPattern: IIndexPattern = {
-      fields: [],
-      title: '*',
-    };
-
-    const esQuery = buildEsQuery(indexPattern, { query: params.query, language: 'kuery' }, []);
-    const query = {
-      body: {
-        query: {
-          bool: {
-            must: esQuery.bool.must, // FIXME
-          },
-        },
-        fields: ['*'],
-        sort: {
-          '@timestamp': 'asc' as const,
-        },
-      },
-    };
-
-    const alerts = await findAlerts(query);
-    alertWithPersistence(alerts).forEach((alert) => {
-      alert.scheduleActions('default', { server: 'server-test' });
-    });
-
-    return {
-      lastChecked: new Date(),
-    };
-  },
-});
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_threshold.sh b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_threshold.sh
new file mode 100644
index 0000000000000..95481ee4ad0df
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_threshold.sh
@@ -0,0 +1,35 @@
+#!/bin/sh
+#
+# Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+# or more contributor license agreements. Licensed under the Elastic License
+# 2.0; you may not use this file except in compliance with the Elastic License
+# 2.0.
+#
+
+curl -X POST http://localhost:5601/${BASE_PATH}/api/alerts/alert \
+     -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
+     -H 'kbn-xsrf: true' \
+     -H 'Content-Type: application/json' \
+     --verbose \
+     -d '
+{
+  "params":{
+     "indexPatterns": ["*"],
+     "customQuery": "*:*",
+     "thresholdFields": ["source.ip", "destination.ip"]
+   },
+   "consumer":"alerts",
+   "alertTypeId":"siem.thresholdRule",
+   "schedule":{
+      "interval":"1m"
+   },
+   "actions":[],
+   "tags":[
+      "persistence",
+      "threshold"
+   ],
+   "notifyWhen":"onActionGroupChange",
+   "name":"Basic Threshold rule"
+}'
+
+
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.ts
index 1fec1c76430eb..e8e4bf00f006a 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.ts
@@ -4,3 +4,211 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
+
+import moment from 'moment';
+import v4 from 'uuid/v4';
+
+import { schema } from '@kbn/config-schema';
+
+import { Logger } from '../../../../../../../src/core/server';
+
+import { AlertServices } from '../../../../../alerting/server';
+import { FieldMapOf, createPersistenceRuleTypeFactory } from '../../../../../rule_registry/server';
+import { THRESHOLD_ALERT_TYPE_ID } from '../../../../common/constants';
+import { SecurityRuleRegistry } from '../../../plugin';
+import { SignalSearchResponse, ThresholdSignalHistory } from '../signals/types';
+import {
+  findThresholdSignals,
+  getThresholdBucketFilters,
+  getThresholdSignalHistory,
+  transformThresholdResultsToEcs,
+} from '../signals/threshold';
+import { getFilter } from '../signals/get_filter';
+import { BuildRuleMessage } from '../signals/rule_messages';
+
+const createSecurityThresholdRuleType = createPersistenceRuleTypeFactory<SecurityRuleRegistry>();
+type AlertType = FieldMapOf<SecurityRuleRegistry>;
+
+interface Rule {
+  id: string;
+  uuid: string;
+  name: string;
+  category: string;
+}
+
+interface RuleParams {
+  indexPatterns: string[];
+  customQuery: string;
+  thresholdFields: string[];
+  thresholdValue: number;
+  thresholdCardinality: Array<{
+    field: string;
+    value: number;
+  }>;
+}
+
+interface BulkCreateThresholdSignalParams {
+  results: SignalSearchResponse;
+  ruleParams: RuleParams;
+  services: AlertServices & { logger: Logger };
+  inputIndexPattern: string[];
+  rule: Rule;
+  startedAt: Date;
+  from: Date;
+  thresholdSignalHistory: ThresholdSignalHistory;
+  buildRuleMessage: BuildRuleMessage;
+}
+
+const formatThresholdSignals = (params: BulkCreateThresholdSignalParams): AlertType[] => {
+  const thresholdResults = params.results;
+  const threshold = {
+    field: params.ruleParams.thresholdFields,
+    value: params.ruleParams.thresholdValue,
+  };
+  const results = transformThresholdResultsToEcs(
+    thresholdResults,
+    params.ruleParams.indexPatterns.join(','),
+    params.startedAt,
+    params.from,
+    undefined,
+    params.services.logger,
+    threshold,
+    params.rule.id,
+    undefined,
+    params.thresholdSignalHistory
+  );
+  return results.hits.hits.map((hit) => {
+    return {
+      ...hit,
+      'event.kind': 'signal',
+      'kibana.rac.alert.id': '???',
+      'kibana.rac.alert.uuid': v4(),
+      '@timestamp': new Date().toISOString(),
+    };
+  });
+};
+
+export const thresholdAlertType = createSecurityThresholdRuleType({
+  id: THRESHOLD_ALERT_TYPE_ID,
+  name: 'Threshold Rule',
+  validate: {
+    params: schema.object({
+      indexPatterns: schema.arrayOf(schema.string()),
+      customQuery: schema.string(),
+      thresholdFields: schema.arrayOf(schema.string()),
+      thresholdValue: schema.number(),
+      thresholdCardinality: schema.arrayOf(
+        schema.object({
+          field: schema.string(),
+          value: schema.number(),
+        })
+      ),
+    }),
+  },
+  actionGroups: [
+    {
+      id: 'default',
+      name: 'Default',
+    },
+  ],
+  defaultActionGroupId: 'default',
+  actionVariables: {
+    context: [{ name: 'server', description: 'the server' }],
+  },
+  minimumLicenseRequired: 'basic',
+  producer: 'security-solution',
+  async executor({
+    // previousStartedAt,
+    rule,
+    startedAt,
+    services,
+    params,
+  }) {
+    const fromDate = moment(startedAt).subtract(moment.duration(5, 'm')); // hardcoded 5-minute rule interval
+    const from = fromDate.toISOString();
+    const to = startedAt.toISOString();
+
+    // TODO: how to get the output index?
+    const outputIndex = ['.kibana-madi-8-alerts-security-solution-8.0.0-000001'];
+    const buildRuleMessage = (...messages: string[]) => messages.join();
+    const timestampOverride = undefined;
+
+    const {
+      thresholdSignalHistory,
+      searchErrors: previousSearchErrors,
+    } = await getThresholdSignalHistory({
+      indexPattern: outputIndex,
+      from,
+      to,
+      services: (services as unknown) as AlertServices,
+      logger: services.logger,
+      ruleId: rule.id,
+      bucketByFields: params.thresholdFields,
+      timestampOverride,
+      buildRuleMessage,
+    });
+
+    const bucketFilters = await getThresholdBucketFilters({
+      thresholdSignalHistory,
+      timestampOverride,
+    });
+
+    const esFilter = await getFilter({
+      type: 'threshold',
+      filters: bucketFilters,
+      language: 'kuery',
+      query: params.customQuery,
+      savedId: undefined,
+      services: (services as unknown) as AlertServices,
+      index: params.indexPatterns,
+      lists: [],
+    });
+
+    const {
+      searchResult: thresholdResults,
+      searchErrors,
+      searchDuration: thresholdSearchDuration,
+    } = await findThresholdSignals({
+      inputIndexPattern: params.indexPatterns,
+      from,
+      to,
+      services: (services as unknown) as AlertServices,
+      logger: services.logger,
+      filter: esFilter,
+      threshold: {
+        field: params.thresholdFields,
+        value: params.thresholdValue,
+        cardinality: params.thresholdCardinality,
+      },
+      timestampOverride,
+      buildRuleMessage,
+    });
+
+    services.logger.info(`Threshold search took ${thresholdSearchDuration}ms`); // TODO: rule status service
+
+    const alerts = formatThresholdSignals({
+      results: thresholdResults,
+      ruleParams: params,
+      services: (services as unknown) as AlertServices & { logger: Logger },
+      inputIndexPattern: ['TODO'],
+      rule,
+      startedAt,
+      from: fromDate.toDate(),
+      thresholdSignalHistory,
+      buildRuleMessage,
+    });
+
+    const errors = searchErrors.concat(previousSearchErrors);
+    if (errors.length === 0) {
+      services.alertWithPersistence(alerts).forEach((alert) => {
+        alert.scheduleActions('default', { server: 'server-test' });
+      });
+    } else {
+      throw new Error(errors.join('\n'));
+    }
+
+    return {
+      lastChecked: new Date(),
+    };
+  },
+});
diff --git a/x-pack/plugins/security_solution/server/plugin.ts b/x-pack/plugins/security_solution/server/plugin.ts
index a0cea1acf6990..1d2719801912c 100644
--- a/x-pack/plugins/security_solution/server/plugin.ts
+++ b/x-pack/plugins/security_solution/server/plugin.ts
@@ -44,7 +44,7 @@ import { TaskManagerSetupContract, TaskManagerStartContract } from '../../task_m
 import { compose } from './lib/compose/kibana';
 import { customAlertType } from './lib/detection_engine/reference_rules/custom';
 import { eqlAlertType } from './lib/detection_engine/reference_rules/eql';
-import { referenceRuleAlertType } from './lib/detection_engine/reference_rules/reference_rule';
+import { thresholdAlertType } from './lib/detection_engine/reference_rules/threshold';
 import { initRoutes } from './routes';
 import { isAlertExecutor } from './lib/detection_engine/signals/types';
 import { signalRulesAlertType } from './lib/detection_engine/signals/signal_rule_alert_type';
@@ -292,6 +292,7 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
     // Create rule-registry scoped to security-solution (APP_ID uses caps, not supported)
     this.setupPlugins.ruleRegistry = plugins.ruleRegistry.create({
       name: 'security-solution',
+      // fieldMap: ecsFieldMap,
       fieldMap: {
         ...pickWithPatterns(ecsFieldMap, 'host.name', 'service.name'),
       },
@@ -300,7 +301,7 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
     // Register reference rule types via rule-registry
     this.setupPlugins.ruleRegistry.registerType(customAlertType);
     this.setupPlugins.ruleRegistry.registerType(eqlAlertType);
-    this.setupPlugins.ruleRegistry.registerType(referenceRuleAlertType);
+    this.setupPlugins.ruleRegistry.registerType(thresholdAlertType);
 
     // Continue to register legacy rules against alerting client exposed through rule-registry
     if (this.setupPlugins.alerting != null) {

From d5efeb409de349dc0c0fcd0a122a202aec4ca383 Mon Sep 17 00:00:00 2001
From: Madison Caldwell <madison.caldwell@elastic.co>
Date: Tue, 27 Apr 2021 00:53:18 +0000
Subject: [PATCH 16/54] Type fixes

---
 x-pack/plugins/rule_registry/server/index.ts    |  2 ++
 .../lib/detection_engine/reference_rules/eql.ts | 17 +++++++++--------
 .../reference_rules/threshold.ts                |  9 +++++++--
 3 files changed, 18 insertions(+), 10 deletions(-)

diff --git a/x-pack/plugins/rule_registry/server/index.ts b/x-pack/plugins/rule_registry/server/index.ts
index 61d172bc63f90..c11e5122e9795 100644
--- a/x-pack/plugins/rule_registry/server/index.ts
+++ b/x-pack/plugins/rule_registry/server/index.ts
@@ -13,7 +13,9 @@ export { RuleRegistryPluginSetupContract } from './plugin';
 export { createLifecycleRuleTypeFactory } from './rule_registry/rule_type_helpers/create_lifecycle_rule_type_factory';
 export { createPersistenceRuleTypeFactory } from './rule_registry/rule_type_helpers/create_persistence_rule_type_factory';
 export { ecsFieldMap } from './generated/ecs_field_map';
+export { DefaultFieldMap } from './rule_registry/defaults/field_map';
 export { pickWithPatterns } from './rule_registry/field_map/pick_with_patterns';
+export { OutputOfFieldMap } from './rule_registry/field_map/runtime_type_from_fieldmap';
 export { FieldMapOf } from './types';
 export { ScopedRuleRegistryClient } from './rule_registry/create_scoped_rule_registry_client/types';
 
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.ts
index ff71a27ed549a..7bf1cfd0c6293 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.ts
@@ -11,7 +11,11 @@ import v4 from 'uuid/v4';
 import { ApiResponse } from '@elastic/elasticsearch';
 import { schema } from '@kbn/config-schema';
 
-import { createPersistenceRuleTypeFactory } from '../../../../../rule_registry/server';
+import {
+  DefaultFieldMap,
+  OutputOfFieldMap,
+  createPersistenceRuleTypeFactory,
+} from '../../../../../rule_registry/server';
 import { EQL_ALERT_TYPE_ID } from '../../../../common/constants';
 import { buildEqlSearchRequest } from '../../../../common/detection_engine/get_query_filter';
 import { SecurityRuleRegistry } from '../../../plugin';
@@ -19,6 +23,8 @@ import { BaseSignalHit, EqlSignalSearchResponse } from '../signals/types';
 
 const createSecurityEQLRuleType = createPersistenceRuleTypeFactory<SecurityRuleRegistry>();
 
+type AlertType = OutputOfFieldMap<DefaultFieldMap>;
+
 export const eqlAlertType = createSecurityEQLRuleType({
   id: EQL_ALERT_TYPE_ID,
   name: 'EQL Rule',
@@ -64,11 +70,6 @@ export const eqlAlertType = createSecurityEQLRuleType({
       request
     )) as ApiResponse<EqlSignalSearchResponse>;
 
-    type ValueFromArrayType<T> = T extends Array<infer U> ? U : T;
-    type ValueFromPromiseType<T> = T extends Promise<infer U> ? U : T;
-    type AlertListType = ValueFromPromiseType<ReturnType<typeof findAlerts>>;
-    type AlertType = ValueFromArrayType<AlertListType>;
-
     const buildSignalFromEvent = (event: BaseSignalHit): AlertType => {
       return {
         ...event,
@@ -79,9 +80,9 @@ export const eqlAlertType = createSecurityEQLRuleType({
       };
     };
 
-    let alerts: AlertListType = [];
+    let alerts: AlertType[] = [];
     if (response.hits.sequences !== undefined) {
-      alerts = response.hits.sequences.reduce((allAlerts: AlertListType, sequence) => {
+      alerts = response.hits.sequences.reduce((allAlerts: AlertType[], sequence) => {
         let previousAlertUuid: string | undefined;
         return {
           ...allAlerts,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.ts
index e8e4bf00f006a..d5b214c2e149f 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.ts
@@ -13,7 +13,11 @@ import { schema } from '@kbn/config-schema';
 import { Logger } from '../../../../../../../src/core/server';
 
 import { AlertServices } from '../../../../../alerting/server';
-import { FieldMapOf, createPersistenceRuleTypeFactory } from '../../../../../rule_registry/server';
+import {
+  DefaultFieldMap,
+  OutputOfFieldMap,
+  createPersistenceRuleTypeFactory,
+} from '../../../../../rule_registry/server';
 import { THRESHOLD_ALERT_TYPE_ID } from '../../../../common/constants';
 import { SecurityRuleRegistry } from '../../../plugin';
 import { SignalSearchResponse, ThresholdSignalHistory } from '../signals/types';
@@ -27,7 +31,8 @@ import { getFilter } from '../signals/get_filter';
 import { BuildRuleMessage } from '../signals/rule_messages';
 
 const createSecurityThresholdRuleType = createPersistenceRuleTypeFactory<SecurityRuleRegistry>();
-type AlertType = FieldMapOf<SecurityRuleRegistry>;
+
+type AlertType = OutputOfFieldMap<DefaultFieldMap>;
 
 interface Rule {
   id: string;

From 7412abc86eb4b0637e3a22d50972259849ea6fb6 Mon Sep 17 00:00:00 2001
From: Madison Caldwell <madison.caldwell@elastic.co>
Date: Tue, 27 Apr 2021 14:46:18 +0000
Subject: [PATCH 17/54] ML + threat_match

---
 .../detection_engine/reference_rules/ml.ts    | 64 +++++++++++++++++++
 .../reference_rules/{custom.ts => query.ts}   |  2 +-
 .../reference_rules/threat_match.ts           |  6 ++
 .../security_solution/server/plugin.ts        |  4 +-
 4 files changed, 73 insertions(+), 3 deletions(-)
 rename x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/{custom.ts => query.ts} (96%)
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threat_match.ts

diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/ml.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/ml.ts
index 1fec1c76430eb..c07d0436cc90d 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/ml.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/ml.ts
@@ -4,3 +4,67 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
+
+/*
+
+import { schema } from '@kbn/config-schema';
+import { KibanaRequest, Logger } from 'src/core/server';
+import { SavedObject } from 'src/core/types';
+
+import { buildEsQuery, IIndexPattern } from '../../../../../../../src/plugins/data/common';
+
+import { createPersistenceRuleTypeFactory } from '../../../../../rule_registry/server';
+import { ML_ALERT_TYPE_ID } from '../../../../common/constants';
+import { SecurityRuleRegistry } from '../../../plugin';
+
+const createSecurityMlRuleType = createPersistenceRuleTypeFactory<SecurityRuleRegistry>();
+
+import {
+  AlertInstanceContext,
+  AlertInstanceState,
+  AlertServices,
+} from '../../../../../alerting/server';
+import { ListClient } from '../../../../../lists/server';
+import { isJobStarted } from '../../../../common/machine_learning/helpers';
+import { ExceptionListItemSchema } from '../../../../common/shared_imports';
+import { SetupPlugins } from '../../../plugin';
+import { RefreshTypes } from '../types';
+import { bulkCreateMlSignals } from '../signals/bulk_create_ml_signals';
+import { filterEventsAgainstList } from '../signals/filters/filter_events_against_list';
+import { findMlSignals } from '../signals/find_ml_signals';
+import { BuildRuleMessage } from '../signals/rule_messages';
+import { RuleStatusService } from '../signals/rule_status_service';
+import { MachineLearningRuleAttributes } from '../signals/types';
+import { createErrorsFromShard, createSearchAfterReturnType, mergeReturns } from '../signals/utils';
+
+export const mlAlertType = createSecurityMlRuleType({
+  id: ML_ALERT_TYPE_ID,
+  name: 'Machine Learning Rule',
+  validate: {
+    params: schema.object({
+      indexPatterns: schema.arrayOf(schema.string()),
+      customQuery: schema.string(),
+    }),
+  },
+  actionGroups: [
+    {
+      id: 'default',
+      name: 'Default',
+    },
+  ],
+  defaultActionGroupId: 'default',
+  actionVariables: {
+    context: [{ name: 'server', description: 'the server' }],
+  },
+  minimumLicenseRequired: 'basic',
+  producer: 'security-solution',
+  async executor({
+    services: { alertWithPersistence, findAlerts },
+    params: { indexPatterns, customQuery },
+  }) {
+    return {
+      lastChecked: new Date(),
+    };
+  },
+});
+*/
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/custom.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/query.ts
similarity index 96%
rename from x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/custom.ts
rename to x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/query.ts
index d4b88e1c4b26b..65654937869e9 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/custom.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/query.ts
@@ -15,7 +15,7 @@ import { SecurityRuleRegistry } from '../../../plugin';
 
 const createSecurityCustomRuleType = createPersistenceRuleTypeFactory<SecurityRuleRegistry>();
 
-export const customAlertType = createSecurityCustomRuleType({
+export const queryAlertType = createSecurityCustomRuleType({
   id: CUSTOM_ALERT_TYPE_ID,
   name: 'Custom Query Rule',
   validate: {
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threat_match.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threat_match.ts
new file mode 100644
index 0000000000000..1fec1c76430eb
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threat_match.ts
@@ -0,0 +1,6 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
diff --git a/x-pack/plugins/security_solution/server/plugin.ts b/x-pack/plugins/security_solution/server/plugin.ts
index 1d2719801912c..55fe750be4566 100644
--- a/x-pack/plugins/security_solution/server/plugin.ts
+++ b/x-pack/plugins/security_solution/server/plugin.ts
@@ -42,7 +42,7 @@ import { ILicense, LicensingPluginStart } from '../../licensing/server';
 import { FleetStartContract } from '../../fleet/server';
 import { TaskManagerSetupContract, TaskManagerStartContract } from '../../task_manager/server';
 import { compose } from './lib/compose/kibana';
-import { customAlertType } from './lib/detection_engine/reference_rules/custom';
+import { queryAlertType } from './lib/detection_engine/reference_rules/query';
 import { eqlAlertType } from './lib/detection_engine/reference_rules/eql';
 import { thresholdAlertType } from './lib/detection_engine/reference_rules/threshold';
 import { initRoutes } from './routes';
@@ -299,7 +299,7 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
     });
 
     // Register reference rule types via rule-registry
-    this.setupPlugins.ruleRegistry.registerType(customAlertType);
+    this.setupPlugins.ruleRegistry.registerType(queryAlertType);
     this.setupPlugins.ruleRegistry.registerType(eqlAlertType);
     this.setupPlugins.ruleRegistry.registerType(thresholdAlertType);
 

From 959e32a8f8e2ea01150cb433fbdf2fcbb5442e46 Mon Sep 17 00:00:00 2001
From: Garrett Spong <garrett.spong@elastic.co>
Date: Wed, 28 Apr 2021 22:25:57 -0600
Subject: [PATCH 18/54] Adds feature flag for enabling rule-registry within
 Security Solution

---
 x-pack/plugins/rule_registry/server/index.ts  |  4 --
 .../server/rule_registry/index.ts             |  5 --
 .../create_persistence_rule_type_factory.ts   | 19 ++++----
 .../security_solution/common/constants.ts     |  1 +
 .../common/experimental_features.ts           |  1 +
 .../public/common/mock/global_state.ts        |  1 +
 .../common/store/sourcerer/selectors.ts       |  5 +-
 .../alerts_table/default_config.tsx           | 46 ++++++++++++++++++-
 .../components/alerts_table/index.tsx         | 13 +++++-
 .../alerts/use_signal_index.tsx               | 13 +++++-
 .../detection_engine/reference_rules/eql.ts   |  9 ++--
 .../create_reference_rule_hierarchical.sh     |  0
 .../reference_rules/threshold.ts              |  9 ++--
 .../security_solution/server/plugin.ts        |  8 ++--
 14 files changed, 89 insertions(+), 45 deletions(-)
 mode change 100644 => 100755 x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_hierarchical.sh

diff --git a/x-pack/plugins/rule_registry/server/index.ts b/x-pack/plugins/rule_registry/server/index.ts
index c11e5122e9795..e2b4dec31b3f7 100644
--- a/x-pack/plugins/rule_registry/server/index.ts
+++ b/x-pack/plugins/rule_registry/server/index.ts
@@ -12,10 +12,6 @@ import { RuleRegistryPlugin } from './plugin';
 export { RuleRegistryPluginSetupContract } from './plugin';
 export { createLifecycleRuleTypeFactory } from './rule_registry/rule_type_helpers/create_lifecycle_rule_type_factory';
 export { createPersistenceRuleTypeFactory } from './rule_registry/rule_type_helpers/create_persistence_rule_type_factory';
-export { ecsFieldMap } from './generated/ecs_field_map';
-export { DefaultFieldMap } from './rule_registry/defaults/field_map';
-export { pickWithPatterns } from './rule_registry/field_map/pick_with_patterns';
-export { OutputOfFieldMap } from './rule_registry/field_map/runtime_type_from_fieldmap';
 export { FieldMapOf } from './types';
 export { ScopedRuleRegistryClient } from './rule_registry/create_scoped_rule_registry_client/types';
 
diff --git a/x-pack/plugins/rule_registry/server/rule_registry/index.ts b/x-pack/plugins/rule_registry/server/rule_registry/index.ts
index 2930dcb4640ee..9fc15e9322e2a 100644
--- a/x-pack/plugins/rule_registry/server/rule_registry/index.ts
+++ b/x-pack/plugins/rule_registry/server/rule_registry/index.ts
@@ -53,7 +53,6 @@ export class RuleRegistry<TFieldMap extends BaseRuleFieldMap> {
   private readonly types: Array<RuleType<TFieldMap, any, any>> = [];
 
   private readonly fieldmapType: FieldMapType<TFieldMap>;
-  public readonly alertingPluginSetupContract: AlertingPluginSetupContract;
 
   constructor(private readonly options: RuleRegistryOptions<TFieldMap>) {
     const { logger, coreSetup } = options;
@@ -62,10 +61,6 @@ export class RuleRegistry<TFieldMap extends BaseRuleFieldMap> {
 
     const { wait, signal } = createReadySignal<boolean>();
 
-    // Exposing alerting client temporarily to allow consumers to register rules
-    // both against the registry and alerting client directly
-    this.alertingPluginSetupContract = options.alertingPluginSetupContract;
-
     this.esAdapter = new ClusterClientAdapter<{
       body: TypeOfFieldMap<TFieldMap>;
       index: string;
diff --git a/x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_persistence_rule_type_factory.ts b/x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_persistence_rule_type_factory.ts
index ed1689ed20555..f94005b314aae 100644
--- a/x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_persistence_rule_type_factory.ts
+++ b/x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_persistence_rule_type_factory.ts
@@ -9,23 +9,22 @@ import v4 from 'uuid/v4';
 
 import { AlertInstance } from '../../../../alerting/server';
 import { ActionVariable, AlertInstanceState } from '../../../../alerting/common';
+import { baseRuleFieldMap, BaseRuleFieldMap, OutputOfFieldMap } from '../../../common';
 import { RuleParams, RuleType } from '../../types';
-import { DefaultFieldMap, defaultFieldMap } from '../defaults/field_map';
-import { OutputOfFieldMap } from '../field_map/runtime_type_from_fieldmap';
 import { RuleRegistry } from '..';
 
 type PersistenceAlertPersistenceService<
-  TFieldMap extends DefaultFieldMap,
+  TFieldMap extends BaseRuleFieldMap,
   TActionVariable extends ActionVariable
 > = (
   alerts: Array<OutputOfFieldMap<TFieldMap>>
 ) => Array<AlertInstance<AlertInstanceState, { [key in TActionVariable['name']]: any }, string>>;
 
-type PersistenceAlertQueryService<TFieldMap extends DefaultFieldMap> = (
+type PersistenceAlertQueryService<TFieldMap extends BaseRuleFieldMap> = (
   query: ESSearchRequest
 ) => Promise<Array<OutputOfFieldMap<TFieldMap>>>;
 
-type CreatePersistenceRuleType<TFieldMap extends DefaultFieldMap> = <
+type CreatePersistenceRuleType<TFieldMap extends BaseRuleFieldMap> = <
   TRuleParams extends RuleParams,
   TActionVariable extends ActionVariable
 >(
@@ -41,12 +40,12 @@ type CreatePersistenceRuleType<TFieldMap extends DefaultFieldMap> = <
 ) => RuleType<TFieldMap, TRuleParams, TActionVariable>;
 
 export function createPersistenceRuleTypeFactory<
-  TRuleRegistry extends RuleRegistry<DefaultFieldMap>
+  TRuleRegistry extends RuleRegistry<BaseRuleFieldMap>
 >(): TRuleRegistry extends RuleRegistry<infer TFieldMap>
   ? CreatePersistenceRuleType<TFieldMap>
   : never;
 
-export function createPersistenceRuleTypeFactory(): CreatePersistenceRuleType<DefaultFieldMap> {
+export function createPersistenceRuleTypeFactory(): CreatePersistenceRuleType<BaseRuleFieldMap> {
   return (type) => {
     return {
       ...type,
@@ -55,7 +54,7 @@ export function createPersistenceRuleTypeFactory(): CreatePersistenceRuleType<De
           services: { scopedClusterClient, scopedRuleRegistryClient, alertInstanceFactory, logger },
         } = options;
 
-        const currentAlerts: Array<OutputOfFieldMap<DefaultFieldMap>> = [];
+        const currentAlerts: Array<OutputOfFieldMap<BaseRuleFieldMap>> = [];
         const timestamp = options.startedAt.toISOString();
 
         const state = await type.executor({
@@ -68,12 +67,12 @@ export function createPersistenceRuleTypeFactory(): CreatePersistenceRuleType<De
             },
             findAlerts: async (query) => {
               const { body } = await scopedClusterClient.asCurrentUser.search<
-                OutputOfFieldMap<DefaultFieldMap>
+                OutputOfFieldMap<BaseRuleFieldMap>
               >({
                 ...query,
                 body: {
                   ...query.body,
-                  _source: Object.keys(defaultFieldMap),
+                  _source: Object.keys(baseRuleFieldMap),
                 },
                 ignore_unavailable: true,
               });
diff --git a/x-pack/plugins/security_solution/common/constants.ts b/x-pack/plugins/security_solution/common/constants.ts
index 5ebd35fc536ce..e913077ce0314 100644
--- a/x-pack/plugins/security_solution/common/constants.ts
+++ b/x-pack/plugins/security_solution/common/constants.ts
@@ -30,6 +30,7 @@ export const DEFAULT_LISTS_INDEX = '.lists';
 export const DEFAULT_ITEMS_INDEX = '.items';
 // The DEFAULT_MAX_SIGNALS value exists also in `x-pack/plugins/cases/common/constants.ts`
 // If either changes, engineer should ensure both values are updated
+export const DEFAULT_ALERTS_INDEX = '*alerts-security-solution*';
 export const DEFAULT_MAX_SIGNALS = 100;
 export const DEFAULT_SEARCH_AFTER_PAGE_SIZE = 100;
 export const DEFAULT_ANOMALY_SCORE = 'securitySolution:defaultAnomalyScore';
diff --git a/x-pack/plugins/security_solution/common/experimental_features.ts b/x-pack/plugins/security_solution/common/experimental_features.ts
index 8d1cc4ca2c1f0..a9d24836fe7f0 100644
--- a/x-pack/plugins/security_solution/common/experimental_features.ts
+++ b/x-pack/plugins/security_solution/common/experimental_features.ts
@@ -16,6 +16,7 @@ const allowedExperimentalValues = Object.freeze({
   metricsEntitiesEnabled: false,
   eventFilteringEnabled: false,
   hostIsolationEnabled: false,
+  ruleRegistryEnabled: false,
 });
 
 type ExperimentalConfigKeys = Array<keyof ExperimentalFeatures>;
diff --git a/x-pack/plugins/security_solution/public/common/mock/global_state.ts b/x-pack/plugins/security_solution/public/common/mock/global_state.ts
index b1b3147f4f494..6a83567e3650b 100644
--- a/x-pack/plugins/security_solution/public/common/mock/global_state.ts
+++ b/x-pack/plugins/security_solution/public/common/mock/global_state.ts
@@ -44,6 +44,7 @@ export const mockGlobalState: State = {
       trustedAppsByPolicyEnabled: false,
       metricsEntitiesEnabled: false,
       hostIsolationEnabled: false,
+      ruleRegistryEnabled: false,
     },
   },
   hosts: {
diff --git a/x-pack/plugins/security_solution/public/common/store/sourcerer/selectors.ts b/x-pack/plugins/security_solution/public/common/store/sourcerer/selectors.ts
index aebc61f29490f..53702bcf23b89 100644
--- a/x-pack/plugins/security_solution/public/common/store/sourcerer/selectors.ts
+++ b/x-pack/plugins/security_solution/public/common/store/sourcerer/selectors.ts
@@ -82,15 +82,14 @@ export const getAllExistingIndexNamesSelector = () => {
 };
 
 const EXCLUDE_ELASTIC_CLOUD_INDEX = '-*elastic-cloud-logs-*';
-const ALERTS_AS_DATA_INDEX = '*alerts-security-solution*';
 
 export const getSourcererScopeSelector = () => {
   const getScopeIdSelector = scopeIdSelector();
   const getSelectedPatterns = memoizeOne((selectedPatternsStr: string): string[] => {
     const selectedPatterns = selectedPatternsStr.length > 0 ? selectedPatternsStr.split(',') : [];
     return selectedPatterns.some((index) => index === 'logs-*')
-      ? [...selectedPatterns, EXCLUDE_ELASTIC_CLOUD_INDEX, ALERTS_AS_DATA_INDEX]
-      : [...selectedPatterns, ALERTS_AS_DATA_INDEX];
+      ? [...selectedPatterns, EXCLUDE_ELASTIC_CLOUD_INDEX]
+      : selectedPatterns;
   });
 
   const getIndexPattern = memoizeOne(
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/default_config.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/default_config.tsx
index a6b0a9726c21b..a9b2b21051f3b 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/default_config.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/default_config.tsx
@@ -74,7 +74,41 @@ export const buildShowBuildingBlockFilter = (showBuildingBlockAlerts: boolean):
         // },
 ];
 
+export const alertsDefaultModel: SubsetTimelineModel = {
+  ...timelineDefaults,
+  columns,
+  showCheckboxes: true,
+  excludedRowRendererIds: Object.values(RowRendererId),
+};
+
 export const requiredFieldsForActions = [
+  '@timestamp',
+  'signal.status',
+  'signal.group.id',
+  'signal.original_time',
+  'signal.rule.building_block_type',
+  'signal.rule.filters',
+  'signal.rule.from',
+  'signal.rule.language',
+  'signal.rule.query',
+  'signal.rule.name',
+  'signal.rule.to',
+  'signal.rule.id',
+  'signal.rule.index',
+  'signal.rule.type',
+  'signal.original_event.kind',
+  'signal.original_event.module',
+  // Endpoint exception fields
+  'file.path',
+  'file.Ext.code_signature.subject_name',
+  'file.Ext.code_signature.trusted',
+  'file.hash.sha256',
+  'host.os.family',
+  'event.code',
+];
+
+// TODO: Once we are past experimental phase this code should be removed
+export const requiredFieldsForActionsRuleRegistry = [
   'alert.id',
   '@timestamp',
   'event.kind',
@@ -91,9 +125,17 @@ export const requiredFieldsForActions = [
   'tags',
 ];
 
-export const alertsDefaultModel: SubsetTimelineModel = {
+export const alertsHeadersRuleRegistry: ColumnHeaderOptions[] = requiredFieldsForActionsRuleRegistry.map<ColumnHeaderOptions>(
+  (field) => ({
+    columnHeaderType: defaultColumnHeaderType,
+    id: field,
+    width: 120,
+  })
+);
+
+export const alertsDefaultModelRuleRegistry: SubsetTimelineModel = {
   ...timelineDefaults,
-  columns,
+  columns: alertsHeadersRuleRegistry,
   showCheckboxes: true,
   excludedRowRendererIds: Object.values(RowRendererId),
 };
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx
index 9dc83d7898963..04140e167bb54 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx
@@ -16,6 +16,7 @@ import { TimelineIdLiteral } from '../../../../common/types/timeline';
 import { useAppToasts } from '../../../common/hooks/use_app_toasts';
 import { StatefulEventsViewer } from '../../../common/components/events_viewer';
 import { HeaderSection } from '../../../common/components/header_section';
+import { useIsExperimentalFeatureEnabled } from '../../../common/hooks/use_experimental_features';
 import { combineQueries } from '../../../timelines/components/timeline/helpers';
 import { useKibana } from '../../../common/lib/kibana';
 import { inputsSelectors, State, inputsModel } from '../../../common/store';
@@ -29,6 +30,7 @@ import {
   requiredFieldsForActions,
   alertsDefaultModel,
   buildAlertStatusFilter,
+  alertsDefaultModelRuleRegistry,
 } from './default_config';
 import { FILTER_OPEN, AlertsTableFilterGroup } from './alerts_filter_group';
 import { AlertsUtilityBar } from './alerts_utility_bar';
@@ -104,6 +106,8 @@ export const AlertsTableComponent: React.FC<AlertsTableComponentProps> = ({
   const [, dispatchToaster] = useStateToaster();
   const { addWarning } = useAppToasts();
   const { initializeTimeline, setSelectAll } = useManageTimeline();
+  // TODO: Once we are past experimental phase this code should be removed
+  const ruleRegistryEnabled = useIsExperimentalFeatureEnabled('ruleRegistryEnabled');
 
   const getGlobalQuery = useCallback(
     (customFilters: Filter[]) => {
@@ -309,10 +313,15 @@ export const AlertsTableComponent: React.FC<AlertsTableComponentProps> = ({
   }, [defaultFilters, filterGroup]);
   const { filterManager } = useKibana().services.data.query;
 
+  // TODO: Once we are past experimental phase this code should be removed
+  const defaultTimelineModel = ruleRegistryEnabled
+    ? alertsDefaultModelRuleRegistry
+    : alertsDefaultModel;
+
   useEffect(() => {
     initializeTimeline({
       defaultModel: {
-        ...alertsDefaultModel,
+        ...defaultTimelineModel,
         columns,
       },
       documentType: i18n.ALERTS_DOCUMENT_TYPE,
@@ -344,7 +353,7 @@ export const AlertsTableComponent: React.FC<AlertsTableComponentProps> = ({
   return (
     <StatefulEventsViewer
       pageFilters={defaultFiltersMemo}
-      defaultModel={alertsDefaultModel}
+      defaultModel={defaultTimelineModel}
       end={to}
       headerFilterGroup={headerFilterGroup}
       id={timelineId}
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_signal_index.tsx b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_signal_index.tsx
index fdbeab26f11f3..84eaf8e3aa93c 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_signal_index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_signal_index.tsx
@@ -6,8 +6,10 @@
  */
 
 import { useEffect, useState } from 'react';
+import { DEFAULT_ALERTS_INDEX } from '../../../../../common/constants';
 
 import { useAppToasts } from '../../../../common/hooks/use_app_toasts';
+import { useIsExperimentalFeatureEnabled } from '../../../../common/hooks/use_experimental_features';
 import { createSignalIndex, getSignalIndex } from './api';
 import * as i18n from './translations';
 import { isSecurityAppError } from '../../../../common/utils/api';
@@ -38,6 +40,8 @@ export const useSignalIndex = (): ReturnSignalIndex => {
   });
   const { addError } = useAppToasts();
   const { hasIndexRead } = useAlertsPrivileges();
+  // TODO: Once we are past experimental phase this code should be removed
+  const ruleRegistryEnabled = useIsExperimentalFeatureEnabled('ruleRegistryEnabled');
 
   useEffect(() => {
     let isSubscribed = true;
@@ -48,10 +52,15 @@ export const useSignalIndex = (): ReturnSignalIndex => {
         setLoading(true);
         const signal = await getSignalIndex({ signal: abortCtrl.signal });
 
+        // TODO: Once we are past experimental phase we can update `getSignalIndex` to return the space-aware DEFAULT_ALERTS_INDEX
+        const signalIndices = ruleRegistryEnabled
+          ? `${DEFAULT_ALERTS_INDEX},${signal.name}`
+          : signal.name;
+
         if (isSubscribed && signal != null) {
           setSignalIndex({
             signalIndexExists: true,
-            signalIndexName: signal.name,
+            signalIndexName: signalIndices,
             signalIndexMappingOutdated: signal.index_mapping_outdated,
             createDeSignalIndex: createIndex,
           });
@@ -115,7 +124,7 @@ export const useSignalIndex = (): ReturnSignalIndex => {
       isSubscribed = false;
       abortCtrl.abort();
     };
-  }, [addError, hasIndexRead]);
+  }, [addError, hasIndexRead, ruleRegistryEnabled]);
 
   return { loading, ...signalIndex };
 };
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.ts
index 7bf1cfd0c6293..5f5a99625d783 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.ts
@@ -10,12 +10,9 @@ import v4 from 'uuid/v4';
 
 import { ApiResponse } from '@elastic/elasticsearch';
 import { schema } from '@kbn/config-schema';
+import { BaseRuleFieldMap, OutputOfFieldMap } from '../../../../../rule_registry/common';
 
-import {
-  DefaultFieldMap,
-  OutputOfFieldMap,
-  createPersistenceRuleTypeFactory,
-} from '../../../../../rule_registry/server';
+import { createPersistenceRuleTypeFactory } from '../../../../../rule_registry/server';
 import { EQL_ALERT_TYPE_ID } from '../../../../common/constants';
 import { buildEqlSearchRequest } from '../../../../common/detection_engine/get_query_filter';
 import { SecurityRuleRegistry } from '../../../plugin';
@@ -23,7 +20,7 @@ import { BaseSignalHit, EqlSignalSearchResponse } from '../signals/types';
 
 const createSecurityEQLRuleType = createPersistenceRuleTypeFactory<SecurityRuleRegistry>();
 
-type AlertType = OutputOfFieldMap<DefaultFieldMap>;
+type AlertType = OutputOfFieldMap<BaseRuleFieldMap>;
 
 export const eqlAlertType = createSecurityEQLRuleType({
   id: EQL_ALERT_TYPE_ID,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_hierarchical.sh b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_hierarchical.sh
old mode 100644
new mode 100755
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.ts
index d5b214c2e149f..6aa8994d6f37c 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.ts
@@ -13,11 +13,8 @@ import { schema } from '@kbn/config-schema';
 import { Logger } from '../../../../../../../src/core/server';
 
 import { AlertServices } from '../../../../../alerting/server';
-import {
-  DefaultFieldMap,
-  OutputOfFieldMap,
-  createPersistenceRuleTypeFactory,
-} from '../../../../../rule_registry/server';
+import { BaseRuleFieldMap, OutputOfFieldMap } from '../../../../../rule_registry/common';
+import { createPersistenceRuleTypeFactory } from '../../../../../rule_registry/server';
 import { THRESHOLD_ALERT_TYPE_ID } from '../../../../common/constants';
 import { SecurityRuleRegistry } from '../../../plugin';
 import { SignalSearchResponse, ThresholdSignalHistory } from '../signals/types';
@@ -32,7 +29,7 @@ import { BuildRuleMessage } from '../signals/rule_messages';
 
 const createSecurityThresholdRuleType = createPersistenceRuleTypeFactory<SecurityRuleRegistry>();
 
-type AlertType = OutputOfFieldMap<DefaultFieldMap>;
+type AlertType = OutputOfFieldMap<BaseRuleFieldMap>;
 
 interface Rule {
   id: string;
diff --git a/x-pack/plugins/security_solution/server/plugin.ts b/x-pack/plugins/security_solution/server/plugin.ts
index 55fe750be4566..11eb3c92e742b 100644
--- a/x-pack/plugins/security_solution/server/plugin.ts
+++ b/x-pack/plugins/security_solution/server/plugin.ts
@@ -27,11 +27,8 @@ import {
   PluginSetupContract as AlertingSetup,
   PluginStartContract as AlertPluginStartContract,
 } from '../../alerting/server';
-import {
-  ecsFieldMap,
-  pickWithPatterns,
-  RuleRegistryPluginSetupContract,
-} from '../../rule_registry/server';
+import { ecsFieldMap, pickWithPatterns } from '../../rule_registry/common';
+import { RuleRegistryPluginSetupContract } from '../../rule_registry/server';
 import { SecurityPluginSetup as SecuritySetup, SecurityPluginStart } from '../../security/server';
 import { PluginSetupContract as FeaturesSetup } from '../../features/server';
 import { MlPluginSetup as MlSetup } from '../../ml/server';
@@ -171,6 +168,7 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
 
   public setup(core: CoreSetup<StartPlugins, PluginStart>, plugins: SetupPlugins) {
     this.logger.debug('plugin setup');
+    this.setupPlugins = plugins;
 
     const config = this.config;
     const globalConfig = this.context.config.legacy.get();

From 52c76e0348f77b3a9cbb31817193516883f22cc6 Mon Sep 17 00:00:00 2001
From: Garrett Spong <garrett.spong@elastic.co>
Date: Mon, 3 May 2021 14:51:00 -0600
Subject: [PATCH 19/54] Fixing jest tests and only registering rules with
 registry if feature flag is set

---
 .../alerts/use_signal_index.test.tsx          | 44 +++++++++----------
 .../security_solution/server/plugin.ts        | 27 +++++++-----
 2 files changed, 35 insertions(+), 36 deletions(-)

diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_signal_index.test.tsx b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_signal_index.test.tsx
index a9789aa4d4f36..235feb19aae69 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_signal_index.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_signal_index.test.tsx
@@ -6,6 +6,8 @@
  */
 import React from 'react';
 import { renderHook, act } from '@testing-library/react-hooks';
+import React from 'react';
+import { TestProviders } from '../../../../common/mock';
 import { useSignalIndex, ReturnSignalIndex } from './use_signal_index';
 import * as api from './api';
 import { useAppToastsMock } from '../../../../common/hooks/use_app_toasts.mock';
@@ -31,10 +33,9 @@ describe('useSignalIndex', () => {
 
   test('init', async () => {
     await act(async () => {
-      const { result, waitForNextUpdate } = renderHook<void, ReturnSignalIndex>(
-        () => useSignalIndex(),
-        { wrapper: Wrapper }
-      );
+      const { result, waitForNextUpdate } = renderHook(() => useSignalIndex(), {
+        wrapper: TestProviders,
+      });
       await waitForNextUpdate();
       expect(result.current).toEqual({
         createDeSignalIndex: null,
@@ -48,10 +49,9 @@ describe('useSignalIndex', () => {
 
   test('fetch alerts info', async () => {
     await act(async () => {
-      const { result, waitForNextUpdate } = renderHook<void, ReturnSignalIndex>(
-        () => useSignalIndex(),
-        { wrapper: Wrapper }
-      );
+      const { result, waitForNextUpdate } = renderHook(() => useSignalIndex(), {
+        wrapper: TestProviders,
+      });
       await waitForNextUpdate();
       await waitForNextUpdate();
       await waitForNextUpdate();
@@ -67,10 +67,9 @@ describe('useSignalIndex', () => {
 
   test('make sure that createSignalIndex is giving back the signal info', async () => {
     await act(async () => {
-      const { result, waitForNextUpdate } = renderHook<void, ReturnSignalIndex>(
-        () => useSignalIndex(),
-        { wrapper: Wrapper }
-      );
+      const { result, waitForNextUpdate } = renderHook(() => useSignalIndex(), {
+        wrapper: TestProviders,
+      });
       await waitForNextUpdate();
       await waitForNextUpdate();
       await waitForNextUpdate();
@@ -91,10 +90,9 @@ describe('useSignalIndex', () => {
   test('make sure that createSignalIndex have been called when trying to create signal index', async () => {
     const spyOnCreateSignalIndex = jest.spyOn(api, 'createSignalIndex');
     await act(async () => {
-      const { result, waitForNextUpdate } = renderHook<void, ReturnSignalIndex>(
-        () => useSignalIndex(),
-        { wrapper: Wrapper }
-      );
+      const { result, waitForNextUpdate } = renderHook(() => useSignalIndex(), {
+        wrapper: TestProviders,
+      });
       await waitForNextUpdate();
       await waitForNextUpdate();
       await waitForNextUpdate();
@@ -112,10 +110,9 @@ describe('useSignalIndex', () => {
       throw new Error('Something went wrong, let see what happen');
     });
     await act(async () => {
-      const { result, waitForNextUpdate } = renderHook<void, ReturnSignalIndex>(
-        () => useSignalIndex(),
-        { wrapper: Wrapper }
-      );
+      const { result, waitForNextUpdate } = renderHook(() => useSignalIndex(), {
+        wrapper: TestProviders,
+      });
       await waitForNextUpdate();
       await waitForNextUpdate();
       await waitForNextUpdate();
@@ -138,10 +135,9 @@ describe('useSignalIndex', () => {
       throw new Error('Something went wrong, let see what happen');
     });
     await act(async () => {
-      const { result, waitForNextUpdate } = renderHook<void, ReturnSignalIndex>(
-        () => useSignalIndex(),
-        { wrapper: Wrapper }
-      );
+      const { result, waitForNextUpdate } = renderHook(() => useSignalIndex(), {
+        wrapper: TestProviders,
+      });
       await waitForNextUpdate();
       await waitForNextUpdate();
       await waitForNextUpdate();
diff --git a/x-pack/plugins/security_solution/server/plugin.ts b/x-pack/plugins/security_solution/server/plugin.ts
index 11eb3c92e742b..d9a24893087c7 100644
--- a/x-pack/plugins/security_solution/server/plugin.ts
+++ b/x-pack/plugins/security_solution/server/plugin.ts
@@ -287,19 +287,22 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
       },
     });
 
-    // Create rule-registry scoped to security-solution (APP_ID uses caps, not supported)
-    this.setupPlugins.ruleRegistry = plugins.ruleRegistry.create({
-      name: 'security-solution',
-      // fieldMap: ecsFieldMap,
-      fieldMap: {
-        ...pickWithPatterns(ecsFieldMap, 'host.name', 'service.name'),
-      },
-    });
+    // TODO: Once we are past experimental phase this check can be removed along with legacy registration of rules
+    if (experimentalFeatures.ruleRegistryEnabled) {
+      // Create rule-registry scoped to security-solution (APP_ID uses caps, not supported)
+      this.setupPlugins.ruleRegistry = plugins.ruleRegistry.create({
+        name: 'security-solution',
+        // fieldMap: ecsFieldMap,
+        fieldMap: {
+          ...pickWithPatterns(ecsFieldMap, 'host.name', 'service.name'),
+        },
+      });
 
-    // Register reference rule types via rule-registry
-    this.setupPlugins.ruleRegistry.registerType(queryAlertType);
-    this.setupPlugins.ruleRegistry.registerType(eqlAlertType);
-    this.setupPlugins.ruleRegistry.registerType(thresholdAlertType);
+      // Register reference rule types via rule-registry
+      this.setupPlugins.ruleRegistry.registerType(queryAlertType);
+      this.setupPlugins.ruleRegistry.registerType(eqlAlertType);
+      this.setupPlugins.ruleRegistry.registerType(thresholdAlertType);
+    }
 
     // Continue to register legacy rules against alerting client exposed through rule-registry
     if (this.setupPlugins.alerting != null) {

From c76caaee2b34910ebcd52b550ac0a88c2f17a1aa Mon Sep 17 00:00:00 2001
From: Garrett Spong <garrett.spong@elastic.co>
Date: Mon, 3 May 2021 16:03:51 -0600
Subject: [PATCH 20/54] Fix test types

---
 .../public/common/mock/test_providers.tsx     |  2 +-
 .../alerts/use_signal_index.test.tsx          | 55 ++++++++++++-------
 2 files changed, 37 insertions(+), 20 deletions(-)

diff --git a/x-pack/plugins/security_solution/public/common/mock/test_providers.tsx b/x-pack/plugins/security_solution/public/common/mock/test_providers.tsx
index 90526e84a2262..c18eb8dc704a9 100644
--- a/x-pack/plugins/security_solution/public/common/mock/test_providers.tsx
+++ b/x-pack/plugins/security_solution/public/common/mock/test_providers.tsx
@@ -28,7 +28,7 @@ import { createSecuritySolutionStorageMock, localStorageMock } from './mock_loca
 const state: State = mockGlobalState;
 
 interface Props {
-  children: React.ReactNode;
+  children?: React.ReactNode;
   store?: Store;
   onDragEnd?: (result: DropResult, provided: ResponderProvided) => void;
 }
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_signal_index.test.tsx b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_signal_index.test.tsx
index 235feb19aae69..7bf0abda7da1b 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_signal_index.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_signal_index.test.tsx
@@ -6,7 +6,6 @@
  */
 import React from 'react';
 import { renderHook, act } from '@testing-library/react-hooks';
-import React from 'react';
 import { TestProviders } from '../../../../common/mock';
 import { useSignalIndex, ReturnSignalIndex } from './use_signal_index';
 import * as api from './api';
@@ -33,9 +32,12 @@ describe('useSignalIndex', () => {
 
   test('init', async () => {
     await act(async () => {
-      const { result, waitForNextUpdate } = renderHook(() => useSignalIndex(), {
-        wrapper: TestProviders,
-      });
+      const { result, waitForNextUpdate } = renderHook<void, ReturnSignalIndex>(
+        () => useSignalIndex(),
+        {
+          wrapper: TestProviders,
+        }
+      );
       await waitForNextUpdate();
       expect(result.current).toEqual({
         createDeSignalIndex: null,
@@ -49,9 +51,12 @@ describe('useSignalIndex', () => {
 
   test('fetch alerts info', async () => {
     await act(async () => {
-      const { result, waitForNextUpdate } = renderHook(() => useSignalIndex(), {
-        wrapper: TestProviders,
-      });
+      const { result, waitForNextUpdate } = renderHook<void, ReturnSignalIndex>(
+        () => useSignalIndex(),
+        {
+          wrapper: TestProviders,
+        }
+      );
       await waitForNextUpdate();
       await waitForNextUpdate();
       await waitForNextUpdate();
@@ -67,9 +72,12 @@ describe('useSignalIndex', () => {
 
   test('make sure that createSignalIndex is giving back the signal info', async () => {
     await act(async () => {
-      const { result, waitForNextUpdate } = renderHook(() => useSignalIndex(), {
-        wrapper: TestProviders,
-      });
+      const { result, waitForNextUpdate } = renderHook<void, ReturnSignalIndex>(
+        () => useSignalIndex(),
+        {
+          wrapper: TestProviders,
+        }
+      );
       await waitForNextUpdate();
       await waitForNextUpdate();
       await waitForNextUpdate();
@@ -90,9 +98,12 @@ describe('useSignalIndex', () => {
   test('make sure that createSignalIndex have been called when trying to create signal index', async () => {
     const spyOnCreateSignalIndex = jest.spyOn(api, 'createSignalIndex');
     await act(async () => {
-      const { result, waitForNextUpdate } = renderHook(() => useSignalIndex(), {
-        wrapper: TestProviders,
-      });
+      const { result, waitForNextUpdate } = renderHook<void, ReturnSignalIndex>(
+        () => useSignalIndex(),
+        {
+          wrapper: TestProviders,
+        }
+      );
       await waitForNextUpdate();
       await waitForNextUpdate();
       await waitForNextUpdate();
@@ -110,9 +121,12 @@ describe('useSignalIndex', () => {
       throw new Error('Something went wrong, let see what happen');
     });
     await act(async () => {
-      const { result, waitForNextUpdate } = renderHook(() => useSignalIndex(), {
-        wrapper: TestProviders,
-      });
+      const { result, waitForNextUpdate } = renderHook<void, ReturnSignalIndex>(
+        () => useSignalIndex(),
+        {
+          wrapper: TestProviders,
+        }
+      );
       await waitForNextUpdate();
       await waitForNextUpdate();
       await waitForNextUpdate();
@@ -135,9 +149,12 @@ describe('useSignalIndex', () => {
       throw new Error('Something went wrong, let see what happen');
     });
     await act(async () => {
-      const { result, waitForNextUpdate } = renderHook(() => useSignalIndex(), {
-        wrapper: TestProviders,
-      });
+      const { result, waitForNextUpdate } = renderHook<void, ReturnSignalIndex>(
+        () => useSignalIndex(),
+        {
+          wrapper: TestProviders,
+        }
+      );
       await waitForNextUpdate();
       await waitForNextUpdate();
       await waitForNextUpdate();

From 29af8f22b8196eb468b1086ec2aa4350d4b2fe9d Mon Sep 17 00:00:00 2001
From: Madison Caldwell <madison.caldwell@elastic.co>
Date: Thu, 29 Apr 2021 22:32:00 -0400
Subject: [PATCH 21/54] Add example unit test for eql rule

---
 .../reference_rules/__mocks__/rule_type.ts    | 65 +++++++++++++++++++
 .../reference_rules/eql.test.ts               | 49 ++++++++++++++
 .../scripts/create_reference_rule.sh          | 33 ----------
 .../create_reference_rule_hierarchical.sh     | 38 -----------
 ...stom.sh => create_reference_rule_query.sh} |  0
 5 files changed, 114 insertions(+), 71 deletions(-)
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/__mocks__/rule_type.ts
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.test.ts
 delete mode 100755 x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule.sh
 delete mode 100755 x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_hierarchical.sh
 rename x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/{create_reference_rule_custom.sh => create_reference_rule_query.sh} (100%)

diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/__mocks__/rule_type.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/__mocks__/rule_type.ts
new file mode 100644
index 0000000000000..f134b9056ee5b
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/__mocks__/rule_type.ts
@@ -0,0 +1,65 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { Logger } from 'kibana/server';
+import { of } from 'rxjs';
+import { elasticsearchServiceMock } from 'src/core/server/mocks';
+import { SecurityRuleRegistry } from '../../../../plugin';
+import { ConfigType } from '../../../../config';
+
+export const createRuleTypeMocks = () => {
+  /* eslint-disable @typescript-eslint/no-explicit-any */
+  let alertExecutor: (...args: any[]) => Promise<Record<string, any>>;
+
+  const mockedConfig$ = of({
+    /* eslint-disable @typescript-eslint/naming-convention */
+    // 'apm_oss.errorIndices': 'apm-*',
+    // 'apm_oss.transactionIndices': 'apm-*',
+    /* eslint-enable @typescript-eslint/naming-convention */
+  } as ConfigType);
+
+  const loggerMock = ({
+    debug: jest.fn(),
+    warn: jest.fn(),
+    error: jest.fn(),
+  } as unknown) as Logger;
+
+  const registry = {
+    registerType: ({ executor }) => {
+      alertExecutor = executor;
+    },
+  } as SecurityRuleRegistry;
+
+  const scheduleActions = jest.fn();
+
+  const services = {
+    scopedClusterClient: elasticsearchServiceMock.createScopedClusterClient(),
+    scopedRuleRegistryClient: {
+      bulkIndex: jest.fn(),
+    },
+    alertInstanceFactory: jest.fn(() => ({ scheduleActions })),
+    alertWithLifecycle: jest.fn(),
+    logger: loggerMock,
+  };
+
+  return {
+    dependencies: {
+      registry,
+      config$: mockedConfig$,
+      logger: loggerMock,
+    },
+    services,
+    scheduleActions,
+    executor: async ({ params }: { params: Record<string, unknown> }) => {
+      return alertExecutor({
+        services,
+        params,
+        startedAt: new Date(),
+      });
+    },
+  };
+};
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.test.ts
new file mode 100644
index 0000000000000..04a5f0d319cb1
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.test.ts
@@ -0,0 +1,49 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { eqlAlertType } from './eql';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { elasticsearchClientMock } from 'src/core/server/elasticsearch/client/mocks';
+import { createRuleTypeMocks } from './__mocks__/rule_type';
+
+describe('Error count alert', () => {
+  it("doesn't send an alert when sequence not found", async () => {
+    const { services, dependencies, executor } = createRuleTypeMocks();
+
+    dependencies.registry.registerType(eqlAlertType);
+
+    const params = {
+        eqlQuery: 'sequence by host.name [network where true=true]',
+        indexPatterns: ['*'],
+    };
+
+    services.scopedClusterClient.asCurrentUser.transport.request.mockReturnValue(
+      elasticsearchClientMock.createSuccessTransportRequestPromise({
+        hits: {
+          hits: [],
+          sequences: [],
+          events: [],
+          total: {
+            relation: 'eq',
+            value: 0,
+          },
+        },
+        took: 0,
+        timed_out: false,
+        _shards: {
+          failed: 0,
+          skipped: 0,
+          successful: 1,
+          total: 1,
+        },
+      })
+    );
+
+    await executor({ params });
+    expect(services.alertInstanceFactory).not.toBeCalled();
+  });
+});
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule.sh b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule.sh
deleted file mode 100755
index d547f295c5d0d..0000000000000
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule.sh
+++ /dev/null
@@ -1,33 +0,0 @@
-#!/bin/sh
-#
-# Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
-# or more contributor license agreements. Licensed under the Elastic License
-# 2.0; you may not use this file except in compliance with the Elastic License
-# 2.0.
-#
-
-curl -X POST http://localhost:5601/${BASE_PATH}/api/alerts/alert \
-     -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
-     -H 'kbn-xsrf: true' \
-     -H 'Content-Type: application/json' \
-     --verbose \
-     -d '
-{
-  "params":{
-      "server":"howdy",
-      "threshold": 0.90
-   },
-   "consumer":"alerts",
-   "alertTypeId":"siem.referenceRule",
-   "schedule":{
-      "interval":"1m"
-   },
-   "actions":[],
-   "tags":[
-      "cpu"
-   ],
-   "notifyWhen":"onActionGroupChange",
-   "name":"Basic lifecycle rule"
-}'
-
-
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_hierarchical.sh b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_hierarchical.sh
deleted file mode 100755
index 61e0fd206654e..0000000000000
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_hierarchical.sh
+++ /dev/null
@@ -1,38 +0,0 @@
-#!/bin/sh
-#
-# Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
-# or more contributor license agreements. Licensed under the Elastic License
-# 2.0; you may not use this file except in compliance with the Elastic License
-# 2.0.
-#
-
-# TODO: create a persistence rule matching against `signal.rule.id`
-# (the id of the rule type) or whatever the equivalent field is.
-# Have the persistence rule create those fields on the alert.
-curl -X POST http://localhost:5601/${BASE_PATH}/api/alerts/alert \
-     -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
-     -H 'kbn-xsrf: true' \
-     -H 'Content-Type: application/json' \
-     --verbose \
-     -d '
-{
-  "params":{
-     "indexPatterns": ["*"],
-     "customQuery": "rule.id:siem.referenceRule"
-   },
-   "consumer":"alerts",
-   "alertTypeId":"siem.customRule",
-   "schedule":{
-      "interval":"1m"
-   },
-   "actions":[],
-   "tags":[
-      "custom",
-      "hierarchical",
-      "persistence"
-   ],
-   "notifyWhen":"onActionGroupChange",
-   "name":"Hierarchical custom query rule"
-}'
-
-
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_custom.sh b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_query.sh
similarity index 100%
rename from x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_custom.sh
rename to x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_query.sh

From ae7c1d61607de4b85126bda1200193417b2c4ec4 Mon Sep 17 00:00:00 2001
From: Madison Caldwell <madison.caldwell@elastic.co>
Date: Thu, 29 Apr 2021 22:34:48 -0400
Subject: [PATCH 22/54] minor fixes

---
 .../reference_rules/__mocks__/rule_type.ts                 | 7 ++-----
 .../lib/detection_engine/reference_rules/query.test.ts     | 6 ++++++
 .../lib/detection_engine/reference_rules/threshold.test.ts | 6 ++++++
 3 files changed, 14 insertions(+), 5 deletions(-)
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/query.test.ts
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.test.ts

diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/__mocks__/rule_type.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/__mocks__/rule_type.ts
index f134b9056ee5b..1eb20e3d88a5f 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/__mocks__/rule_type.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/__mocks__/rule_type.ts
@@ -16,10 +16,6 @@ export const createRuleTypeMocks = () => {
   let alertExecutor: (...args: any[]) => Promise<Record<string, any>>;
 
   const mockedConfig$ = of({
-    /* eslint-disable @typescript-eslint/naming-convention */
-    // 'apm_oss.errorIndices': 'apm-*',
-    // 'apm_oss.transactionIndices': 'apm-*',
-    /* eslint-enable @typescript-eslint/naming-convention */
   } as ConfigType);
 
   const loggerMock = ({
@@ -42,7 +38,8 @@ export const createRuleTypeMocks = () => {
       bulkIndex: jest.fn(),
     },
     alertInstanceFactory: jest.fn(() => ({ scheduleActions })),
-    alertWithLifecycle: jest.fn(),
+    findAlerts: jest.fn(), // TODO: does this stay?
+    alertWithPersistence: jest.fn(),
     logger: loggerMock,
   };
 
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/query.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/query.test.ts
new file mode 100644
index 0000000000000..6e73da33405b8
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/query.test.ts
@@ -0,0 +1,6 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
\ No newline at end of file
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.test.ts
new file mode 100644
index 0000000000000..6e73da33405b8
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.test.ts
@@ -0,0 +1,6 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
\ No newline at end of file

From b4f0ff76218388a47e48c209d1874a15c6e7d511 Mon Sep 17 00:00:00 2001
From: Madison Caldwell <madison.caldwell@elastic.co>
Date: Sun, 2 May 2021 22:47:01 -0400
Subject: [PATCH 23/54] Add unit tests, fix bugs

---
 .../reference_rules/__mocks__/rule_type.ts    |  3 +-
 .../reference_rules/eql.test.ts               | 49 +++++++++++++++++--
 .../detection_engine/reference_rules/eql.ts   |  4 +-
 .../reference_rules/query.test.ts             |  2 +-
 .../scripts/create_reference_rule_eql.sh      |  2 +-
 .../reference_rules/threshold.test.ts         |  2 +-
 6 files changed, 50 insertions(+), 12 deletions(-)

diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/__mocks__/rule_type.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/__mocks__/rule_type.ts
index 1eb20e3d88a5f..3482c21dc99a3 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/__mocks__/rule_type.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/__mocks__/rule_type.ts
@@ -15,8 +15,7 @@ export const createRuleTypeMocks = () => {
   /* eslint-disable @typescript-eslint/no-explicit-any */
   let alertExecutor: (...args: any[]) => Promise<Record<string, any>>;
 
-  const mockedConfig$ = of({
-  } as ConfigType);
+  const mockedConfig$ = of({} as ConfigType);
 
   const loggerMock = ({
     debug: jest.fn(),
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.test.ts
index 04a5f0d319cb1..981a5413bffcf 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.test.ts
@@ -5,20 +5,23 @@
  * 2.0.
  */
 
-import { eqlAlertType } from './eql';
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
 import { elasticsearchClientMock } from 'src/core/server/elasticsearch/client/mocks';
+
+import { sequenceResponse } from '../../../search_strategy/timeline/eql/__mocks__';
+
+import { eqlAlertType } from './eql';
 import { createRuleTypeMocks } from './__mocks__/rule_type';
 
-describe('Error count alert', () => {
-  it("doesn't send an alert when sequence not found", async () => {
+describe('EQL alerts', () => {
+  it('does not send an alert when sequence not found', async () => {
     const { services, dependencies, executor } = createRuleTypeMocks();
 
     dependencies.registry.registerType(eqlAlertType);
 
     const params = {
-        eqlQuery: 'sequence by host.name [network where true=true]',
-        indexPatterns: ['*'],
+      eqlQuery: 'sequence by host.name↵[any where true]↵[any where true]↵[any where true]',
+      indexPatterns: ['*'],
     };
 
     services.scopedClusterClient.asCurrentUser.transport.request.mockReturnValue(
@@ -46,4 +49,40 @@ describe('Error count alert', () => {
     await executor({ params });
     expect(services.alertInstanceFactory).not.toBeCalled();
   });
+
+  it('sends a properly formatted alert when sequence is found', async () => {
+    const { services, dependencies, executor } = createRuleTypeMocks();
+
+    dependencies.registry.registerType(eqlAlertType);
+
+    const params = {
+      eqlQuery: 'sequence by host.name↵[any where true]↵[any where true]↵[any where true]',
+      indexPatterns: ['*'],
+    };
+
+    services.scopedClusterClient.asCurrentUser.transport.request.mockReturnValue(
+      elasticsearchClientMock.createSuccessTransportRequestPromise({
+        hits: sequenceResponse.rawResponse.body.hits,
+        took: 0,
+        timed_out: false,
+        _shards: {
+          failed: 0,
+          skipped: 0,
+          successful: 1,
+          total: 1,
+        },
+      })
+    );
+
+    await executor({ params });
+    expect(services.alertInstanceFactory).toBeCalled();
+    expect(services.scopedRuleRegistryClient.bulkIndex).toBeCalledWith(
+      expect.arrayContaining([
+        expect.objectContaining({
+          'event.kind': 'signal',
+          'kibana.rac.alert.building_block_type': 'default',
+        }),
+      ])
+    );
+  });
 });
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.ts
index 5f5a99625d783..af973f2865ce4 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.ts
@@ -81,7 +81,7 @@ export const eqlAlertType = createSecurityEQLRuleType({
     if (response.hits.sequences !== undefined) {
       alerts = response.hits.sequences.reduce((allAlerts: AlertType[], sequence) => {
         let previousAlertUuid: string | undefined;
-        return {
+        return [
           ...allAlerts,
           ...sequence.events.map((event, idx) => {
             const alert = {
@@ -93,7 +93,7 @@ export const eqlAlertType = createSecurityEQLRuleType({
             previousAlertUuid = alert['kibana.rac.alert.uuid'];
             return alert;
           }),
-        };
+        ];
       }, []);
     } else if (response.hits.events !== undefined) {
       alerts = response.hits.events.map((event) => {
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/query.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/query.test.ts
index 6e73da33405b8..1fec1c76430eb 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/query.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/query.test.ts
@@ -3,4 +3,4 @@
  * or more contributor license agreements. Licensed under the Elastic License
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
- */
\ No newline at end of file
+ */
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_eql.sh b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_eql.sh
index e27702385fca5..25e247a08ef46 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_eql.sh
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_eql.sh
@@ -15,7 +15,7 @@ curl -X POST http://localhost:5601/${BASE_PATH}/api/alerts/alert \
 {
   "params":{
      "indexPatterns": ["*"],
-     "eqlQuery": "sequence by hostname [network where true]"
+     "eqlQuery": "sequence by host.name↵[any where true]↵[any where true]↵[any where true]"
    },
    "consumer":"alerts",
    "alertTypeId":"siem.eqlRule",
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.test.ts
index 6e73da33405b8..1fec1c76430eb 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.test.ts
@@ -3,4 +3,4 @@
  * or more contributor license agreements. Licensed under the Elastic License
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
- */
\ No newline at end of file
+ */

From 733b926186a130c6c17761388721df853cf2fdfa Mon Sep 17 00:00:00 2001
From: Madison Caldwell <madison.caldwell@elastic.co>
Date: Sun, 2 May 2021 22:52:38 -0400
Subject: [PATCH 24/54] Stubbing tests for custom query + threshold

---
 .../reference_rules/query.test.ts             | 87 +++++++++++++++++++
 .../reference_rules/threshold.test.ts         | 87 +++++++++++++++++++
 2 files changed, 174 insertions(+)

diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/query.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/query.test.ts
index 1fec1c76430eb..089b1ce4ea881 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/query.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/query.test.ts
@@ -4,3 +4,90 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
+
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { elasticsearchClientMock } from 'src/core/server/elasticsearch/client/mocks';
+
+// import { sequenceResponse } from '../../../search_strategy/timeline/eql/__mocks__';
+
+import { queryAlertType } from './query';
+import { createRuleTypeMocks } from './__mocks__/rule_type';
+
+describe('Custom query alerts', () => {
+  it('does not send an alert when no events found', async () => {
+    const { services, dependencies, executor } = createRuleTypeMocks();
+
+    dependencies.registry.registerType(queryAlertType);
+
+    const params = {
+      customQuery: 'dne:42',
+      indexPatterns: ['*'],
+    };
+
+    services.scopedClusterClient.asCurrentUser.transport.request.mockReturnValue(
+      elasticsearchClientMock.createSuccessTransportRequestPromise({
+        hits: {
+          hits: [],
+          sequences: [],
+          events: [],
+          total: {
+            relation: 'eq',
+            value: 0,
+          },
+        },
+        took: 0,
+        timed_out: false,
+        _shards: {
+          failed: 0,
+          skipped: 0,
+          successful: 1,
+          total: 1,
+        },
+      })
+    );
+
+    await executor({ params });
+    expect(services.alertInstanceFactory).not.toBeCalled();
+  });
+
+  it('sends a properly formatted alert when events are found', async () => {
+    const { services, dependencies, executor } = createRuleTypeMocks();
+
+    dependencies.registry.registerType(queryAlertType);
+
+    const params = {
+      eqlQuery: '*:*',
+      indexPatterns: ['*'],
+    };
+
+    services.scopedClusterClient.asCurrentUser.transport.request.mockReturnValue(
+      elasticsearchClientMock.createSuccessTransportRequestPromise({
+        hits: {
+          hits: ['TODO'],
+          total: {
+            relation: 'eq',
+            value: 0, // TODO
+          },
+        },
+        took: 0,
+        timed_out: false,
+        _shards: {
+          failed: 0,
+          skipped: 0,
+          successful: 1,
+          total: 1,
+        },
+      })
+    );
+
+    await executor({ params });
+    expect(services.alertInstanceFactory).toBeCalled();
+    expect(services.scopedRuleRegistryClient.bulkIndex).toBeCalledWith(
+      expect.arrayContaining([
+        expect.objectContaining({
+          'event.kind': 'signal',
+        }),
+      ])
+    );
+  });
+});
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.test.ts
index 1fec1c76430eb..47de01e19fc91 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.test.ts
@@ -4,3 +4,90 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
+
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { elasticsearchClientMock } from 'src/core/server/elasticsearch/client/mocks';
+
+// import { sequenceResponse } from '../../../search_strategy/timeline/eql/__mocks__';
+
+import { thresholdAlertType } from './threshold';
+import { createRuleTypeMocks } from './__mocks__/rule_type';
+
+describe('Threshold alerts', () => {
+  it('does not send an alert when threshold is not met', async () => {
+    const { services, dependencies, executor } = createRuleTypeMocks();
+
+    dependencies.registry.registerType(thresholdAlertType);
+
+    const params = {
+      customQuery: 'dne:42',
+      indexPatterns: ['*'],
+    };
+
+    services.scopedClusterClient.asCurrentUser.transport.request.mockReturnValue(
+      elasticsearchClientMock.createSuccessTransportRequestPromise({
+        hits: {
+          hits: [],
+          sequences: [],
+          events: [],
+          total: {
+            relation: 'eq',
+            value: 0,
+          },
+        },
+        took: 0,
+        timed_out: false,
+        _shards: {
+          failed: 0,
+          skipped: 0,
+          successful: 1,
+          total: 1,
+        },
+      })
+    );
+
+    await executor({ params });
+    expect(services.alertInstanceFactory).not.toBeCalled();
+  });
+
+  it('sends a properly formatted alert when threshold is met', async () => {
+    const { services, dependencies, executor } = createRuleTypeMocks();
+
+    dependencies.registry.registerType(thresholdAlertType);
+
+    const params = {
+      eqlQuery: '*:*',
+      indexPatterns: ['*'],
+    };
+
+    services.scopedClusterClient.asCurrentUser.transport.request.mockReturnValue(
+      elasticsearchClientMock.createSuccessTransportRequestPromise({
+        hits: {
+          hits: ['TODO'],
+          total: {
+            relation: 'eq',
+            value: 0, // TODO
+          },
+        },
+        took: 0,
+        timed_out: false,
+        _shards: {
+          failed: 0,
+          skipped: 0,
+          successful: 1,
+          total: 1,
+        },
+      })
+    );
+
+    await executor({ params });
+    expect(services.alertInstanceFactory).toBeCalled();
+    expect(services.scopedRuleRegistryClient.bulkIndex).toBeCalledWith(
+      expect.arrayContaining([
+        expect.objectContaining({
+          'event.kind': 'signal',
+        }),
+      ])
+    );
+  });
+});

From fcdd2863e508d02734560a4af3d05b6929a0ec4a Mon Sep 17 00:00:00 2001
From: Madison Caldwell <madison.caldwell@elastic.co>
Date: Mon, 3 May 2021 13:14:46 -0400
Subject: [PATCH 25/54] Add threshold tests

---
 .../reference_rules/__mocks__/rule_type.ts    |  9 ++-
 .../reference_rules/__mocks__/threshold.ts    | 61 +++++++++++++++++++
 .../reference_rules/indicator.ts              |  6 --
 .../reference_rules/threat_match.ts           |  6 --
 .../reference_rules/threshold.test.ts         | 43 ++++++++++---
 .../threshold/find_threshold_signals.ts       |  2 +-
 6 files changed, 105 insertions(+), 22 deletions(-)
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/__mocks__/threshold.ts
 delete mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/indicator.ts
 delete mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threat_match.ts

diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/__mocks__/rule_type.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/__mocks__/rule_type.ts
index 3482c21dc99a3..a351ae494e9ba 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/__mocks__/rule_type.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/__mocks__/rule_type.ts
@@ -5,9 +5,12 @@
  * 2.0.
  */
 
-import { Logger } from 'kibana/server';
 import { of } from 'rxjs';
+import { v4 } from 'uuid';
+
+import { Logger } from 'kibana/server';
 import { elasticsearchServiceMock } from 'src/core/server/mocks';
+
 import { SecurityRuleRegistry } from '../../../../plugin';
 import { ConfigType } from '../../../../config';
 
@@ -19,6 +22,7 @@ export const createRuleTypeMocks = () => {
 
   const loggerMock = ({
     debug: jest.fn(),
+    info: jest.fn(),
     warn: jest.fn(),
     error: jest.fn(),
   } as unknown) as Logger;
@@ -54,6 +58,9 @@ export const createRuleTypeMocks = () => {
       return alertExecutor({
         services,
         params,
+        rule: {
+          id: v4(),
+        },
         startedAt: new Date(),
       });
     },
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/__mocks__/threshold.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/__mocks__/threshold.ts
new file mode 100644
index 0000000000000..446f579dc417e
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/__mocks__/threshold.ts
@@ -0,0 +1,61 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { sampleDocNoSortId } from '../../signals/__mocks__/es_results';
+
+export const mockThresholdResults = {
+  rawResponse: {
+    body: {
+      is_partial: false,
+      is_running: false,
+      took: 527,
+      timed_out: false,
+      hits: {
+        total: {
+          value: 0,
+          relation: 'eq',
+        },
+        hits: [],
+      },
+      aggregations: {
+        'threshold_0:source.ip': {
+          buckets: [
+            {
+              key: '127.0.0.1',
+              doc_count: 5,
+              buckets: [
+                {
+                  'threshold_1:host.name': {
+                    key: 'tardigrade',
+                    doc_count: 3,
+                    top_threshold_hits: {
+                      hits: {
+                        total: {
+                          value: 1,
+                          relation: 'eq',
+                        },
+                        hits: [
+                          {
+                            ...sampleDocNoSortId(),
+                            'host.name': 'tardigrade',
+                          },
+                        ],
+                      },
+                    },
+                    cardinality_count: {
+                      value: 3,
+                    },
+                  },
+                },
+              ],
+            },
+          ],
+        },
+      },
+    },
+  },
+};
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/indicator.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/indicator.ts
deleted file mode 100644
index 1fec1c76430eb..0000000000000
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/indicator.ts
+++ /dev/null
@@ -1,6 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threat_match.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threat_match.ts
deleted file mode 100644
index 1fec1c76430eb..0000000000000
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threat_match.ts
+++ /dev/null
@@ -1,6 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.test.ts
index 47de01e19fc91..304d754bd3abb 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.test.ts
@@ -8,10 +8,9 @@
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
 import { elasticsearchClientMock } from 'src/core/server/elasticsearch/client/mocks';
 
-// import { sequenceResponse } from '../../../search_strategy/timeline/eql/__mocks__';
-
-import { thresholdAlertType } from './threshold';
 import { createRuleTypeMocks } from './__mocks__/rule_type';
+import { mockThresholdResults } from './__mocks__/threshold';
+import { thresholdAlertType } from './threshold';
 
 describe('Threshold alerts', () => {
   it('does not send an alert when threshold is not met', async () => {
@@ -20,11 +19,13 @@ describe('Threshold alerts', () => {
     dependencies.registry.registerType(thresholdAlertType);
 
     const params = {
-      customQuery: 'dne:42',
       indexPatterns: ['*'],
+      customQuery: '*:*',
+      thresholdFields: ['source.ip', 'host.name'],
+      thresholdValue: 4,
     };
 
-    services.scopedClusterClient.asCurrentUser.transport.request.mockReturnValue(
+    services.scopedClusterClient.asCurrentUser.search.mockReturnValue(
       elasticsearchClientMock.createSuccessTransportRequestPromise({
         hits: {
           hits: [],
@@ -35,6 +36,11 @@ describe('Threshold alerts', () => {
             value: 0,
           },
         },
+        aggregations: {
+          'threshold_0:source.ip': {
+            buckets: [],
+          },
+        },
         took: 0,
         timed_out: false,
         _shards: {
@@ -60,13 +66,34 @@ describe('Threshold alerts', () => {
       indexPatterns: ['*'],
     };
 
-    services.scopedClusterClient.asCurrentUser.transport.request.mockReturnValue(
+    services.scopedClusterClient.asCurrentUser.search.mockReturnValueOnce(
+      elasticsearchClientMock.createSuccessTransportRequestPromise({
+        hits: {
+          hits: [],
+          total: {
+            relation: 'eq',
+            value: 0,
+          },
+        },
+        took: 0,
+        timed_out: false,
+        _shards: {
+          failed: 0,
+          skipped: 0,
+          successful: 1,
+          total: 1,
+        },
+      })
+    );
+
+    services.scopedClusterClient.asCurrentUser.search.mockReturnValueOnce(
       elasticsearchClientMock.createSuccessTransportRequestPromise({
         hits: {
-          hits: ['TODO'],
+          hits: [],
+          aggregations: mockThresholdResults.rawResponse.body.aggregations,
           total: {
             relation: 'eq',
-            value: 0, // TODO
+            value: 0,
           },
         },
         took: 0,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threshold/find_threshold_signals.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threshold/find_threshold_signals.ts
index 986393d6d3454..ca7f22e4a7570 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threshold/find_threshold_signals.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threshold/find_threshold_signals.ts
@@ -138,7 +138,7 @@ export const findThresholdSignals = async ({
     logger,
     // @ts-expect-error refactor to pass type explicitly instead of unknown
     filter,
-    pageSize: 1,
+    pageSize: 0,
     sortOrder: 'desc',
     buildRuleMessage,
   });

From 50d324e244c39933732ea4a9f8fecc263cf6d940 Mon Sep 17 00:00:00 2001
From: Madison Caldwell <madison.caldwell@elastic.co>
Date: Mon, 3 May 2021 13:41:16 -0400
Subject: [PATCH 26/54] fix test

---
 .../reference_rules/__mocks__/threshold.ts    | 10 +--
 .../reference_rules/threshold.test.ts         | 78 ++++++++++---------
 2 files changed, 45 insertions(+), 43 deletions(-)

diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/__mocks__/threshold.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/__mocks__/threshold.ts
index 446f579dc417e..40d2ed37a5576 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/__mocks__/threshold.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/__mocks__/threshold.ts
@@ -27,9 +27,9 @@ export const mockThresholdResults = {
             {
               key: '127.0.0.1',
               doc_count: 5,
-              buckets: [
-                {
-                  'threshold_1:host.name': {
+              'threshold_1:host.name': {
+                buckets: [
+                  {
                     key: 'tardigrade',
                     doc_count: 3,
                     top_threshold_hits: {
@@ -50,8 +50,8 @@ export const mockThresholdResults = {
                       value: 3,
                     },
                   },
-                },
-              ],
+                ],
+              },
             },
           ],
         },
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.test.ts
index 304d754bd3abb..83be0d5f96914 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.test.ts
@@ -62,50 +62,52 @@ describe('Threshold alerts', () => {
     dependencies.registry.registerType(thresholdAlertType);
 
     const params = {
-      eqlQuery: '*:*',
       indexPatterns: ['*'],
+      customQuery: '*:*',
+      thresholdFields: ['source.ip', 'host.name'],
+      thresholdValue: 4,
     };
 
-    services.scopedClusterClient.asCurrentUser.search.mockReturnValueOnce(
-      elasticsearchClientMock.createSuccessTransportRequestPromise({
-        hits: {
-          hits: [],
-          total: {
-            relation: 'eq',
-            value: 0,
+    services.scopedClusterClient.asCurrentUser.search
+      .mockReturnValueOnce(
+        elasticsearchClientMock.createSuccessTransportRequestPromise({
+          hits: {
+            hits: [],
+            total: {
+              relation: 'eq',
+              value: 0,
+            },
+          },
+          took: 0,
+          timed_out: false,
+          _shards: {
+            failed: 0,
+            skipped: 0,
+            successful: 1,
+            total: 1,
+          },
+        })
+      )
+      .mockReturnValueOnce(
+        elasticsearchClientMock.createSuccessTransportRequestPromise({
+          hits: {
+            hits: [],
+            total: {
+              relation: 'eq',
+              value: 0,
+            },
           },
-        },
-        took: 0,
-        timed_out: false,
-        _shards: {
-          failed: 0,
-          skipped: 0,
-          successful: 1,
-          total: 1,
-        },
-      })
-    );
-
-    services.scopedClusterClient.asCurrentUser.search.mockReturnValueOnce(
-      elasticsearchClientMock.createSuccessTransportRequestPromise({
-        hits: {
-          hits: [],
           aggregations: mockThresholdResults.rawResponse.body.aggregations,
-          total: {
-            relation: 'eq',
-            value: 0,
+          took: 0,
+          timed_out: false,
+          _shards: {
+            failed: 0,
+            skipped: 0,
+            successful: 1,
+            total: 1,
           },
-        },
-        took: 0,
-        timed_out: false,
-        _shards: {
-          failed: 0,
-          skipped: 0,
-          successful: 1,
-          total: 1,
-        },
-      })
-    );
+        })
+      );
 
     await executor({ params });
     expect(services.alertInstanceFactory).toBeCalled();

From 640da91bb033341693eb89389e69d3bda71400f0 Mon Sep 17 00:00:00 2001
From: Madison Caldwell <madison.caldwell@elastic.co>
Date: Mon, 3 May 2021 20:05:39 -0400
Subject: [PATCH 27/54] Fix custom query tests

---
 .../detection_engine/reference_rules/query.test.ts | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/query.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/query.test.ts
index 089b1ce4ea881..9d285016800db 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/query.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/query.test.ts
@@ -5,10 +5,12 @@
  * 2.0.
  */
 
+import { v4 } from 'uuid';
+
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
 import { elasticsearchClientMock } from 'src/core/server/elasticsearch/client/mocks';
 
-// import { sequenceResponse } from '../../../search_strategy/timeline/eql/__mocks__';
+import { sampleDocNoSortId } from '../signals/__mocks__/es_results';
 
 import { queryAlertType } from './query';
 import { createRuleTypeMocks } from './__mocks__/rule_type';
@@ -24,7 +26,7 @@ describe('Custom query alerts', () => {
       indexPatterns: ['*'],
     };
 
-    services.scopedClusterClient.asCurrentUser.transport.request.mockReturnValue(
+    services.scopedClusterClient.asCurrentUser.search.mockReturnValue(
       elasticsearchClientMock.createSuccessTransportRequestPromise({
         hits: {
           hits: [],
@@ -56,17 +58,17 @@ describe('Custom query alerts', () => {
     dependencies.registry.registerType(queryAlertType);
 
     const params = {
-      eqlQuery: '*:*',
+      customQuery: '*:*',
       indexPatterns: ['*'],
     };
 
-    services.scopedClusterClient.asCurrentUser.transport.request.mockReturnValue(
+    services.scopedClusterClient.asCurrentUser.search.mockReturnValue(
       elasticsearchClientMock.createSuccessTransportRequestPromise({
         hits: {
-          hits: ['TODO'],
+          hits: [sampleDocNoSortId(v4()), sampleDocNoSortId(v4()), sampleDocNoSortId(v4())],
           total: {
             relation: 'eq',
-            value: 0, // TODO
+            value: 3,
           },
         },
         took: 0,

From 60f8983095b567d6631e436c926a9671e01e768a Mon Sep 17 00:00:00 2001
From: Dario Gieselaar <dario.gieselaar@elastic.co>
Date: Fri, 30 Apr 2021 12:14:13 +0200
Subject: [PATCH 28/54] rule registry > rule data

---
 typings/elasticsearch/search.d.ts             |   6 +-
 x-pack/plugins/apm/kibana.json                |  12 +-
 .../server/lib/alerts/register_apm_alerts.ts  |   6 +-
 .../alerts/register_error_count_alert_type.ts |  15 +-
 ...egister_transaction_duration_alert_type.ts | 249 ++++++-------
 ...transaction_duration_anomaly_alert_type.ts |  17 +-
 ...ister_transaction_error_rate_alert_type.ts |  15 +-
 .../server/lib/services/get_service_alerts.ts |  14 +-
 x-pack/plugins/apm/server/plugin.ts           |  38 +-
 .../server/routes/register_routes/index.ts    |   6 +-
 x-pack/plugins/apm/server/routes/services.ts  |  19 +-
 x-pack/plugins/apm/server/routes/typings.ts   |   4 +-
 x-pack/plugins/apm/server/types.ts            |   9 +
 .../rules/observability_rule_field_map.ts     |  22 --
 .../public/application/index.tsx              |   3 +-
 x-pack/plugins/observability/public/plugin.ts |  13 +-
 .../create_observability_rule_registry.ts     |  22 ++
 .../public/rules/formatter_rule_registry.ts   |  30 --
 .../rules/observability_rule_registry_mock.ts |   6 +-
 .../server/lib/rules/get_top_alerts.ts        |  30 +-
 x-pack/plugins/observability/server/plugin.ts |  22 +-
 .../server/routes/register_routes.ts          |   8 +-
 .../observability/server/routes/rules.ts      |  27 +-
 .../observability/server/routes/types.ts      |   4 +-
 x-pack/plugins/observability/server/types.ts  |   6 -
 x-pack/plugins/rule_registry/common/assets.ts |  12 +
 .../common/field_map/base_rule_field_map.ts   |  33 --
 .../rule_registry/common/field_map/index.ts   |   2 -
 .../common/technical_rule_data_field_names.ts |  76 ++++
 x-pack/plugins/rule_registry/public/index.ts  |  17 -
 x-pack/plugins/rule_registry/public/plugin.ts |  56 ---
 .../public/rule_registry/index.ts             |  47 ---
 .../public/rule_registry/types.ts             |  63 ----
 .../ecs_component_template.ts                 |  24 ++
 .../technical_component_template.ts           |  19 +
 .../assets/field_maps}/ecs_field_map.ts       |   0
 .../field_maps/technical_rule_field_map.ts    |  56 +++
 .../index_templates/base_index_template.ts    |  15 +
 .../default_lifecycle_policy.ts}              |   4 +-
 .../lifecycle_policies}/field_map.ts          |   0
 x-pack/plugins/rule_registry/server/index.ts  |  10 +-
 x-pack/plugins/rule_registry/server/plugin.ts |  84 +++--
 .../server/rule_data_client/index.ts          | 115 ++++++
 .../server/rule_data_client/types.ts          |  43 +++
 .../server/rule_data_plugin_service/index.ts  |  54 +++
 .../server/rule_data_plugin_service/types.ts} |  12 +-
 .../index.ts                                  | 179 ----------
 .../types.ts                                  |  57 ---
 .../server/rule_registry/index.ts             | 329 ------------------
 .../create_lifecycle_rule_type_factory.ts     | 235 -------------
 .../server/rule_registry/types.ts             |  42 ---
 x-pack/plugins/rule_registry/server/types.ts  | 106 ++----
 .../create_lifecycle_rule_type_factory.ts     | 244 +++++++++++++
 .../server/utils/get_rule_executor_data.ts    |  39 +++
 .../mapping_from_field_map.ts                 |   6 +-
 .../server/utils/parse_technical_fields.ts    |  25 ++
 .../utils/with_rule_data_client_factory.ts    |  39 +++
 57 files changed, 1144 insertions(+), 1502 deletions(-)
 delete mode 100644 x-pack/plugins/observability/common/rules/observability_rule_field_map.ts
 create mode 100644 x-pack/plugins/observability/public/rules/create_observability_rule_registry.ts
 delete mode 100644 x-pack/plugins/observability/public/rules/formatter_rule_registry.ts
 create mode 100644 x-pack/plugins/rule_registry/common/assets.ts
 delete mode 100644 x-pack/plugins/rule_registry/common/field_map/base_rule_field_map.ts
 create mode 100644 x-pack/plugins/rule_registry/common/technical_rule_data_field_names.ts
 delete mode 100644 x-pack/plugins/rule_registry/public/index.ts
 delete mode 100644 x-pack/plugins/rule_registry/public/plugin.ts
 delete mode 100644 x-pack/plugins/rule_registry/public/rule_registry/index.ts
 delete mode 100644 x-pack/plugins/rule_registry/public/rule_registry/types.ts
 create mode 100644 x-pack/plugins/rule_registry/server/assets/component_templates/ecs_component_template.ts
 create mode 100644 x-pack/plugins/rule_registry/server/assets/component_templates/technical_component_template.ts
 rename x-pack/plugins/rule_registry/{common/field_map => server/assets/field_maps}/ecs_field_map.ts (100%)
 create mode 100644 x-pack/plugins/rule_registry/server/assets/field_maps/technical_rule_field_map.ts
 create mode 100644 x-pack/plugins/rule_registry/server/assets/index_templates/base_index_template.ts
 rename x-pack/plugins/rule_registry/server/{rule_registry/defaults/ilm_policy.ts => assets/lifecycle_policies/default_lifecycle_policy.ts} (86%)
 rename x-pack/plugins/rule_registry/server/{rule_registry/defaults => assets/lifecycle_policies}/field_map.ts (100%)
 create mode 100644 x-pack/plugins/rule_registry/server/rule_data_client/index.ts
 create mode 100644 x-pack/plugins/rule_registry/server/rule_data_client/types.ts
 create mode 100644 x-pack/plugins/rule_registry/server/rule_data_plugin_service/index.ts
 rename x-pack/plugins/{apm/server/lib/alerts/create_apm_lifecycle_rule_type.ts => rule_registry/server/rule_data_plugin_service/types.ts} (53%)
 delete mode 100644 x-pack/plugins/rule_registry/server/rule_registry/create_scoped_rule_registry_client/index.ts
 delete mode 100644 x-pack/plugins/rule_registry/server/rule_registry/create_scoped_rule_registry_client/types.ts
 delete mode 100644 x-pack/plugins/rule_registry/server/rule_registry/index.ts
 delete mode 100644 x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_lifecycle_rule_type_factory.ts
 delete mode 100644 x-pack/plugins/rule_registry/server/rule_registry/types.ts
 create mode 100644 x-pack/plugins/rule_registry/server/utils/create_lifecycle_rule_type_factory.ts
 create mode 100644 x-pack/plugins/rule_registry/server/utils/get_rule_executor_data.ts
 rename x-pack/plugins/rule_registry/server/{rule_registry/field_map => utils}/mapping_from_field_map.ts (80%)
 create mode 100644 x-pack/plugins/rule_registry/server/utils/parse_technical_fields.ts
 create mode 100644 x-pack/plugins/rule_registry/server/utils/with_rule_data_client_factory.ts

diff --git a/typings/elasticsearch/search.d.ts b/typings/elasticsearch/search.d.ts
index c9bf3b1d8b7bc..6f427348a5286 100644
--- a/typings/elasticsearch/search.d.ts
+++ b/typings/elasticsearch/search.d.ts
@@ -49,7 +49,7 @@ type ValueTypeOfField<T> = T extends Record<string, string | number>
 
 type MaybeArray<T> = T | T[];
 
-type Fields = MaybeArray<string | estypes.DateField>;
+type Fields = Required<estypes.SearchRequest>['body']['fields'];
 type DocValueFields = MaybeArray<string | estypes.DocValueField>;
 
 export type SearchHit<
@@ -58,7 +58,7 @@ export type SearchHit<
   TDocValueFields extends DocValueFields | undefined = undefined
 > = Omit<estypes.Hit, '_source' | 'fields'> &
   (TSource extends false ? {} : { _source: TSource }) &
-  (TFields extends estypes.Fields
+  (TFields extends Fields
     ? {
         fields: Partial<Record<ValueTypeOfField<TFields>, unknown[]>>;
       }
@@ -77,7 +77,7 @@ type HitsOf<
 > = Array<
   SearchHit<
     TOptions extends { _source: false } ? undefined : TDocument,
-    TOptions extends { fields: estypes.Fields } ? TOptions['fields'] : undefined,
+    TOptions extends { fields: Fields } ? TOptions['fields'] : undefined,
     TOptions extends { docvalue_fields: DocValueFields } ? TOptions['docvalue_fields'] : undefined
   >
 >;
diff --git a/x-pack/plugins/apm/kibana.json b/x-pack/plugins/apm/kibana.json
index 28e4a7b36e740..76d544c3bc6f5 100644
--- a/x-pack/plugins/apm/kibana.json
+++ b/x-pack/plugins/apm/kibana.json
@@ -10,7 +10,8 @@
     "triggersActionsUi",
     "embeddable",
     "infra",
-    "observability"
+    "observability",
+    "ruleRegistry"
   ],
   "optionalPlugins": [
     "spaces",
@@ -26,8 +27,13 @@
   ],
   "server": true,
   "ui": true,
-  "configPath": ["xpack", "apm"],
-  "extraPublicDirs": ["public/style/variables"],
+  "configPath": [
+    "xpack",
+    "apm"
+  ],
+  "extraPublicDirs": [
+    "public/style/variables"
+  ],
   "requiredBundles": [
     "home",
     "kibanaReact",
diff --git a/x-pack/plugins/apm/server/lib/alerts/register_apm_alerts.ts b/x-pack/plugins/apm/server/lib/alerts/register_apm_alerts.ts
index 9a362efa90ac0..022fad6fa7840 100644
--- a/x-pack/plugins/apm/server/lib/alerts/register_apm_alerts.ts
+++ b/x-pack/plugins/apm/server/lib/alerts/register_apm_alerts.ts
@@ -7,17 +7,19 @@
 
 import { Observable } from 'rxjs';
 import { Logger } from 'kibana/server';
+import { PluginSetupContract as AlertingPluginSetupContract } from '../../../../alerting/server';
+import { RuleDataClient } from '../../../../rule_registry/server';
 import { registerTransactionDurationAlertType } from './register_transaction_duration_alert_type';
 import { registerTransactionDurationAnomalyAlertType } from './register_transaction_duration_anomaly_alert_type';
 import { registerErrorCountAlertType } from './register_error_count_alert_type';
 import { APMConfig } from '../..';
 import { MlPluginSetup } from '../../../../ml/server';
 import { registerTransactionErrorRateAlertType } from './register_transaction_error_rate_alert_type';
-import { APMRuleRegistry } from '../../plugin';
 
 export interface RegisterRuleDependencies {
-  registry: APMRuleRegistry;
+  ruleDataClient: RuleDataClient;
   ml?: MlPluginSetup;
+  alerting: AlertingPluginSetupContract;
   config$: Observable<APMConfig>;
   logger: Logger;
 }
diff --git a/x-pack/plugins/apm/server/lib/alerts/register_error_count_alert_type.ts b/x-pack/plugins/apm/server/lib/alerts/register_error_count_alert_type.ts
index 15ec5d0ef0bd0..4ccfb002dd890 100644
--- a/x-pack/plugins/apm/server/lib/alerts/register_error_count_alert_type.ts
+++ b/x-pack/plugins/apm/server/lib/alerts/register_error_count_alert_type.ts
@@ -7,6 +7,7 @@
 
 import { schema } from '@kbn/config-schema';
 import { take } from 'rxjs/operators';
+import { createLifecycleRuleTypeFactory } from '../../../../rule_registry/server';
 import { ENVIRONMENT_NOT_DEFINED } from '../../../common/environment_filter_values';
 import { asMutableArray } from '../../../common/utils/as_mutable_array';
 import { AlertType, ALERT_TYPES_CONFIG } from '../../../common/alert_types';
@@ -21,7 +22,6 @@ import { getApmIndices } from '../settings/apm_indices/get_apm_indices';
 import { apmActionVariables } from './action_variables';
 import { alertingEsClient } from './alerting_es_client';
 import { RegisterRuleDependencies } from './register_apm_alerts';
-import { createAPMLifecycleRuleType } from './create_apm_lifecycle_rule_type';
 
 const paramsSchema = schema.object({
   windowSize: schema.number(),
@@ -34,11 +34,18 @@ const paramsSchema = schema.object({
 const alertTypeConfig = ALERT_TYPES_CONFIG[AlertType.ErrorCount];
 
 export function registerErrorCountAlertType({
-  registry,
+  alerting,
+  logger,
+  ruleDataClient,
   config$,
 }: RegisterRuleDependencies) {
-  registry.registerType(
-    createAPMLifecycleRuleType({
+  const createLifecycleRuleType = createLifecycleRuleTypeFactory({
+    ruleDataClient,
+    logger,
+  });
+
+  alerting.registerType(
+    createLifecycleRuleType({
       id: AlertType.ErrorCount,
       name: alertTypeConfig.name,
       actionGroups: alertTypeConfig.actionGroups,
diff --git a/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_alert_type.ts b/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_alert_type.ts
index 4918a6cc892b7..a5c9a7315787b 100644
--- a/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_alert_type.ts
+++ b/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_alert_type.ts
@@ -8,6 +8,7 @@
 import { schema } from '@kbn/config-schema';
 import { take } from 'rxjs/operators';
 import { QueryContainer } from '@elastic/elasticsearch/api/types';
+import { createLifecycleRuleTypeFactory } from '../../../../rule_registry/server';
 import { parseEnvironmentUrlParam } from '../../../common/environment_filter_values';
 import { AlertType, ALERT_TYPES_CONFIG } from '../../../common/alert_types';
 import {
@@ -24,7 +25,6 @@ import { getApmIndices } from '../settings/apm_indices/get_apm_indices';
 import { apmActionVariables } from './action_variables';
 import { alertingEsClient } from './alerting_es_client';
 import { RegisterRuleDependencies } from './register_apm_alerts';
-import { createAPMLifecycleRuleType } from './create_apm_lifecycle_rule_type';
 
 const paramsSchema = schema.object({
   serviceName: schema.string(),
@@ -43,130 +43,143 @@ const paramsSchema = schema.object({
 const alertTypeConfig = ALERT_TYPES_CONFIG[AlertType.TransactionDuration];
 
 export function registerTransactionDurationAlertType({
-  registry,
+  alerting,
+  ruleDataClient,
   config$,
+  logger,
 }: RegisterRuleDependencies) {
-  registry.registerType(
-    createAPMLifecycleRuleType({
-      id: AlertType.TransactionDuration,
-      name: alertTypeConfig.name,
-      actionGroups: alertTypeConfig.actionGroups,
-      defaultActionGroupId: alertTypeConfig.defaultActionGroupId,
-      validate: {
-        params: paramsSchema,
-      },
-      actionVariables: {
-        context: [
-          apmActionVariables.serviceName,
-          apmActionVariables.transactionType,
-          apmActionVariables.environment,
-          apmActionVariables.threshold,
-          apmActionVariables.triggerValue,
-          apmActionVariables.interval,
-        ],
-      },
-      producer: 'apm',
-      minimumLicenseRequired: 'basic',
-      executor: async ({ services, params }) => {
-        const config = await config$.pipe(take(1)).toPromise();
-        const alertParams = params;
-        const indices = await getApmIndices({
-          config,
-          savedObjectsClient: services.savedObjectsClient,
-        });
-
-        const searchParams = {
-          index: indices['apm_oss.transactionIndices'],
-          body: {
-            size: 0,
-            query: {
-              bool: {
-                filter: [
-                  {
-                    range: {
-                      '@timestamp': {
-                        gte: `now-${alertParams.windowSize}${alertParams.windowUnit}`,
-                      },
+  const createLifecycleRuleType = createLifecycleRuleTypeFactory({
+    ruleDataClient,
+    logger,
+  });
+
+  const type = createLifecycleRuleType({
+    id: AlertType.TransactionDuration,
+    name: alertTypeConfig.name,
+    actionGroups: alertTypeConfig.actionGroups,
+    defaultActionGroupId: alertTypeConfig.defaultActionGroupId,
+    validate: {
+      params: paramsSchema,
+    },
+    actionVariables: {
+      context: [
+        apmActionVariables.serviceName,
+        apmActionVariables.transactionType,
+        apmActionVariables.environment,
+        apmActionVariables.threshold,
+        apmActionVariables.triggerValue,
+        apmActionVariables.interval,
+      ],
+    },
+    producer: 'apm',
+    minimumLicenseRequired: 'basic',
+    executor: async ({ services, params }) => {
+      const config = await config$.pipe(take(1)).toPromise();
+      const alertParams = params;
+      const indices = await getApmIndices({
+        config,
+        savedObjectsClient: services.savedObjectsClient,
+      });
+
+      const searchParams = {
+        index: indices['apm_oss.transactionIndices'],
+        body: {
+          size: 0,
+          query: {
+            bool: {
+              filter: [
+                {
+                  range: {
+                    '@timestamp': {
+                      gte: `now-${alertParams.windowSize}${alertParams.windowUnit}`,
                     },
                   },
-                  { term: { [PROCESSOR_EVENT]: ProcessorEvent.transaction } },
-                  { term: { [SERVICE_NAME]: alertParams.serviceName } },
-                  { term: { [TRANSACTION_TYPE]: alertParams.transactionType } },
-                  ...environmentQuery(alertParams.environment),
-                ] as QueryContainer[],
-              },
+                },
+                {
+                  term: { [PROCESSOR_EVENT]: ProcessorEvent.transaction },
+                },
+                { term: { [SERVICE_NAME]: alertParams.serviceName } },
+                {
+                  term: {
+                    [TRANSACTION_TYPE]: alertParams.transactionType,
+                  },
+                },
+                ...environmentQuery(alertParams.environment),
+              ] as QueryContainer[],
             },
-            aggs: {
-              latency:
-                alertParams.aggregationType === 'avg'
-                  ? { avg: { field: TRANSACTION_DURATION } }
-                  : {
-                      percentiles: {
-                        field: TRANSACTION_DURATION,
-                        percents: [
-                          alertParams.aggregationType === '95th' ? 95 : 99,
-                        ],
-                      },
+          },
+          aggs: {
+            latency:
+              alertParams.aggregationType === 'avg'
+                ? { avg: { field: TRANSACTION_DURATION } }
+                : {
+                    percentiles: {
+                      field: TRANSACTION_DURATION,
+                      percents: [
+                        alertParams.aggregationType === '95th' ? 95 : 99,
+                      ],
                     },
-            },
+                  },
           },
-        };
-
-        const response = await alertingEsClient({
-          scopedClusterClient: services.scopedClusterClient,
-          params: searchParams,
-        });
-
-        if (!response.aggregations) {
-          return {};
-        }
-
-        const { latency } = response.aggregations;
-
-        const transactionDuration =
-          'values' in latency
-            ? Object.values(latency.values)[0]
-            : latency?.value;
-
-        const threshold = alertParams.threshold * 1000;
-
-        if (transactionDuration && transactionDuration > threshold) {
-          const durationFormatter = getDurationFormatter(transactionDuration);
-          const transactionDurationFormatted = durationFormatter(
-            transactionDuration
-          ).formatted;
-
-          const environmentParsed = parseEnvironmentUrlParam(
-            alertParams.environment
-          );
-
-          services
-            .alertWithLifecycle({
-              id: `${AlertType.TransactionDuration}_${environmentParsed.text}`,
-              fields: {
-                [SERVICE_NAME]: alertParams.serviceName,
-                ...(environmentParsed.esFieldValue
-                  ? { [SERVICE_ENVIRONMENT]: environmentParsed.esFieldValue }
-                  : {}),
-                [TRANSACTION_TYPE]: alertParams.transactionType,
-                [PROCESSOR_EVENT]: ProcessorEvent.transaction,
-                'kibana.observability.evaluation.value': transactionDuration,
-                'kibana.observability.evaluation.threshold':
-                  alertParams.threshold * 1000,
-              },
-            })
-            .scheduleActions(alertTypeConfig.defaultActionGroupId, {
-              transactionType: alertParams.transactionType,
-              serviceName: alertParams.serviceName,
-              environment: environmentParsed.text,
-              threshold,
-              triggerValue: transactionDurationFormatted,
-              interval: `${alertParams.windowSize}${alertParams.windowUnit}`,
-            });
-        }
+        },
+      };
 
+      const response = await alertingEsClient({
+        scopedClusterClient: services.scopedClusterClient,
+        params: searchParams,
+      });
+
+      if (!response.aggregations) {
         return {};
-      },
-    })
-  );
+      }
+
+      const { latency } = response.aggregations;
+
+      const transactionDuration =
+        'values' in latency ? Object.values(latency.values)[0] : latency?.value;
+
+      const threshold = alertParams.threshold * 1000;
+
+      if (transactionDuration && transactionDuration > threshold) {
+        const durationFormatter = getDurationFormatter(transactionDuration);
+        const transactionDurationFormatted = durationFormatter(
+          transactionDuration
+        ).formatted;
+
+        const environmentParsed = parseEnvironmentUrlParam(
+          alertParams.environment
+        );
+
+        services
+          .alertWithLifecycle({
+            id: `${AlertType.TransactionDuration}_${environmentParsed.text}`,
+            fields: {
+              [SERVICE_NAME]: alertParams.serviceName,
+              ...(environmentParsed.esFieldValue
+                ? {
+                    [SERVICE_ENVIRONMENT]: environmentParsed.esFieldValue,
+                  }
+                : {}),
+              [TRANSACTION_TYPE]: alertParams.transactionType,
+              [PROCESSOR_EVENT]: ProcessorEvent.transaction,
+              'kibana.observability.evaluation.value': transactionDuration,
+              'kibana.observability.evaluation.threshold':
+                alertParams.threshold * 1000,
+            },
+          })
+          .scheduleActions(alertTypeConfig.defaultActionGroupId, {
+            transactionType: alertParams.transactionType,
+            serviceName: alertParams.serviceName,
+            environment: environmentParsed.text,
+            threshold,
+            triggerValue: transactionDurationFormatted,
+            interval: `${alertParams.windowSize}${alertParams.windowUnit}`,
+          });
+      }
+
+      return {};
+    },
+  });
+
+  alerting.registerType(type);
 }
diff --git a/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_anomaly_alert_type.ts b/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_anomaly_alert_type.ts
index 67ff7cdb8e4e0..ef2218eeae9e0 100644
--- a/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_anomaly_alert_type.ts
+++ b/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_anomaly_alert_type.ts
@@ -9,6 +9,7 @@ import { schema } from '@kbn/config-schema';
 import { compact } from 'lodash';
 import { ESSearchResponse } from 'typings/elasticsearch';
 import { QueryContainer } from '@elastic/elasticsearch/api/types';
+import { createLifecycleRuleTypeFactory } from '../../../../rule_registry/server';
 import { ProcessorEvent } from '../../../common/processor_event';
 import { getSeverity } from '../../../common/anomaly_detection';
 import {
@@ -29,7 +30,6 @@ import { getMLJobs } from '../service_map/get_service_anomalies';
 import { apmActionVariables } from './action_variables';
 import { RegisterRuleDependencies } from './register_apm_alerts';
 import { parseEnvironmentUrlParam } from '../../../common/environment_filter_values';
-import { createAPMLifecycleRuleType } from './create_apm_lifecycle_rule_type';
 
 const paramsSchema = schema.object({
   serviceName: schema.maybe(schema.string()),
@@ -49,11 +49,18 @@ const alertTypeConfig =
   ALERT_TYPES_CONFIG[AlertType.TransactionDurationAnomaly];
 
 export function registerTransactionDurationAnomalyAlertType({
-  registry,
+  logger,
+  ruleDataClient,
+  alerting,
   ml,
 }: RegisterRuleDependencies) {
-  registry.registerType(
-    createAPMLifecycleRuleType({
+  const createLifecycleRuleType = createLifecycleRuleTypeFactory({
+    logger,
+    ruleDataClient,
+  });
+
+  alerting.registerType(
+    createLifecycleRuleType({
       id: AlertType.TransactionDurationAnomaly,
       name: alertTypeConfig.name,
       actionGroups: alertTypeConfig.actionGroups,
@@ -190,7 +197,7 @@ export function registerTransactionDurationAnomalyAlertType({
               const job = mlJobs.find((j) => j.job_id === latest.job_id);
 
               if (!job) {
-                services.logger.warn(
+                logger.warn(
                   `Could not find matching job for job id ${latest.job_id}`
                 );
                 return undefined;
diff --git a/x-pack/plugins/apm/server/lib/alerts/register_transaction_error_rate_alert_type.ts b/x-pack/plugins/apm/server/lib/alerts/register_transaction_error_rate_alert_type.ts
index bead17e308f06..c6c3b473cc2a5 100644
--- a/x-pack/plugins/apm/server/lib/alerts/register_transaction_error_rate_alert_type.ts
+++ b/x-pack/plugins/apm/server/lib/alerts/register_transaction_error_rate_alert_type.ts
@@ -7,6 +7,7 @@
 
 import { schema } from '@kbn/config-schema';
 import { take } from 'rxjs/operators';
+import { createLifecycleRuleTypeFactory } from '../../../../rule_registry/server';
 import { AlertType, ALERT_TYPES_CONFIG } from '../../../common/alert_types';
 import {
   EVENT_OUTCOME,
@@ -22,7 +23,6 @@ import { environmentQuery } from '../../../server/utils/queries';
 import { getApmIndices } from '../settings/apm_indices/get_apm_indices';
 import { apmActionVariables } from './action_variables';
 import { alertingEsClient } from './alerting_es_client';
-import { createAPMLifecycleRuleType } from './create_apm_lifecycle_rule_type';
 import { RegisterRuleDependencies } from './register_apm_alerts';
 
 const paramsSchema = schema.object({
@@ -37,11 +37,18 @@ const paramsSchema = schema.object({
 const alertTypeConfig = ALERT_TYPES_CONFIG[AlertType.TransactionErrorRate];
 
 export function registerTransactionErrorRateAlertType({
-  registry,
+  alerting,
+  ruleDataClient,
+  logger,
   config$,
 }: RegisterRuleDependencies) {
-  registry.registerType(
-    createAPMLifecycleRuleType({
+  const createLifecycleRuleType = createLifecycleRuleTypeFactory({
+    ruleDataClient,
+    logger,
+  });
+
+  alerting.registerType(
+    createLifecycleRuleType({
       id: AlertType.TransactionErrorRate,
       name: alertTypeConfig.name,
       actionGroups: alertTypeConfig.actionGroups,
diff --git a/x-pack/plugins/apm/server/lib/services/get_service_alerts.ts b/x-pack/plugins/apm/server/lib/services/get_service_alerts.ts
index 6356731cc48d1..90275ed676a44 100644
--- a/x-pack/plugins/apm/server/lib/services/get_service_alerts.ts
+++ b/x-pack/plugins/apm/server/lib/services/get_service_alerts.ts
@@ -5,33 +5,29 @@
  * 2.0.
  */
 
+import { RuleDataClient } from '../../../../rule_registry/server';
 import {
   SERVICE_NAME,
   TRANSACTION_TYPE,
 } from '../../../common/elasticsearch_fieldnames';
-import type { PromiseReturnType } from '../../../../observability/typings/common';
-import type { APMRuleRegistry } from '../../plugin';
 import { environmentQuery, rangeQuery } from '../../utils/queries';
 
 export async function getServiceAlerts({
-  apmRuleRegistryClient,
+  ruleDataClient,
   start,
   end,
   serviceName,
   environment,
   transactionType,
 }: {
-  apmRuleRegistryClient: Exclude<
-    PromiseReturnType<APMRuleRegistry['createScopedRuleRegistryClient']>,
-    undefined
-  >;
+  ruleDataClient: RuleDataClient;
   start: number;
   end: number;
   serviceName: string;
   environment?: string;
   transactionType: string;
 }) {
-  const response = await apmRuleRegistryClient.search({
+  const response = await ruleDataClient.getReader().search({
     body: {
       query: {
         bool: {
@@ -76,5 +72,5 @@ export async function getServiceAlerts({
     },
   });
 
-  return response.events;
+  return response.hits.hits.map((hit) => hit.fields);
 }
diff --git a/x-pack/plugins/apm/server/plugin.ts b/x-pack/plugins/apm/server/plugin.ts
index e12d089855834..fd19c659694d6 100644
--- a/x-pack/plugins/apm/server/plugin.ts
+++ b/x-pack/plugins/apm/server/plugin.ts
@@ -17,6 +17,7 @@ import {
   PluginInitializerContext,
 } from 'src/core/server';
 import { mapValues } from 'lodash';
+import { RuleDataClient } from '../../rule_registry/server';
 import { APMConfig, APMXPackConfig } from '.';
 import { mergeConfigs } from './index';
 import { UI_SETTINGS } from '../../../../src/plugins/data/common';
@@ -42,10 +43,6 @@ import {
 } from './types';
 import { registerRoutes } from './routes/register_routes';
 import { getGlobalApmServerRouteRepository } from './routes/get_global_apm_server_route_repository';
-import { apmRuleRegistrySettings } from '../common/rules/apm_rule_registry_settings';
-import { apmRuleFieldMap } from '../common/rules/apm_rule_field_map';
-
-export type APMRuleRegistry = ReturnType<APMPlugin['setup']>['ruleRegistry'];
 
 export class APMPlugin
   implements
@@ -124,20 +121,26 @@ export class APMPlugin
 
     registerFeaturesUsage({ licensingPlugin: plugins.licensing });
 
-    const apmRuleRegistry = plugins.observability.ruleRegistry.create({
-      ...apmRuleRegistrySettings,
-      fieldMap: apmRuleFieldMap,
+    const getCoreStart = () =>
+      core.getStartServices().then(([coreStart]) => coreStart);
+
+    const ruleDataClient = new RuleDataClient({
+      alias: plugins.ruleRegistry.getFullAssetName('apm'),
+      ready: async () => {
+        const coreStart = await getCoreStart();
+        return { clusterClient: coreStart.elasticsearch.client.asInternalUser };
+      },
     });
 
     registerRoutes({
       core: {
         setup: core,
-        start: () => core.getStartServices().then(([coreStart]) => coreStart),
+        start: getCoreStart,
       },
       logger: this.logger,
       config: currentConfig,
       repository: getGlobalApmServerRouteRepository(),
-      apmRuleRegistry,
+      ruleDataClient,
       plugins: mapValues(plugins, (value, key) => {
         return {
           setup: value,
@@ -157,12 +160,16 @@ export class APMPlugin
         savedObjectsClient: await getInternalSavedObjectsClient(core),
         config: await mergedConfig$.pipe(take(1)).toPromise(),
       });
-    registerApmAlerts({
-      registry: apmRuleRegistry,
-      ml: plugins.ml,
-      config$: mergedConfig$,
-      logger: this.logger!.get('rule'),
-    });
+
+    if (plugins.alerting) {
+      registerApmAlerts({
+        ruleDataClient,
+        alerting: plugins.alerting,
+        ml: plugins.ml,
+        config$: mergedConfig$,
+        logger: this.logger!.get('rule'),
+      });
+    }
 
     return {
       config$: mergedConfig$,
@@ -193,7 +200,6 @@ export class APMPlugin
           },
         });
       },
-      ruleRegistry: apmRuleRegistry,
     };
   }
 
diff --git a/x-pack/plugins/apm/server/routes/register_routes/index.ts b/x-pack/plugins/apm/server/routes/register_routes/index.ts
index f792e078c528a..c9df12fd58208 100644
--- a/x-pack/plugins/apm/server/routes/register_routes/index.ts
+++ b/x-pack/plugins/apm/server/routes/register_routes/index.ts
@@ -39,14 +39,14 @@ export function registerRoutes({
   plugins,
   logger,
   config,
-  apmRuleRegistry,
+  ruleDataClient,
 }: {
   core: APMRouteHandlerResources['core'];
   plugins: APMRouteHandlerResources['plugins'];
   logger: APMRouteHandlerResources['logger'];
   repository: ServerRouteRepository<APMRouteHandlerResources>;
   config: APMRouteHandlerResources['config'];
-  apmRuleRegistry: APMRouteHandlerResources['apmRuleRegistry'];
+  ruleDataClient: APMRouteHandlerResources['ruleDataClient'];
 }) {
   const routes = repository.getRoutes();
 
@@ -99,7 +99,7 @@ export function registerRoutes({
               },
               validatedParams
             ),
-            apmRuleRegistry,
+            ruleDataClient,
           })) as any;
 
           if (Array.isArray(data)) {
diff --git a/x-pack/plugins/apm/server/routes/services.ts b/x-pack/plugins/apm/server/routes/services.ts
index 54e59f2be7ae3..4384d2be78ca0 100644
--- a/x-pack/plugins/apm/server/routes/services.ts
+++ b/x-pack/plugins/apm/server/routes/services.ts
@@ -737,30 +737,15 @@ const serviceAlertsRoute = createApmServerRoute({
   options: {
     tags: ['access:apm'],
   },
-  handler: async ({ context, params, apmRuleRegistry }) => {
-    const alertsClient = context.alerting.getAlertsClient();
-
+  handler: async ({ context, params, ruleDataClient }) => {
     const {
       query: { start, end, environment, transactionType },
       path: { serviceName },
     } = params;
 
-    const apmRuleRegistryClient = await apmRuleRegistry.createScopedRuleRegistryClient(
-      {
-        alertsClient,
-        context,
-      }
-    );
-
-    if (!apmRuleRegistryClient) {
-      throw Boom.failedDependency(
-        'xpack.ruleRegistry.unsafe.write.enabled is set to false'
-      );
-    }
-
     return {
       alerts: await getServiceAlerts({
-        apmRuleRegistryClient,
+        ruleDataClient,
         start,
         end,
         serviceName,
diff --git a/x-pack/plugins/apm/server/routes/typings.ts b/x-pack/plugins/apm/server/routes/typings.ts
index 602e1f3e0edb9..13bd631085aac 100644
--- a/x-pack/plugins/apm/server/routes/typings.ts
+++ b/x-pack/plugins/apm/server/routes/typings.ts
@@ -12,11 +12,11 @@ import {
   KibanaRequest,
   CoreStart,
 } from 'src/core/server';
+import { RuleDataClient } from '../../../rule_registry/server';
 import { AlertingApiRequestHandlerContext } from '../../../alerting/server';
 import { LicensingApiRequestHandlerContext } from '../../../licensing/server';
 import { APMConfig } from '..';
 import { APMPluginDependencies } from '../types';
-import { APMRuleRegistry } from '../plugin';
 
 export interface ApmPluginRequestHandlerContext extends RequestHandlerContext {
   licensing: LicensingApiRequestHandlerContext;
@@ -62,5 +62,5 @@ export interface APMRouteHandlerResources {
       start: () => Promise<Required<APMPluginDependencies>[key]['start']>;
     };
   };
-  apmRuleRegistry: APMRuleRegistry;
+  ruleDataClient: RuleDataClient;
 }
diff --git a/x-pack/plugins/apm/server/types.ts b/x-pack/plugins/apm/server/types.ts
index dbc220f9f6b15..a5ba4f39b32b3 100644
--- a/x-pack/plugins/apm/server/types.ts
+++ b/x-pack/plugins/apm/server/types.ts
@@ -7,6 +7,10 @@
 import { ValuesType } from 'utility-types';
 import { Observable } from 'rxjs';
 import { CoreSetup, CoreStart, KibanaRequest } from 'kibana/server';
+import {
+  RuleRegistryPluginSetupContract,
+  RuleRegistryPluginStartContract,
+} from '../../rule_registry/server';
 import {
   PluginSetup as DataPluginSetup,
   PluginStart as DataPluginStart,
@@ -115,6 +119,10 @@ interface DependencyMap {
     setup: DataPluginSetup;
     start: DataPluginStart;
   };
+  ruleRegistry: {
+    setup: RuleRegistryPluginSetupContract;
+    start: RuleRegistryPluginStartContract;
+  };
 }
 
 const requiredDependencies = [
@@ -126,6 +134,7 @@ const requiredDependencies = [
   'embeddable',
   'infra',
   'observability',
+  'ruleRegistry',
 ] as const;
 
 const optionalDependencies = [
diff --git a/x-pack/plugins/observability/common/rules/observability_rule_field_map.ts b/x-pack/plugins/observability/common/rules/observability_rule_field_map.ts
deleted file mode 100644
index 370f5d4ef79f2..0000000000000
--- a/x-pack/plugins/observability/common/rules/observability_rule_field_map.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { ecsFieldMap, pickWithPatterns } from '../../../rule_registry/common';
-
-export const observabilityRuleFieldMap = {
-  ...pickWithPatterns(ecsFieldMap, 'host.name', 'service.name'),
-  'kibana.observability.evaluation.value': {
-    type: 'scaled_float' as const,
-    scaling_factor: 1000,
-  },
-  'kibana.observability.evaluation.threshold': {
-    type: 'scaled_float' as const,
-    scaling_factor: 1000,
-  },
-};
-
-export type ObservabilityRuleFieldMap = typeof observabilityRuleFieldMap;
diff --git a/x-pack/plugins/observability/public/application/index.tsx b/x-pack/plugins/observability/public/application/index.tsx
index 8607b57b42666..0b9542fe262a3 100644
--- a/x-pack/plugins/observability/public/application/index.tsx
+++ b/x-pack/plugins/observability/public/application/index.tsx
@@ -18,11 +18,12 @@ import {
 import { PluginContext } from '../context/plugin_context';
 import { usePluginContext } from '../hooks/use_plugin_context';
 import { useRouteParams } from '../hooks/use_route_params';
-import { ObservabilityPublicPluginsStart, ObservabilityRuleRegistry } from '../plugin';
+import { ObservabilityPublicPluginsStart } from '../plugin';
 import { HasDataContextProvider } from '../context/has_data_context';
 import { Breadcrumbs, routes } from '../routes';
 import { Storage } from '../../../../../src/plugins/kibana_utils/public';
 import { ConfigSchema } from '..';
+import { ObservabilityRuleRegistry } from '../rules/create_observability_rule_registry';
 
 function getTitleFromBreadCrumbs(breadcrumbs: Breadcrumbs) {
   return breadcrumbs.map(({ text }) => text).reverse();
diff --git a/x-pack/plugins/observability/public/plugin.ts b/x-pack/plugins/observability/public/plugin.ts
index 517675fe1d525..5779dd11f816d 100644
--- a/x-pack/plugins/observability/public/plugin.ts
+++ b/x-pack/plugins/observability/public/plugin.ts
@@ -25,21 +25,16 @@ import type {
   HomePublicPluginStart,
 } from '../../../../src/plugins/home/public';
 import type { LensPublicStart } from '../../lens/public';
-import type { RuleRegistryPublicPluginSetupContract } from '../../rule_registry/public';
-import type { ObservabilityRuleFieldMap } from '../common/rules/observability_rule_field_map';
-import { observabilityRuleRegistrySettings } from '../common/rules/observability_rule_registry_settings';
 import { registerDataHandler } from './data_handler';
-import { FormatterRuleRegistry } from './rules/formatter_rule_registry';
 import { createCallObservabilityApi } from './services/call_observability_api';
 import { toggleOverviewLinkInNav } from './toggle_overview_link_in_nav';
 import { ConfigSchema } from '.';
+import { createObservabilityRuleRegistry } from './rules/create_observability_rule_registry';
 
 export type ObservabilityPublicSetup = ReturnType<Plugin['setup']>;
-export type ObservabilityRuleRegistry = ObservabilityPublicSetup['ruleRegistry'];
 
 export interface ObservabilityPublicPluginsSetup {
   data: DataPublicPluginSetup;
-  ruleRegistry: RuleRegistryPublicPluginSetupContract;
   home?: HomePublicPluginSetup;
 }
 
@@ -75,11 +70,7 @@ export class Plugin
 
     createCallObservabilityApi(coreSetup.http);
 
-    const observabilityRuleRegistry = pluginsSetup.ruleRegistry.registry.create({
-      ...observabilityRuleRegistrySettings,
-      fieldMap: {} as ObservabilityRuleFieldMap,
-      ctor: FormatterRuleRegistry,
-    });
+    const observabilityRuleRegistry = createObservabilityRuleRegistry();
 
     const mount = async (params: AppMountParameters<unknown>) => {
       // Load application bundle
diff --git a/x-pack/plugins/observability/public/rules/create_observability_rule_registry.ts b/x-pack/plugins/observability/public/rules/create_observability_rule_registry.ts
new file mode 100644
index 0000000000000..455a817edc0d2
--- /dev/null
+++ b/x-pack/plugins/observability/public/rules/create_observability_rule_registry.ts
@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { TechnicalRuleDataFieldName } from '../../../rule_registry/common/technical_rule_data_field_names';
+
+type Formatter = (
+  fields: Record<TechnicalRuleDataFieldName, unknown[]>
+) => { reason: string; link: string };
+
+export function createObservabilityRuleRegistry() {
+  const formatters: Formatter[] = [];
+  return {
+    registerFormatter: (typeId: string, formatter: Formatter) => {},
+    getFormatters: () => formatters.concat(),
+  };
+}
+
+export type ObservabilityRuleRegistry = ReturnType<typeof createObservabilityRuleRegistry>;
diff --git a/x-pack/plugins/observability/public/rules/formatter_rule_registry.ts b/x-pack/plugins/observability/public/rules/formatter_rule_registry.ts
deleted file mode 100644
index 0d0d22cf750fb..0000000000000
--- a/x-pack/plugins/observability/public/rules/formatter_rule_registry.ts
+++ /dev/null
@@ -1,30 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-import type { RuleType } from '../../../rule_registry/public';
-import type { BaseRuleFieldMap, OutputOfFieldMap } from '../../../rule_registry/common';
-import { RuleRegistry } from '../../../rule_registry/public';
-import type { asDuration, asPercent } from '../../common/utils/formatters';
-
-type AlertTypeOf<TFieldMap extends BaseRuleFieldMap> = OutputOfFieldMap<TFieldMap>;
-
-type FormattableRuleType<TFieldMap extends BaseRuleFieldMap> = RuleType & {
-  format?: (options: {
-    alert: AlertTypeOf<TFieldMap>;
-    formatters: {
-      asDuration: typeof asDuration;
-      asPercent: typeof asPercent;
-    };
-  }) => {
-    reason?: string;
-    link?: string;
-  };
-};
-
-export class FormatterRuleRegistry<TFieldMap extends BaseRuleFieldMap> extends RuleRegistry<
-  TFieldMap,
-  FormattableRuleType<TFieldMap>
-> {}
diff --git a/x-pack/plugins/observability/public/rules/observability_rule_registry_mock.ts b/x-pack/plugins/observability/public/rules/observability_rule_registry_mock.ts
index 389b581b5fb60..1daa915bd0a6d 100644
--- a/x-pack/plugins/observability/public/rules/observability_rule_registry_mock.ts
+++ b/x-pack/plugins/observability/public/rules/observability_rule_registry_mock.ts
@@ -5,12 +5,10 @@
  * 2.0.
  */
 
-import { ObservabilityRuleRegistry } from '../plugin';
+import { ObservabilityRuleRegistry } from './create_observability_rule_registry';
 
 const createRuleRegistryMock = () => ({
-  registerType: () => {},
-  getTypeByRuleId: () => ({ format: () => ({ link: '/test/example' }) }),
-  create: () => createRuleRegistryMock(),
+  registerFormatter: () => {},
 });
 
 export const createObservabilityRuleRegistryMock = () =>
diff --git a/x-pack/plugins/observability/server/lib/rules/get_top_alerts.ts b/x-pack/plugins/observability/server/lib/rules/get_top_alerts.ts
index 0045c0f0c6757..9ac860b5a37a6 100644
--- a/x-pack/plugins/observability/server/lib/rules/get_top_alerts.ts
+++ b/x-pack/plugins/observability/server/lib/rules/get_top_alerts.ts
@@ -4,24 +4,27 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-import { Required } from 'utility-types';
-import { ObservabilityRuleRegistryClient } from '../../types';
+import {
+  ALERT_UUID,
+  TIMESTAMP,
+} from '../../../../rule_registry/common/technical_rule_data_field_names';
+import { RuleDataClient } from '../../../../rule_registry/server';
 import { kqlQuery, rangeQuery } from '../../utils/queries';
 
 export async function getTopAlerts({
-  ruleRegistryClient,
+  ruleDataClient,
   start,
   end,
   kuery,
   size,
 }: {
-  ruleRegistryClient: ObservabilityRuleRegistryClient;
+  ruleDataClient: RuleDataClient;
   start: number;
   end: number;
   kuery?: string;
   size: number;
 }) {
-  const response = await ruleRegistryClient.search({
+  const response = await ruleDataClient.getReader().search({
     body: {
       query: {
         bool: {
@@ -30,26 +33,17 @@ export async function getTopAlerts({
       },
       fields: ['*'],
       collapse: {
-        field: 'kibana.rac.alert.uuid',
+        field: ALERT_UUID,
       },
       size,
       sort: {
-        '@timestamp': 'desc',
+        [TIMESTAMP]: 'desc',
       },
       _source: false,
     },
   });
 
-  return response.events.map((event) => {
-    return event as Required<
-      typeof event,
-      | 'rule.id'
-      | 'rule.name'
-      | 'kibana.rac.alert.start'
-      | 'event.action'
-      | 'rule.category'
-      | 'rule.name'
-      | 'kibana.rac.alert.duration.us'
-    >;
+  return response.hits.hits.map((hit) => {
+    return hit.fields;
   });
 }
diff --git a/x-pack/plugins/observability/server/plugin.ts b/x-pack/plugins/observability/server/plugin.ts
index b5208260297d0..8b02d9c8225d2 100644
--- a/x-pack/plugins/observability/server/plugin.ts
+++ b/x-pack/plugins/observability/server/plugin.ts
@@ -6,6 +6,7 @@
  */
 
 import { PluginInitializerContext, Plugin, CoreSetup } from 'src/core/server';
+import { RuleDataClient } from '../../rule_registry/server';
 import { ObservabilityConfig } from '.';
 import {
   bootstrapAnnotations,
@@ -16,11 +17,8 @@ import type { RuleRegistryPluginSetupContract } from '../../rule_registry/server
 import { uiSettings } from './ui_settings';
 import { registerRoutes } from './routes/register_routes';
 import { getGlobalObservabilityServerRouteRepository } from './routes/get_global_observability_server_route_repository';
-import { observabilityRuleRegistrySettings } from '../common/rules/observability_rule_registry_settings';
-import { observabilityRuleFieldMap } from '../common/rules/observability_rule_field_map';
 
 export type ObservabilityPluginSetup = ReturnType<ObservabilityPlugin['setup']>;
-export type ObservabilityRuleRegistry = ObservabilityPluginSetup['ruleRegistry'];
 
 export class ObservabilityPlugin implements Plugin<ObservabilityPluginSetup> {
   constructor(private readonly initContext: PluginInitializerContext) {
@@ -51,19 +49,26 @@ export class ObservabilityPlugin implements Plugin<ObservabilityPluginSetup> {
       });
     }
 
-    const observabilityRuleRegistry = plugins.ruleRegistry.create({
-      ...observabilityRuleRegistrySettings,
-      fieldMap: observabilityRuleFieldMap,
+    const start = () => core.getStartServices().then(([coreStart]) => coreStart);
+
+    const ruleDataClient = new RuleDataClient({
+      ready: async () => {
+        const coreStart = await start();
+        return {
+          clusterClient: coreStart.elasticsearch.client.asInternalUser,
+        };
+      },
+      alias: plugins.ruleRegistry.getFullAssetName(),
     });
 
     registerRoutes({
       core: {
         setup: core,
-        start: () => core.getStartServices().then(([coreStart]) => coreStart),
+        start,
       },
-      ruleRegistry: observabilityRuleRegistry,
       logger: this.initContext.logger.get(),
       repository: getGlobalObservabilityServerRouteRepository(),
+      ruleDataClient,
     });
 
     return {
@@ -71,7 +76,6 @@ export class ObservabilityPlugin implements Plugin<ObservabilityPluginSetup> {
         const api = await annotationsApiPromise;
         return api?.getScopedAnnotationsClient(...args);
       },
-      ruleRegistry: observabilityRuleRegistry,
     };
   }
 
diff --git a/x-pack/plugins/observability/server/routes/register_routes.ts b/x-pack/plugins/observability/server/routes/register_routes.ts
index 85ee456b812b8..75b6703cc64de 100644
--- a/x-pack/plugins/observability/server/routes/register_routes.ts
+++ b/x-pack/plugins/observability/server/routes/register_routes.ts
@@ -13,23 +13,23 @@ import {
 import { CoreSetup, CoreStart, Logger, RouteRegistrar } from 'kibana/server';
 import Boom from '@hapi/boom';
 import { RequestAbortedError } from '@elastic/elasticsearch/lib/errors';
-import { ObservabilityRuleRegistry } from '../plugin';
+import { RuleDataClient } from '../../../rule_registry/server';
 import { ObservabilityRequestHandlerContext } from '../types';
 import { AbstractObservabilityServerRouteRepository } from './types';
 
 export function registerRoutes({
-  ruleRegistry,
   repository,
   core,
   logger,
+  ruleDataClient,
 }: {
   core: {
     setup: CoreSetup;
     start: () => Promise<CoreStart>;
   };
-  ruleRegistry: ObservabilityRuleRegistry;
   repository: AbstractObservabilityServerRouteRepository;
   logger: Logger;
+  ruleDataClient: RuleDataClient;
 }) {
   const routes = repository.getRoutes();
 
@@ -59,10 +59,10 @@ export function registerRoutes({
           const data = (await handler({
             context,
             request,
-            ruleRegistry,
             core,
             logger,
             params: decodedParams,
+            ruleDataClient,
           })) as any;
 
           return response.ok({ body: data });
diff --git a/x-pack/plugins/observability/server/routes/rules.ts b/x-pack/plugins/observability/server/routes/rules.ts
index cd3f4976e0af3..848f0489985fc 100644
--- a/x-pack/plugins/observability/server/routes/rules.ts
+++ b/x-pack/plugins/observability/server/routes/rules.ts
@@ -6,7 +6,6 @@
  */
 import * as t from 'io-ts';
 import { isoToEpochRt, toNumberRt } from '@kbn/io-ts-utils';
-import Boom from '@hapi/boom';
 import { createObservabilityServerRoute } from './create_observability_server_route';
 import { createObservabilityServerRouteRepository } from './create_observability_server_route_repository';
 import { getTopAlerts } from '../lib/rules/get_top_alerts';
@@ -28,22 +27,13 @@ const alertsListRoute = createObservabilityServerRoute({
       }),
     ]),
   }),
-  handler: async ({ ruleRegistry, context, params }) => {
-    const ruleRegistryClient = await ruleRegistry.createScopedRuleRegistryClient({
-      context,
-      alertsClient: context.alerting.getAlertsClient(),
-    });
-
-    if (!ruleRegistryClient) {
-      throw Boom.failedDependency('xpack.ruleRegistry.unsafe.write.enabled is set to false');
-    }
-
+  handler: async ({ ruleDataClient, context, params }) => {
     const {
       query: { start, end, kuery, size = 100 },
     } = params;
 
     return getTopAlerts({
-      ruleRegistryClient,
+      ruleDataClient,
       start,
       end,
       kuery,
@@ -57,17 +47,10 @@ const alertsDynamicIndexPatternRoute = createObservabilityServerRoute({
   options: {
     tags: [],
   },
-  handler: async ({ ruleRegistry, context }) => {
-    const ruleRegistryClient = await ruleRegistry.createScopedRuleRegistryClient({
-      context,
-      alertsClient: context.alerting.getAlertsClient(),
-    });
-
-    if (!ruleRegistryClient) {
-      throw Boom.failedDependency();
-    }
+  handler: async ({ ruleDataClient }) => {
+    const reader = ruleDataClient.getReader();
 
-    return ruleRegistryClient.getDynamicIndexPattern();
+    return reader.getDynamicIndexPattern();
   },
 });
 
diff --git a/x-pack/plugins/observability/server/routes/types.ts b/x-pack/plugins/observability/server/routes/types.ts
index 0588bf8df2292..1fa7229c6cf62 100644
--- a/x-pack/plugins/observability/server/routes/types.ts
+++ b/x-pack/plugins/observability/server/routes/types.ts
@@ -12,7 +12,7 @@ import type {
   ServerRouteRepository,
 } from '@kbn/server-route-repository';
 import { CoreSetup, CoreStart, KibanaRequest, Logger } from 'kibana/server';
-import { ObservabilityRuleRegistry } from '../plugin';
+import { RuleDataClient } from '../../../rule_registry/server';
 
 import { ObservabilityServerRouteRepository } from './get_global_observability_server_route_repository';
 import { ObservabilityRequestHandlerContext } from '../types';
@@ -24,7 +24,7 @@ export interface ObservabilityRouteHandlerResources {
     start: () => Promise<CoreStart>;
     setup: CoreSetup;
   };
-  ruleRegistry: ObservabilityRuleRegistry;
+  ruleDataClient: RuleDataClient;
   request: KibanaRequest;
   context: ObservabilityRequestHandlerContext;
   logger: Logger;
diff --git a/x-pack/plugins/observability/server/types.ts b/x-pack/plugins/observability/server/types.ts
index 81b32b3f8db7b..da13e60804a60 100644
--- a/x-pack/plugins/observability/server/types.ts
+++ b/x-pack/plugins/observability/server/types.ts
@@ -7,9 +7,7 @@
 
 import type { IRouter, RequestHandlerContext } from 'src/core/server';
 import type { AlertingApiRequestHandlerContext } from '../../alerting/server';
-import type { ScopedRuleRegistryClient, FieldMapOf } from '../../rule_registry/server';
 import type { LicensingApiRequestHandlerContext } from '../../licensing/server';
-import type { ObservabilityRuleRegistry } from './plugin';
 
 export type {
   ObservabilityRouteCreateOptions,
@@ -31,7 +29,3 @@ export interface ObservabilityRequestHandlerContext extends RequestHandlerContex
  * @internal
  */
 export type ObservabilityPluginRouter = IRouter<ObservabilityRequestHandlerContext>;
-
-export type ObservabilityRuleRegistryClient = ScopedRuleRegistryClient<
-  FieldMapOf<ObservabilityRuleRegistry>
->;
diff --git a/x-pack/plugins/rule_registry/common/assets.ts b/x-pack/plugins/rule_registry/common/assets.ts
new file mode 100644
index 0000000000000..ddc425f068c5a
--- /dev/null
+++ b/x-pack/plugins/rule_registry/common/assets.ts
@@ -0,0 +1,12 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export const DEFAULT_ASSET_NAMESPACE = 'alerts';
+
+export const TECHNICAL_COMPONENT_TEMPLATE_NAME = `technical-mappings`;
+export const ECS_COMPONENT_TEMPLATE_NAME = `ecs-mappings`;
+export const DEFAULT_ILM_POLICY_ID = 'ilm-policy';
diff --git a/x-pack/plugins/rule_registry/common/field_map/base_rule_field_map.ts b/x-pack/plugins/rule_registry/common/field_map/base_rule_field_map.ts
deleted file mode 100644
index 22a74212d2ce0..0000000000000
--- a/x-pack/plugins/rule_registry/common/field_map/base_rule_field_map.ts
+++ /dev/null
@@ -1,33 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-import { ecsFieldMap } from './ecs_field_map';
-import { pickWithPatterns } from '../pick_with_patterns';
-
-export const baseRuleFieldMap = {
-  ...pickWithPatterns(
-    ecsFieldMap,
-    '@timestamp',
-    'event.kind',
-    'event.action',
-    'rule.uuid',
-    'rule.id',
-    'rule.name',
-    'rule.category',
-    'tags'
-  ),
-  'kibana.rac.producer': { type: 'keyword' },
-  'kibana.rac.alert.uuid': { type: 'keyword' },
-  'kibana.rac.alert.id': { type: 'keyword' },
-  'kibana.rac.alert.start': { type: 'date' },
-  'kibana.rac.alert.end': { type: 'date' },
-  'kibana.rac.alert.duration.us': { type: 'long' },
-  'kibana.rac.alert.severity.level': { type: 'keyword' },
-  'kibana.rac.alert.severity.value': { type: 'long' },
-  'kibana.rac.alert.status': { type: 'keyword' },
-} as const;
-
-export type BaseRuleFieldMap = typeof baseRuleFieldMap;
diff --git a/x-pack/plugins/rule_registry/common/field_map/index.ts b/x-pack/plugins/rule_registry/common/field_map/index.ts
index 8db5c2738439b..fac8575b8af48 100644
--- a/x-pack/plugins/rule_registry/common/field_map/index.ts
+++ b/x-pack/plugins/rule_registry/common/field_map/index.ts
@@ -5,8 +5,6 @@
  * 2.0.
  */
 
-export * from './base_rule_field_map';
-export * from './ecs_field_map';
 export * from './merge_field_maps';
 export * from './runtime_type_from_fieldmap';
 export * from './types';
diff --git a/x-pack/plugins/rule_registry/common/technical_rule_data_field_names.ts b/x-pack/plugins/rule_registry/common/technical_rule_data_field_names.ts
new file mode 100644
index 0000000000000..e6ee7d1ea5376
--- /dev/null
+++ b/x-pack/plugins/rule_registry/common/technical_rule_data_field_names.ts
@@ -0,0 +1,76 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ValuesType } from 'utility-types';
+
+const ALERT_NAMESPACE = 'kibana.rac.alert';
+
+const TIMESTAMP = '@timestamp' as const;
+const EVENT_KIND = 'event.kind' as const;
+const EVENT_ACTION = 'event.action' as const;
+const RULE_UUID = 'rule.uuid' as const;
+const RULE_ID = 'rule.id' as const;
+const RULE_NAME = 'rule.name' as const;
+const RULE_CATEGORY = 'rule.category' as const;
+const TAGS = 'tags' as const;
+const PRODUCER = `${ALERT_NAMESPACE}.producer` as const;
+const ALERT_ID = `${ALERT_NAMESPACE}.id` as const;
+const ALERT_UUID = `${ALERT_NAMESPACE}.uuid` as const;
+const ALERT_START = `${ALERT_NAMESPACE}.start` as const;
+const ALERT_END = `${ALERT_NAMESPACE}.end` as const;
+const ALERT_DURATION = `${ALERT_NAMESPACE}.duration.us` as const;
+const ALERT_SEVERITY_LEVEL = `${ALERT_NAMESPACE}.severity.level` as const;
+const ALERT_SEVERITY_VALUE = `${ALERT_NAMESPACE}.severity.value` as const;
+const ALERT_STATUS = `${ALERT_NAMESPACE}.status` as const;
+const ALERT_EVALUATION_THRESHOLD = `${ALERT_NAMESPACE}.evaluation.threshold` as const;
+const ALERT_EVALUATION_VALUE = `${ALERT_NAMESPACE}.evaluation.value` as const;
+
+const fields = {
+  TIMESTAMP,
+  EVENT_KIND,
+  EVENT_ACTION,
+  RULE_UUID,
+  RULE_ID,
+  RULE_NAME,
+  RULE_CATEGORY,
+  TAGS,
+  PRODUCER,
+  ALERT_ID,
+  ALERT_UUID,
+  ALERT_START,
+  ALERT_END,
+  ALERT_DURATION,
+  ALERT_SEVERITY_LEVEL,
+  ALERT_SEVERITY_VALUE,
+  ALERT_STATUS,
+  ALERT_EVALUATION_THRESHOLD,
+  ALERT_EVALUATION_VALUE,
+};
+
+export {
+  TIMESTAMP,
+  EVENT_KIND,
+  EVENT_ACTION,
+  RULE_UUID,
+  RULE_ID,
+  RULE_NAME,
+  RULE_CATEGORY,
+  TAGS,
+  PRODUCER,
+  ALERT_ID,
+  ALERT_UUID,
+  ALERT_START,
+  ALERT_END,
+  ALERT_DURATION,
+  ALERT_SEVERITY_LEVEL,
+  ALERT_SEVERITY_VALUE,
+  ALERT_STATUS,
+  ALERT_EVALUATION_THRESHOLD,
+  ALERT_EVALUATION_VALUE,
+};
+
+export type TechnicalRuleDataFieldName = ValuesType<typeof fields>;
diff --git a/x-pack/plugins/rule_registry/public/index.ts b/x-pack/plugins/rule_registry/public/index.ts
deleted file mode 100644
index 59697261ff20b..0000000000000
--- a/x-pack/plugins/rule_registry/public/index.ts
+++ /dev/null
@@ -1,17 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import type { PluginInitializerContext } from 'kibana/public';
-import { Plugin } from './plugin';
-
-export type { RuleRegistryPublicPluginSetupContract } from './plugin';
-export { RuleRegistry } from './rule_registry';
-export type { IRuleRegistry, RuleType } from './rule_registry/types';
-
-export const plugin = (context: PluginInitializerContext) => {
-  return new Plugin(context);
-};
diff --git a/x-pack/plugins/rule_registry/public/plugin.ts b/x-pack/plugins/rule_registry/public/plugin.ts
deleted file mode 100644
index 7f0bceefb6797..0000000000000
--- a/x-pack/plugins/rule_registry/public/plugin.ts
+++ /dev/null
@@ -1,56 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import type {
-  CoreSetup,
-  CoreStart,
-  Plugin as PluginClass,
-  PluginInitializerContext,
-} from '../../../../src/core/public';
-import type {
-  PluginSetupContract as AlertingPluginPublicSetupContract,
-  PluginStartContract as AlertingPluginPublicStartContract,
-} from '../../alerting/public';
-import type {
-  TriggersAndActionsUIPublicPluginSetup,
-  TriggersAndActionsUIPublicPluginStart,
-} from '../../triggers_actions_ui/public';
-import type { BaseRuleFieldMap } from '../common';
-import { RuleRegistry } from './rule_registry';
-
-interface RuleRegistrySetupPlugins {
-  alerting: AlertingPluginPublicSetupContract;
-  triggersActionsUi: TriggersAndActionsUIPublicPluginSetup;
-}
-
-interface RuleRegistryStartPlugins {
-  alerting: AlertingPluginPublicStartContract;
-  triggersActionsUi: TriggersAndActionsUIPublicPluginStart;
-}
-
-export type RuleRegistryPublicPluginSetupContract = ReturnType<Plugin['setup']>;
-
-export class Plugin
-  implements PluginClass<void, void, RuleRegistrySetupPlugins, RuleRegistryStartPlugins> {
-  constructor(context: PluginInitializerContext) {}
-
-  public setup(core: CoreSetup<RuleRegistryStartPlugins>, plugins: RuleRegistrySetupPlugins) {
-    const rootRegistry = new RuleRegistry({
-      fieldMap: {} as BaseRuleFieldMap,
-      alertTypeRegistry: plugins.triggersActionsUi.alertTypeRegistry,
-    });
-    return {
-      registry: rootRegistry,
-    };
-  }
-
-  start(core: CoreStart, plugins: RuleRegistryStartPlugins) {
-    return {
-      registerType: plugins.triggersActionsUi.alertTypeRegistry,
-    };
-  }
-}
diff --git a/x-pack/plugins/rule_registry/public/rule_registry/index.ts b/x-pack/plugins/rule_registry/public/rule_registry/index.ts
deleted file mode 100644
index ea47fe2e26aad..0000000000000
--- a/x-pack/plugins/rule_registry/public/rule_registry/index.ts
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import type { BaseRuleFieldMap } from '../../common';
-import type { RuleType, CreateRuleRegistry, RuleRegistryConstructorOptions } from './types';
-
-export class RuleRegistry<TFieldMap extends BaseRuleFieldMap, TRuleType extends RuleType> {
-  protected types: TRuleType[] = [];
-
-  constructor(private readonly options: RuleRegistryConstructorOptions<TFieldMap>) {}
-
-  getTypes(): TRuleType[] {
-    return this.types;
-  }
-
-  getTypeByRuleId(id: string): TRuleType | undefined {
-    return this.types.find((type) => type.id === id);
-  }
-
-  registerType(type: TRuleType) {
-    this.types.push(type);
-    if (this.options.parent) {
-      this.options.parent.registerType(type);
-    } else {
-      this.options.alertTypeRegistry.register(type);
-    }
-  }
-
-  create: CreateRuleRegistry<TFieldMap, TRuleType> = ({ fieldMap, ctor }) => {
-    const createOptions = {
-      fieldMap: {
-        ...this.options.fieldMap,
-        ...fieldMap,
-      },
-      alertTypeRegistry: this.options.alertTypeRegistry,
-      parent: this,
-    };
-
-    const registry = ctor ? new ctor(createOptions) : new RuleRegistry(createOptions);
-
-    return registry as any;
-  };
-}
diff --git a/x-pack/plugins/rule_registry/public/rule_registry/types.ts b/x-pack/plugins/rule_registry/public/rule_registry/types.ts
deleted file mode 100644
index 7c186385ebd35..0000000000000
--- a/x-pack/plugins/rule_registry/public/rule_registry/types.ts
+++ /dev/null
@@ -1,63 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-import type { AlertTypeRegistryContract } from '../../../triggers_actions_ui/public';
-import type { BaseRuleFieldMap, FieldMap } from '../../common';
-
-export interface RuleRegistryConstructorOptions<TFieldMap extends BaseRuleFieldMap> {
-  fieldMap: TFieldMap;
-  alertTypeRegistry: AlertTypeRegistryContract;
-  parent?: IRuleRegistry<any, any>;
-}
-
-export type RuleType = Parameters<AlertTypeRegistryContract['register']>[0];
-
-export type RegisterRuleType<
-  TFieldMap extends BaseRuleFieldMap,
-  TAdditionalRegisterOptions = {}
-> = (type: RuleType & TAdditionalRegisterOptions) => void;
-
-export type RuleRegistryExtensions<T extends keyof any = never> = Record<
-  T,
-  (...args: any[]) => any
->;
-
-export type CreateRuleRegistry<
-  TFieldMap extends BaseRuleFieldMap,
-  TRuleType extends RuleType,
-  TInstanceType = undefined
-> = <
-  TNextFieldMap extends FieldMap,
-  TRuleRegistryInstance extends IRuleRegistry<
-    TFieldMap & TNextFieldMap,
-    any
-  > = TInstanceType extends IRuleRegistry<TFieldMap & TNextFieldMap, TRuleType>
-    ? TInstanceType
-    : IRuleRegistry<TFieldMap & TNextFieldMap, TRuleType>
->(options: {
-  fieldMap: TNextFieldMap;
-  ctor?: new (
-    options: RuleRegistryConstructorOptions<TFieldMap & TNextFieldMap>
-  ) => TRuleRegistryInstance;
-}) => TRuleRegistryInstance;
-
-export interface IRuleRegistry<
-  TFieldMap extends BaseRuleFieldMap,
-  TRuleType extends RuleType,
-  TInstanceType = undefined
-> {
-  create: CreateRuleRegistry<TFieldMap, TRuleType, TInstanceType>;
-  registerType(type: TRuleType): void;
-  getTypeByRuleId(ruleId: string): TRuleType;
-  getTypes(): TRuleType[];
-}
-
-export type FieldMapOfRuleRegistry<TRuleRegistry> = TRuleRegistry extends IRuleRegistry<
-  infer TFieldMap,
-  any
->
-  ? TFieldMap
-  : never;
diff --git a/x-pack/plugins/rule_registry/server/assets/component_templates/ecs_component_template.ts b/x-pack/plugins/rule_registry/server/assets/component_templates/ecs_component_template.ts
new file mode 100644
index 0000000000000..45e6b9a748cbf
--- /dev/null
+++ b/x-pack/plugins/rule_registry/server/assets/component_templates/ecs_component_template.ts
@@ -0,0 +1,24 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { merge } from 'lodash';
+import { ClusterPutComponentTemplateBody } from '../../rule_data_plugin_service/types';
+import { mappingFromFieldMap } from '../../utils/mapping_from_field_map';
+import { ecsFieldMap } from '../field_maps/ecs_field_map';
+import { technicalRuleFieldMap } from '../field_maps/technical_rule_field_map';
+
+export const ecsComponentTemplate: ClusterPutComponentTemplateBody = {
+  template: {
+    settings: {
+      number_of_shards: 1,
+    },
+    mappings: merge(
+      {},
+      mappingFromFieldMap(ecsFieldMap),
+      mappingFromFieldMap(technicalRuleFieldMap)
+    ),
+  },
+};
diff --git a/x-pack/plugins/rule_registry/server/assets/component_templates/technical_component_template.ts b/x-pack/plugins/rule_registry/server/assets/component_templates/technical_component_template.ts
new file mode 100644
index 0000000000000..46aaa8845ca21
--- /dev/null
+++ b/x-pack/plugins/rule_registry/server/assets/component_templates/technical_component_template.ts
@@ -0,0 +1,19 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ClusterPutComponentTemplateBody } from '../../rule_data_plugin_service/types';
+import { mappingFromFieldMap } from '../../utils/mapping_from_field_map';
+import { technicalRuleFieldMap } from '../field_maps/technical_rule_field_map';
+
+export const technicalComponentTemplate: ClusterPutComponentTemplateBody = {
+  template: {
+    settings: {
+      number_of_shards: 1,
+    },
+    mappings: mappingFromFieldMap(technicalRuleFieldMap),
+  },
+};
diff --git a/x-pack/plugins/rule_registry/common/field_map/ecs_field_map.ts b/x-pack/plugins/rule_registry/server/assets/field_maps/ecs_field_map.ts
similarity index 100%
rename from x-pack/plugins/rule_registry/common/field_map/ecs_field_map.ts
rename to x-pack/plugins/rule_registry/server/assets/field_maps/ecs_field_map.ts
diff --git a/x-pack/plugins/rule_registry/server/assets/field_maps/technical_rule_field_map.ts b/x-pack/plugins/rule_registry/server/assets/field_maps/technical_rule_field_map.ts
new file mode 100644
index 0000000000000..a946e9523548c
--- /dev/null
+++ b/x-pack/plugins/rule_registry/server/assets/field_maps/technical_rule_field_map.ts
@@ -0,0 +1,56 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { pickWithPatterns } from '../../../common/pick_with_patterns';
+import {
+  ALERT_DURATION,
+  ALERT_END,
+  ALERT_EVALUATION_THRESHOLD,
+  ALERT_EVALUATION_VALUE,
+  ALERT_ID,
+  ALERT_SEVERITY_LEVEL,
+  ALERT_SEVERITY_VALUE,
+  ALERT_START,
+  ALERT_STATUS,
+  ALERT_UUID,
+  EVENT_ACTION,
+  EVENT_KIND,
+  PRODUCER,
+  RULE_CATEGORY,
+  RULE_ID,
+  RULE_NAME,
+  RULE_UUID,
+  TAGS,
+  TIMESTAMP,
+} from '../../../common/technical_rule_data_field_names';
+import { ecsFieldMap } from './ecs_field_map';
+
+export const technicalRuleFieldMap = {
+  ...pickWithPatterns(
+    ecsFieldMap,
+    TIMESTAMP,
+    EVENT_KIND,
+    EVENT_ACTION,
+    RULE_UUID,
+    RULE_ID,
+    RULE_NAME,
+    RULE_CATEGORY,
+    TAGS
+  ),
+  [PRODUCER]: { type: 'keyword' },
+  [ALERT_UUID]: { type: 'keyword' },
+  [ALERT_ID]: { type: 'keyword' },
+  [ALERT_START]: { type: 'date' },
+  [ALERT_END]: { type: 'date' },
+  [ALERT_DURATION]: { type: 'long' },
+  [ALERT_SEVERITY_LEVEL]: { type: 'keyword' },
+  [ALERT_SEVERITY_VALUE]: { type: 'long' },
+  [ALERT_STATUS]: { type: 'keyword' },
+  [ALERT_EVALUATION_THRESHOLD]: { type: 'scaled_float', scaling_factor: 100 },
+  [ALERT_EVALUATION_VALUE]: { type: 'scaled_float', scaling_factor: 100 },
+} as const;
+
+export type TechnicalRuleFieldMaps = typeof technicalRuleFieldMap;
diff --git a/x-pack/plugins/rule_registry/server/assets/index_templates/base_index_template.ts b/x-pack/plugins/rule_registry/server/assets/index_templates/base_index_template.ts
new file mode 100644
index 0000000000000..ee2e45640c149
--- /dev/null
+++ b/x-pack/plugins/rule_registry/server/assets/index_templates/base_index_template.ts
@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export const baseIndexTemplate = {
+  template: {
+    settings: {
+      number_of_shards: 1,
+      number_of_replicas: 0,
+    },
+  },
+};
diff --git a/x-pack/plugins/rule_registry/server/rule_registry/defaults/ilm_policy.ts b/x-pack/plugins/rule_registry/server/assets/lifecycle_policies/default_lifecycle_policy.ts
similarity index 86%
rename from x-pack/plugins/rule_registry/server/rule_registry/defaults/ilm_policy.ts
rename to x-pack/plugins/rule_registry/server/assets/lifecycle_policies/default_lifecycle_policy.ts
index c80f7e772f308..f207087f7aa19 100644
--- a/x-pack/plugins/rule_registry/server/rule_registry/defaults/ilm_policy.ts
+++ b/x-pack/plugins/rule_registry/server/assets/lifecycle_policies/default_lifecycle_policy.ts
@@ -5,9 +5,7 @@
  * 2.0.
  */
 
-import { ILMPolicy } from '../types';
-
-export const defaultIlmPolicy: ILMPolicy = {
+export const defaultLifecyclePolicy = {
   policy: {
     phases: {
       hot: {
diff --git a/x-pack/plugins/rule_registry/server/rule_registry/defaults/field_map.ts b/x-pack/plugins/rule_registry/server/assets/lifecycle_policies/field_map.ts
similarity index 100%
rename from x-pack/plugins/rule_registry/server/rule_registry/defaults/field_map.ts
rename to x-pack/plugins/rule_registry/server/assets/lifecycle_policies/field_map.ts
diff --git a/x-pack/plugins/rule_registry/server/index.ts b/x-pack/plugins/rule_registry/server/index.ts
index e2b4dec31b3f7..8ac41497d3e94 100644
--- a/x-pack/plugins/rule_registry/server/index.ts
+++ b/x-pack/plugins/rule_registry/server/index.ts
@@ -9,11 +9,11 @@ import { schema, TypeOf } from '@kbn/config-schema';
 import { PluginInitializerContext } from 'src/core/server';
 import { RuleRegistryPlugin } from './plugin';
 
-export { RuleRegistryPluginSetupContract } from './plugin';
-export { createLifecycleRuleTypeFactory } from './rule_registry/rule_type_helpers/create_lifecycle_rule_type_factory';
+export type { RuleRegistryPluginSetupContract, RuleRegistryPluginStartContract } from './plugin';
+export { RuleDataClient } from './rule_data_client';
+export { getRuleExecutorData, RuleExecutorData } from './utils/get_rule_executor_data';
+export { createLifecycleRuleTypeFactory } from './utils/create_lifecycle_rule_type_factory';
 export { createPersistenceRuleTypeFactory } from './rule_registry/rule_type_helpers/create_persistence_rule_type_factory';
-export { FieldMapOf } from './types';
-export { ScopedRuleRegistryClient } from './rule_registry/create_scoped_rule_registry_client/types';
 
 export const config = {
   schema: schema.object({
@@ -24,7 +24,7 @@ export const config = {
   }),
 };
 
-export type RuleRegistryConfig = TypeOf<typeof config.schema>;
+export type RuleRegistryPluginConfig = TypeOf<typeof config.schema>;
 
 export const plugin = (initContext: PluginInitializerContext) =>
   new RuleRegistryPlugin(initContext);
diff --git a/x-pack/plugins/rule_registry/server/plugin.ts b/x-pack/plugins/rule_registry/server/plugin.ts
index 961b947e3f556..12eb06c93bde0 100644
--- a/x-pack/plugins/rule_registry/server/plugin.ts
+++ b/x-pack/plugins/rule_registry/server/plugin.ts
@@ -5,53 +5,77 @@
  * 2.0.
  */
 
-import { PluginInitializerContext, Plugin, CoreSetup, CoreStart } from 'src/core/server';
+import { PluginInitializerContext, Plugin, CoreSetup } from 'src/core/server';
+import { once } from 'lodash';
+import { RuleDataPluginService } from './rule_data_plugin_service';
+import { RuleRegistryPluginConfig } from '.';
+import { technicalComponentTemplate } from './assets/component_templates/technical_component_template';
 import {
-  PluginSetupContract as AlertingPluginSetupContract,
-  PluginStartContract as AlertPluginStartContract,
-} from '../../alerting/server';
-import { RuleRegistry } from './rule_registry';
-import { defaultIlmPolicy } from './rule_registry/defaults/ilm_policy';
-import { BaseRuleFieldMap, baseRuleFieldMap } from '../common';
-import { RuleRegistryConfig } from '.';
+  DEFAULT_ILM_POLICY_ID,
+  ECS_COMPONENT_TEMPLATE_NAME,
+  TECHNICAL_COMPONENT_TEMPLATE_NAME,
+} from '../common/assets';
+import { ecsComponentTemplate } from './assets/component_templates/ecs_component_template';
+import { defaultLifecyclePolicy } from './assets/lifecycle_policies/default_lifecycle_policy';
 
-export type RuleRegistryPluginSetupContract = RuleRegistry<BaseRuleFieldMap>;
+export type RuleRegistryPluginSetupContract = RuleDataPluginService;
+export type RuleRegistryPluginStartContract = void;
 
 export class RuleRegistryPlugin implements Plugin<RuleRegistryPluginSetupContract> {
   constructor(private readonly initContext: PluginInitializerContext) {
     this.initContext = initContext;
   }
 
-  public setup(
-    core: CoreSetup,
-    plugins: { alerting: AlertingPluginSetupContract }
-  ): RuleRegistryPluginSetupContract {
+  public setup(core: CoreSetup): RuleRegistryPluginSetupContract {
     const globalConfig = this.initContext.config.legacy.get();
-    const config = this.initContext.config.get<RuleRegistryConfig>();
+    const config = this.initContext.config.get<RuleRegistryPluginConfig>();
 
     const logger = this.initContext.logger.get();
 
-    const rootRegistry = new RuleRegistry({
-      coreSetup: core,
-      ilmPolicy: defaultIlmPolicy,
-      fieldMap: baseRuleFieldMap,
+    const ready = once(async () => {
+      logger.debug('Installing assets');
+
+      const startServicesPromise = core.getStartServices();
+
+      await service.createOrUpdateLifecyclePolicy({
+        policy_id: service.getFullAssetName(DEFAULT_ILM_POLICY_ID),
+        body: defaultLifecyclePolicy,
+      });
+
+      await service.createOrUpdateComponentTemplate({
+        name: service.getFullAssetName(TECHNICAL_COMPONENT_TEMPLATE_NAME),
+        body: technicalComponentTemplate,
+      });
+
+      await service.createOrUpdateComponentTemplate({
+        name: service.getFullAssetName(ECS_COMPONENT_TEMPLATE_NAME),
+        body: ecsComponentTemplate,
+      });
+
+      const [coreStart] = await startServicesPromise;
+
+      return {
+        clusterClient: coreStart.elasticsearch.client.asInternalUser,
+      };
+    });
+
+    ready().catch((originalError) => {
+      const error = new Error('Failed installing assets');
+      Object.assign(error, { originalError });
+      logger.error(error);
+    });
+
+    const service = new RuleDataPluginService({
+      logger,
+      isWriteEnabled: config.unsafe.write.enabled,
       kibanaIndex: globalConfig.kibana.index,
-      name: 'alerts',
-      kibanaVersion: this.initContext.env.packageInfo.version,
-      logger: logger.get('root'),
-      alertingPluginSetupContract: plugins.alerting,
-      writeEnabled: config.unsafe.write.enabled,
+      ready,
     });
 
-    return rootRegistry;
+    return service;
   }
 
-  // Temporarily exposing alerting client as passthrough
-  public start(core: CoreStart, plugins: { alerting: AlertPluginStartContract }) {
-    return {
-      alerting: plugins.alerting,
-    };
-  }
+  public start(): RuleRegistryPluginStartContract {}
 
   public stop() {}
 }
diff --git a/x-pack/plugins/rule_registry/server/rule_data_client/index.ts b/x-pack/plugins/rule_registry/server/rule_data_client/index.ts
new file mode 100644
index 0000000000000..b110091515d19
--- /dev/null
+++ b/x-pack/plugins/rule_registry/server/rule_data_client/index.ts
@@ -0,0 +1,115 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { TypeMapping } from '@elastic/elasticsearch/api/types';
+import { ResponseError } from '@elastic/elasticsearch/lib/errors';
+import { IndexPatternsFetcher } from 'src/plugins/data/server';
+import {
+  IRuleDataClient,
+  RuleDataClientConstructorOptions,
+  RuleDataReader,
+  RuleDataWriter,
+} from './types';
+
+function getNamespacedAlias(options: { alias: string; namespace?: string }) {
+  return [options.alias, options.namespace].filter(Boolean).join('-');
+}
+
+export class RuleDataClient implements IRuleDataClient {
+  constructor(private readonly options: RuleDataClientConstructorOptions) {}
+
+  private async getClusterClient() {
+    const { clusterClient } = await this.options.ready();
+    return clusterClient;
+  }
+
+  getReader(): RuleDataReader {
+    return {
+      search: async (request) => {
+        const clusterClient = await this.getClusterClient();
+
+        return clusterClient.search({
+          ...request,
+          index: this.options.alias,
+        }) as Promise<any>;
+      },
+      getDynamicIndexPattern: async (pattern: string = this.options.alias) => {
+        const clusterClient = await this.getClusterClient();
+        const indexPatternsFetcher = new IndexPatternsFetcher(clusterClient);
+
+        const fields = await indexPatternsFetcher.getFieldsForWildcard({
+          pattern,
+        });
+
+        return {
+          fields,
+          timeFieldName: '@timestamp',
+          title: pattern,
+        };
+      },
+    };
+  }
+
+  getWriter(options: { namespace?: string } = {}): RuleDataWriter {
+    const { namespace } = options;
+    const alias = getNamespacedAlias({ alias: this.options.alias, namespace });
+    return {
+      bulk: async (request) => {
+        const clusterClient = await this.getClusterClient();
+
+        const requestWithDefaultParameters = {
+          ...request,
+          require_alias: true,
+          index: alias,
+        };
+
+        return clusterClient.bulk(requestWithDefaultParameters).catch((error) => {
+          if (error instanceof ResponseError && error.name === 'index_not_found_exception') {
+            return this.createOrUpdateWriteTarget({ namespace }).then(() => {
+              return clusterClient.bulk(requestWithDefaultParameters);
+            });
+          }
+          throw error;
+        });
+      },
+    };
+  }
+
+  async createOrUpdateWriteTarget({ namespace }: { namespace?: string }) {
+    const alias = getNamespacedAlias({ alias: this.options.alias, namespace });
+
+    const clusterClient = await this.getClusterClient();
+
+    const { body: aliasExists } = await clusterClient.indices.existsAlias({
+      name: alias,
+    });
+
+    const concreteIndexName = `${alias}-000001`;
+
+    if (!aliasExists) {
+      await clusterClient.indices.create({
+        index: concreteIndexName,
+        body: {
+          aliases: {
+            [alias]: {
+              is_write_index: true,
+            },
+          },
+        },
+      });
+    }
+
+    const { body: simulateResponse } = await clusterClient.transport.request({
+      method: 'POST',
+      path: `/_index_template/_simulate_index/${concreteIndexName}`,
+    });
+
+    const mappings: TypeMapping = simulateResponse.mappings;
+
+    await clusterClient.indices.putMapping({ index: `${alias}*`, body: mappings });
+  }
+}
diff --git a/x-pack/plugins/rule_registry/server/rule_data_client/types.ts b/x-pack/plugins/rule_registry/server/rule_data_client/types.ts
new file mode 100644
index 0000000000000..8868ee3dbb530
--- /dev/null
+++ b/x-pack/plugins/rule_registry/server/rule_data_client/types.ts
@@ -0,0 +1,43 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ApiResponse } from '@elastic/elasticsearch';
+import { BulkRequest, BulkResponse } from '@elastic/elasticsearch/api/types';
+import { ElasticsearchClient } from 'kibana/server';
+import { FieldDescriptor } from 'src/plugins/data/server';
+import { ESSearchRequest, ESSearchResponse } from 'typings/elasticsearch';
+import { TechnicalRuleDataFieldName } from '../../common/technical_rule_data_field_names';
+
+export interface RuleDataReader {
+  search<TSearchRequest extends ESSearchRequest>(
+    request: TSearchRequest
+  ): Promise<
+    ESSearchResponse<Partial<Record<TechnicalRuleDataFieldName, unknown[]>>, TSearchRequest>
+  >;
+  getDynamicIndexPattern(
+    target?: string
+  ): Promise<{
+    title: string;
+    timeFieldName: string;
+    fields: FieldDescriptor[];
+  }>;
+}
+
+export interface RuleDataWriter {
+  bulk(request: BulkRequest): Promise<ApiResponse<BulkResponse>>;
+}
+
+export interface IRuleDataClient {
+  getReader(): RuleDataReader;
+  getWriter(options?: { namespace?: string }): RuleDataWriter;
+  createOrUpdateWriteTarget(options: { namespace?: string }): Promise<void>;
+}
+
+export interface RuleDataClientConstructorOptions {
+  ready: () => Promise<{ clusterClient: ElasticsearchClient }>;
+  alias: string;
+}
diff --git a/x-pack/plugins/rule_registry/server/rule_data_plugin_service/index.ts b/x-pack/plugins/rule_registry/server/rule_data_plugin_service/index.ts
new file mode 100644
index 0000000000000..c11c3151a3259
--- /dev/null
+++ b/x-pack/plugins/rule_registry/server/rule_data_plugin_service/index.ts
@@ -0,0 +1,54 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ClusterPutComponentTemplate } from '@elastic/elasticsearch/api/requestParams';
+import { estypes } from '@elastic/elasticsearch';
+import { ElasticsearchClient, Logger } from 'kibana/server';
+import { ClusterPutComponentTemplateBody } from './types';
+import { DEFAULT_ASSET_NAMESPACE } from '../../common/assets';
+
+interface RuleDataPluginServiceConstructorOptions {
+  ready: () => Promise<{ clusterClient: ElasticsearchClient }>;
+  logger: Logger;
+  isWriteEnabled: boolean;
+  kibanaIndex: string;
+}
+
+export class RuleDataPluginService {
+  constructor(private readonly options: RuleDataPluginServiceConstructorOptions) {}
+
+  private async getClusterClient() {
+    const { clusterClient } = await this.options.ready();
+
+    return clusterClient;
+  }
+
+  async createOrUpdateComponentTemplate(
+    template: ClusterPutComponentTemplate<ClusterPutComponentTemplateBody>
+  ) {
+    const clusterClient = await this.getClusterClient();
+    return clusterClient.cluster.putComponentTemplate(template);
+  }
+
+  async createOrUpdateIndexTemplate(template: estypes.PutIndexTemplateRequest) {
+    const clusterClient = await this.getClusterClient();
+    return clusterClient.indices.putIndexTemplate(template);
+  }
+
+  async createOrUpdateLifecyclePolicy(policy: estypes.PutLifecycleRequest) {
+    const clusterClient = await this.getClusterClient();
+    return clusterClient.ilm.putLifecycle(policy);
+  }
+
+  isWriteEnabled(): boolean {
+    return this.options.isWriteEnabled;
+  }
+
+  getFullAssetName(assetName?: string) {
+    return [this.options.kibanaIndex, DEFAULT_ASSET_NAMESPACE, assetName].filter(Boolean).join('-');
+  }
+}
diff --git a/x-pack/plugins/apm/server/lib/alerts/create_apm_lifecycle_rule_type.ts b/x-pack/plugins/rule_registry/server/rule_data_plugin_service/types.ts
similarity index 53%
rename from x-pack/plugins/apm/server/lib/alerts/create_apm_lifecycle_rule_type.ts
rename to x-pack/plugins/rule_registry/server/rule_data_plugin_service/types.ts
index 8d250a5765cce..156622877aa24 100644
--- a/x-pack/plugins/apm/server/lib/alerts/create_apm_lifecycle_rule_type.ts
+++ b/x-pack/plugins/rule_registry/server/rule_data_plugin_service/types.ts
@@ -5,7 +5,13 @@
  * 2.0.
  */
 
-import { createLifecycleRuleTypeFactory } from '../../../../rule_registry/server';
-import { APMRuleRegistry } from '../../plugin';
+import { estypes } from '@elastic/elasticsearch';
 
-export const createAPMLifecycleRuleType = createLifecycleRuleTypeFactory<APMRuleRegistry>();
+export interface ClusterPutComponentTemplateBody {
+  template: {
+    settings: {
+      number_of_shards: number;
+    };
+    mappings: estypes.TypeMapping;
+  };
+}
diff --git a/x-pack/plugins/rule_registry/server/rule_registry/create_scoped_rule_registry_client/index.ts b/x-pack/plugins/rule_registry/server/rule_registry/create_scoped_rule_registry_client/index.ts
deleted file mode 100644
index 0d7735380b640..0000000000000
--- a/x-pack/plugins/rule_registry/server/rule_registry/create_scoped_rule_registry_client/index.ts
+++ /dev/null
@@ -1,179 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-import { Either, isLeft, isRight } from 'fp-ts/lib/Either';
-import { Errors } from 'io-ts';
-import { PathReporter } from 'io-ts/lib/PathReporter';
-import { Logger } from 'kibana/server';
-import { IScopedClusterClient as ScopedClusterClient } from 'src/core/server';
-import { castArray, compact } from 'lodash';
-import { ESSearchRequest } from 'typings/elasticsearch';
-import { IndexPatternsFetcher } from '../../../../../../src/plugins/data/server';
-import { ClusterClientAdapter } from '../../../../event_log/server';
-import { TypeOfFieldMap } from '../../../common';
-import { ScopedRuleRegistryClient, EventsOf } from './types';
-import { BaseRuleFieldMap } from '../../../common';
-import { RuleRegistry } from '..';
-
-const createPathReporterError = (either: Either<Errors, unknown>) => {
-  const error = new Error(`Failed to validate alert event`);
-  error.stack += '\n' + PathReporter.report(either).join('\n');
-  return error;
-};
-
-export function createScopedRuleRegistryClient<TFieldMap extends BaseRuleFieldMap>({
-  ruleUuids,
-  scopedClusterClient,
-  clusterClientAdapter,
-  indexAliasName,
-  indexTarget,
-  logger,
-  registry,
-  ruleData,
-}: {
-  ruleUuids: string[];
-  scopedClusterClient: ScopedClusterClient;
-  clusterClientAdapter: ClusterClientAdapter<{
-    body: TypeOfFieldMap<TFieldMap>;
-    index: string;
-  }>;
-  indexAliasName: string;
-  indexTarget: string;
-  logger: Logger;
-  registry: RuleRegistry<TFieldMap>;
-  ruleData?: {
-    rule: {
-      id: string;
-      uuid: string;
-      category: string;
-      name: string;
-    };
-    producer: string;
-    tags: string[];
-  };
-}): ScopedRuleRegistryClient<TFieldMap> {
-  const fieldmapType = registry.getFieldMapType();
-
-  const defaults = ruleData
-    ? {
-        'rule.uuid': ruleData.rule.uuid,
-        'rule.id': ruleData.rule.id,
-        'rule.name': ruleData.rule.name,
-        'rule.category': ruleData.rule.category,
-        'kibana.rac.producer': ruleData.producer,
-        tags: ruleData.tags,
-      }
-    : {};
-
-  const client: ScopedRuleRegistryClient<BaseRuleFieldMap> = {
-    search: async (searchRequest) => {
-      const fields = [
-        'rule.id',
-        ...(searchRequest.body?.fields ? castArray(searchRequest.body.fields) : []),
-      ];
-
-      const response = await scopedClusterClient.asInternalUser.search({
-        ...searchRequest,
-        index: indexTarget,
-        body: {
-          ...searchRequest.body,
-          query: {
-            bool: {
-              filter: [
-                { terms: { 'rule.uuid': ruleUuids } },
-                ...compact([searchRequest.body?.query]),
-              ],
-            },
-          },
-          fields,
-        },
-      });
-
-      return {
-        body: response.body as any,
-        events: compact(
-          response.body.hits.hits.map((hit) => {
-            const ruleTypeId: string = hit.fields!['rule.id'][0];
-
-            const registryOfType = registry.getRegistryByRuleTypeId(ruleTypeId);
-
-            if (ruleTypeId && !registryOfType) {
-              logger.warn(
-                `Could not find type ${ruleTypeId} in registry, decoding with default type`
-              );
-            }
-
-            const type = registryOfType?.getFieldMapType() ?? fieldmapType;
-
-            const validation = type.decode(hit.fields);
-            if (isLeft(validation)) {
-              const error = createPathReporterError(validation);
-              logger.error(error);
-              return undefined;
-            }
-            return type.encode(validation.right);
-          })
-        ) as EventsOf<ESSearchRequest, TFieldMap>,
-      };
-    },
-    getDynamicIndexPattern: async () => {
-      const indexPatternsFetcher = new IndexPatternsFetcher(scopedClusterClient.asInternalUser);
-
-      const fields = await indexPatternsFetcher.getFieldsForWildcard({
-        pattern: indexTarget,
-      });
-
-      return {
-        fields,
-        timeFieldName: '@timestamp',
-        title: indexTarget,
-      };
-    },
-    index: (doc) => {
-      const validation = fieldmapType.decode({
-        ...doc,
-        ...defaults,
-      });
-
-      if (isLeft(validation)) {
-        throw createPathReporterError(validation);
-      }
-
-      clusterClientAdapter.indexDocument({
-        body: validation.right,
-        index: indexAliasName,
-      });
-    },
-    bulkIndex: (docs) => {
-      const validations = docs.map((doc) => {
-        return fieldmapType.decode({
-          ...doc,
-          ...defaults,
-        });
-      });
-
-      const errors = compact(
-        validations.map((validation) =>
-          isLeft(validation) ? createPathReporterError(validation) : null
-        )
-      );
-
-      errors.forEach((error) => {
-        logger.error(error);
-      });
-
-      const operations = compact(
-        validations.map((validation) => (isRight(validation) ? validation.right : null))
-      ).map((doc) => ({ body: doc, index: indexAliasName }));
-
-      return clusterClientAdapter.indexDocuments(operations);
-    },
-  };
-
-  // @ts-expect-error: We can't use ScopedRuleRegistryClient<BaseRuleFieldMap>
-  // when creating the client, due to #41693 which will be fixed in 4.2
-  return client;
-}
diff --git a/x-pack/plugins/rule_registry/server/rule_registry/create_scoped_rule_registry_client/types.ts b/x-pack/plugins/rule_registry/server/rule_registry/create_scoped_rule_registry_client/types.ts
deleted file mode 100644
index f7b2394fe3a32..0000000000000
--- a/x-pack/plugins/rule_registry/server/rule_registry/create_scoped_rule_registry_client/types.ts
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { FieldDescriptor } from 'src/plugins/data/server';
-import { ESSearchRequest, ESSearchResponse } from 'typings/elasticsearch';
-import {
-  PatternsUnionOf,
-  PickWithPatterns,
-  OutputOfFieldMap,
-  BaseRuleFieldMap,
-} from '../../../common';
-
-export type PrepopulatedRuleEventFields = keyof Pick<
-  BaseRuleFieldMap,
-  'rule.uuid' | 'rule.id' | 'rule.name' | 'rule.category' | 'kibana.rac.producer'
->;
-
-type FieldsOf<TFieldMap extends BaseRuleFieldMap> =
-  | Array<{ field: PatternsUnionOf<TFieldMap> } | PatternsUnionOf<TFieldMap>>
-  | PatternsUnionOf<TFieldMap>;
-
-type Fields<TPattern extends string> = Array<{ field: TPattern } | TPattern> | TPattern;
-
-type FieldsESSearchRequest<TFieldMap extends BaseRuleFieldMap> = ESSearchRequest & {
-  body?: { fields: FieldsOf<TFieldMap> };
-};
-
-export type EventsOf<
-  TFieldsESSearchRequest extends ESSearchRequest,
-  TFieldMap extends BaseRuleFieldMap
-> = TFieldsESSearchRequest extends { body: { fields: infer TFields } }
-  ? TFields extends Fields<infer TPattern>
-    ? Array<OutputOfFieldMap<PickWithPatterns<TFieldMap, TPattern[]>>>
-    : never
-  : never;
-
-export interface ScopedRuleRegistryClient<TFieldMap extends BaseRuleFieldMap> {
-  search<TSearchRequest extends FieldsESSearchRequest<TFieldMap>>(
-    request: TSearchRequest
-  ): Promise<{
-    body: ESSearchResponse<unknown, TSearchRequest>;
-    events: EventsOf<TSearchRequest, TFieldMap>;
-  }>;
-  getDynamicIndexPattern(): Promise<{
-    title: string;
-    timeFieldName: string;
-    fields: FieldDescriptor[];
-  }>;
-  index(doc: Omit<OutputOfFieldMap<TFieldMap>, PrepopulatedRuleEventFields>): void;
-  bulkIndex(
-    doc: Array<Omit<OutputOfFieldMap<TFieldMap>, PrepopulatedRuleEventFields>>
-  ): Promise<void>;
-}
diff --git a/x-pack/plugins/rule_registry/server/rule_registry/index.ts b/x-pack/plugins/rule_registry/server/rule_registry/index.ts
deleted file mode 100644
index 9fc15e9322e2a..0000000000000
--- a/x-pack/plugins/rule_registry/server/rule_registry/index.ts
+++ /dev/null
@@ -1,329 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { CoreSetup, Logger, RequestHandlerContext } from 'kibana/server';
-import { inspect } from 'util';
-import { AlertsClient } from '../../../alerting/server';
-import { SpacesServiceStart } from '../../../spaces/server';
-import {
-  ActionVariable,
-  AlertInstanceState,
-  AlertTypeParams,
-  AlertTypeState,
-} from '../../../alerting/common';
-import { createReadySignal, ClusterClientAdapter } from '../../../event_log/server';
-import { ILMPolicy } from './types';
-import { RuleParams, RuleType } from '../types';
-import {
-  mergeFieldMaps,
-  TypeOfFieldMap,
-  FieldMap,
-  FieldMapType,
-  BaseRuleFieldMap,
-  runtimeTypeFromFieldMap,
-} from '../../common';
-import { mappingFromFieldMap } from './field_map/mapping_from_field_map';
-import { PluginSetupContract as AlertingPluginSetupContract } from '../../../alerting/server';
-import { createScopedRuleRegistryClient } from './create_scoped_rule_registry_client';
-import { ScopedRuleRegistryClient } from './create_scoped_rule_registry_client/types';
-
-interface RuleRegistryOptions<TFieldMap extends FieldMap> {
-  kibanaIndex: string;
-  kibanaVersion: string;
-  name: string;
-  logger: Logger;
-  coreSetup: CoreSetup;
-  spacesStart?: SpacesServiceStart;
-  fieldMap: TFieldMap;
-  ilmPolicy: ILMPolicy;
-  alertingPluginSetupContract: AlertingPluginSetupContract;
-  writeEnabled: boolean;
-}
-
-export class RuleRegistry<TFieldMap extends BaseRuleFieldMap> {
-  private readonly esAdapter: ClusterClientAdapter<{
-    body: TypeOfFieldMap<TFieldMap>;
-    index: string;
-  }>;
-  private readonly children: Array<RuleRegistry<TFieldMap>> = [];
-  private readonly types: Array<RuleType<TFieldMap, any, any>> = [];
-
-  private readonly fieldmapType: FieldMapType<TFieldMap>;
-
-  constructor(private readonly options: RuleRegistryOptions<TFieldMap>) {
-    const { logger, coreSetup } = options;
-
-    this.fieldmapType = runtimeTypeFromFieldMap(options.fieldMap);
-
-    const { wait, signal } = createReadySignal<boolean>();
-
-    this.esAdapter = new ClusterClientAdapter<{
-      body: TypeOfFieldMap<TFieldMap>;
-      index: string;
-    }>({
-      wait,
-      elasticsearchClientPromise: coreSetup
-        .getStartServices()
-        .then(([{ elasticsearch }]) => elasticsearch.client.asInternalUser),
-      logger: logger.get('esAdapter'),
-    });
-
-    if (this.options.writeEnabled) {
-      this.initialize()
-        .then(() => {
-          this.options.logger.debug('Bootstrapped alerts index');
-          signal(true);
-        })
-        .catch((err) => {
-          logger.error(inspect(err, { depth: null }));
-          signal(false);
-        });
-    } else {
-      logger.debug('Write disabled, indices are not being bootstrapped');
-    }
-  }
-
-  private getEsNames() {
-    const base = [this.options.kibanaIndex, this.options.name];
-    const indexTarget = `${base.join('-')}*`;
-    const indexAliasName = [...base, this.options.kibanaVersion.toLowerCase()].join('-');
-    const policyName = [...base, 'policy'].join('-');
-
-    return {
-      indexAliasName,
-      indexTarget,
-      policyName,
-    };
-  }
-
-  private async initialize() {
-    const { indexAliasName, policyName } = this.getEsNames();
-
-    const ilmPolicyExists = await this.esAdapter.doesIlmPolicyExist(policyName);
-
-    if (!ilmPolicyExists) {
-      await this.esAdapter.createIlmPolicy(
-        policyName,
-        (this.options.ilmPolicy as unknown) as Record<string, unknown>
-      );
-    }
-
-    const templateExists = await this.esAdapter.doesIndexTemplateExist(indexAliasName);
-
-    const mappings = mappingFromFieldMap(this.options.fieldMap);
-
-    const esClient = (await this.options.coreSetup.getStartServices())[0].elasticsearch.client
-      .asInternalUser;
-
-    if (!templateExists) {
-      await this.esAdapter.createIndexTemplate(indexAliasName, {
-        index_patterns: [`${indexAliasName}-*`],
-        settings: {
-          number_of_shards: 1,
-          auto_expand_replicas: '0-1',
-          'index.lifecycle.name': policyName,
-          'index.lifecycle.rollover_alias': indexAliasName,
-          'sort.field': '@timestamp',
-          'sort.order': 'desc',
-        },
-        mappings,
-      });
-    } else {
-      await esClient.indices.putTemplate({
-        name: indexAliasName,
-        body: {
-          index_patterns: [`${indexAliasName}-*`],
-          mappings,
-        },
-        create: false,
-      });
-    }
-
-    const aliasExists = await this.esAdapter.doesAliasExist(indexAliasName);
-
-    if (!aliasExists) {
-      await this.esAdapter.createIndex(`${indexAliasName}-000001`, {
-        aliases: {
-          [indexAliasName]: {
-            is_write_index: true,
-          },
-        },
-      });
-    } else {
-      const { body: aliases } = (await esClient.indices.getAlias({
-        index: indexAliasName,
-      })) as { body: Record<string, { aliases: Record<string, { is_write_index: boolean }> }> };
-
-      const writeIndex = Object.entries(aliases).find(
-        ([indexName, alias]) => alias.aliases[indexAliasName]?.is_write_index === true
-      )![0];
-
-      const { body: fieldsInWriteIndex } = await esClient.fieldCaps({
-        index: writeIndex,
-        fields: '*',
-      });
-
-      const fieldsNotOrDifferentInIndex = Object.entries(this.options.fieldMap).filter(
-        ([fieldName, descriptor]) => {
-          return (
-            !fieldsInWriteIndex.fields[fieldName] ||
-            !fieldsInWriteIndex.fields[fieldName][descriptor.type]
-          );
-        }
-      );
-
-      if (fieldsNotOrDifferentInIndex.length > 0) {
-        this.options.logger.debug(
-          `Some fields were not found in write index mapping: ${Object.keys(
-            Object.fromEntries(fieldsNotOrDifferentInIndex)
-          ).join(',')}`
-        );
-        this.options.logger.info(`Updating index mapping due to new fields`);
-
-        await esClient.indices.putMapping({
-          index: indexAliasName,
-          body: mappings,
-        });
-      }
-    }
-  }
-
-  getFieldMapType() {
-    return this.fieldmapType;
-  }
-
-  getRuleTypeById(ruleTypeId: string) {
-    return this.types.find((type) => type.id === ruleTypeId);
-  }
-
-  getRegistryByRuleTypeId(ruleTypeId: string): RuleRegistry<TFieldMap> | undefined {
-    if (this.getRuleTypeById(ruleTypeId)) {
-      return this;
-    }
-
-    return this.children.find((child) => child.getRegistryByRuleTypeId(ruleTypeId));
-  }
-
-  async createScopedRuleRegistryClient({
-    context,
-    alertsClient,
-  }: {
-    context: RequestHandlerContext;
-    alertsClient: AlertsClient;
-  }): Promise<ScopedRuleRegistryClient<TFieldMap> | undefined> {
-    if (!this.options.writeEnabled) {
-      return undefined;
-    }
-    const { indexAliasName, indexTarget } = this.getEsNames();
-
-    const frameworkAlerts = (
-      await alertsClient.find({
-        options: {
-          perPage: 1000,
-        },
-      })
-    ).data;
-
-    return createScopedRuleRegistryClient({
-      ruleUuids: frameworkAlerts.map((frameworkAlert) => frameworkAlert.id),
-      scopedClusterClient: context.core.elasticsearch.client,
-      clusterClientAdapter: this.esAdapter,
-      registry: this,
-      indexAliasName,
-      indexTarget,
-      logger: this.options.logger,
-    });
-  }
-
-  registerType<TRuleParams extends RuleParams, TActionVariable extends ActionVariable>(
-    type: RuleType<TFieldMap, TRuleParams, TActionVariable>
-  ) {
-    const logger = this.options.logger.get(type.id);
-
-    const { indexAliasName, indexTarget } = this.getEsNames();
-
-    this.types.push(type);
-
-    this.options.alertingPluginSetupContract.registerType<
-      AlertTypeParams,
-      AlertTypeState,
-      AlertInstanceState,
-      { [key in TActionVariable['name']]: any },
-      string
-    >({
-      ...type,
-      executor: async (executorOptions) => {
-        const { services, alertId, name, tags } = executorOptions;
-
-        const rule = {
-          id: type.id,
-          uuid: alertId,
-          category: type.name,
-          name,
-        };
-
-        const producer = type.producer;
-
-        return type.executor({
-          ...executorOptions,
-          rule,
-          producer,
-          services: {
-            ...services,
-            logger,
-            ...(this.options.writeEnabled
-              ? {
-                  scopedRuleRegistryClient: createScopedRuleRegistryClient({
-                    scopedClusterClient: services.scopedClusterClient,
-                    ruleUuids: [rule.uuid],
-                    clusterClientAdapter: this.esAdapter,
-                    registry: this,
-                    indexAliasName,
-                    indexTarget,
-                    ruleData: {
-                      producer,
-                      rule,
-                      tags,
-                    },
-                    logger: this.options.logger,
-                  }),
-                }
-              : {}),
-          },
-        });
-      },
-    });
-  }
-
-  create<TNextFieldMap extends FieldMap>({
-    name,
-    fieldMap,
-    ilmPolicy,
-  }: {
-    name: string;
-    fieldMap: TNextFieldMap;
-    ilmPolicy?: ILMPolicy;
-  }): RuleRegistry<TFieldMap & TNextFieldMap> {
-    const mergedFieldMap = fieldMap
-      ? mergeFieldMaps(this.options.fieldMap, fieldMap)
-      : this.options.fieldMap;
-
-    const child = new RuleRegistry({
-      ...this.options,
-      logger: this.options.logger.get(name),
-      name: [this.options.name, name].filter(Boolean).join('-'),
-      fieldMap: mergedFieldMap,
-      ...(ilmPolicy ? { ilmPolicy } : {}),
-      writeEnabled: true,
-    });
-
-    this.children.push(child);
-
-    // @ts-expect-error could be instantiated with a different subtype of constraint
-    return child;
-  }
-}
diff --git a/x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_lifecycle_rule_type_factory.ts b/x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_lifecycle_rule_type_factory.ts
deleted file mode 100644
index 65eaf0964cfca..0000000000000
--- a/x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_lifecycle_rule_type_factory.ts
+++ /dev/null
@@ -1,235 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-import * as t from 'io-ts';
-import { isLeft } from 'fp-ts/lib/Either';
-import v4 from 'uuid/v4';
-import { Mutable } from 'utility-types';
-import { AlertInstance } from '../../../../alerting/server';
-import { ActionVariable, AlertInstanceState } from '../../../../alerting/common';
-import { RuleParams, RuleType } from '../../types';
-import { BaseRuleFieldMap, OutputOfFieldMap } from '../../../common';
-import { PrepopulatedRuleEventFields } from '../create_scoped_rule_registry_client/types';
-import { RuleRegistry } from '..';
-
-type UserDefinedAlertFields<TFieldMap extends BaseRuleFieldMap> = Omit<
-  OutputOfFieldMap<TFieldMap>,
-  PrepopulatedRuleEventFields | 'kibana.rac.alert.id' | 'kibana.rac.alert.uuid' | '@timestamp'
->;
-
-type LifecycleAlertService<
-  TFieldMap extends BaseRuleFieldMap,
-  TActionVariable extends ActionVariable
-> = (alert: {
-  id: string;
-  fields: UserDefinedAlertFields<TFieldMap>;
-}) => AlertInstance<AlertInstanceState, { [key in TActionVariable['name']]: any }, string>;
-
-type CreateLifecycleRuleType<TFieldMap extends BaseRuleFieldMap> = <
-  TRuleParams extends RuleParams,
-  TActionVariable extends ActionVariable
->(
-  type: RuleType<
-    TFieldMap,
-    TRuleParams,
-    TActionVariable,
-    { alertWithLifecycle: LifecycleAlertService<TFieldMap, TActionVariable> }
-  >
-) => RuleType<TFieldMap, TRuleParams, TActionVariable>;
-
-const trackedAlertStateRt = t.type({
-  alertId: t.string,
-  alertUuid: t.string,
-  started: t.string,
-});
-
-const wrappedStateRt = t.type({
-  wrapped: t.record(t.string, t.unknown),
-  trackedAlerts: t.record(t.string, trackedAlertStateRt),
-});
-
-export function createLifecycleRuleTypeFactory<
-  TRuleRegistry extends RuleRegistry<BaseRuleFieldMap>
->(): TRuleRegistry extends RuleRegistry<infer TFieldMap>
-  ? CreateLifecycleRuleType<TFieldMap>
-  : never;
-
-export function createLifecycleRuleTypeFactory(): CreateLifecycleRuleType<BaseRuleFieldMap> {
-  return (type) => {
-    return {
-      ...type,
-      executor: async (options) => {
-        const {
-          services: { scopedRuleRegistryClient, alertInstanceFactory, logger },
-          state: previousState,
-          rule,
-        } = options;
-
-        const decodedState = wrappedStateRt.decode(previousState);
-
-        const state = isLeft(decodedState)
-          ? {
-              wrapped: previousState,
-              trackedAlerts: {},
-            }
-          : decodedState.right;
-
-        const currentAlerts: Record<
-          string,
-          UserDefinedAlertFields<BaseRuleFieldMap> & { 'kibana.rac.alert.id': string }
-        > = {};
-
-        const timestamp = options.startedAt.toISOString();
-
-        const nextWrappedState = await type.executor({
-          ...options,
-          state: state.wrapped,
-          services: {
-            ...options.services,
-            alertWithLifecycle: ({ id, fields }) => {
-              currentAlerts[id] = {
-                ...fields,
-                'kibana.rac.alert.id': id,
-              };
-              return alertInstanceFactory(id);
-            },
-          },
-        });
-
-        const currentAlertIds = Object.keys(currentAlerts);
-        const trackedAlertIds = Object.keys(state.trackedAlerts);
-        const newAlertIds = currentAlertIds.filter((alertId) => !trackedAlertIds.includes(alertId));
-
-        const allAlertIds = [...new Set(currentAlertIds.concat(trackedAlertIds))];
-
-        const trackedAlertStatesOfRecovered = Object.values(state.trackedAlerts).filter(
-          (trackedAlertState) => !currentAlerts[trackedAlertState.alertId]
-        );
-
-        logger.debug(
-          `Tracking ${allAlertIds.length} alerts (${newAlertIds.length} new, ${trackedAlertStatesOfRecovered.length} recovered)`
-        );
-
-        const alertsDataMap: Record<string, UserDefinedAlertFields<BaseRuleFieldMap>> = {
-          ...currentAlerts,
-        };
-
-        if (scopedRuleRegistryClient && trackedAlertStatesOfRecovered.length) {
-          const { events } = await scopedRuleRegistryClient.search({
-            body: {
-              query: {
-                bool: {
-                  filter: [
-                    {
-                      term: {
-                        'rule.uuid': rule.uuid,
-                      },
-                    },
-                    {
-                      terms: {
-                        'kibana.rac.alert.uuid': trackedAlertStatesOfRecovered.map(
-                          (trackedAlertState) => trackedAlertState.alertUuid
-                        ),
-                      },
-                    },
-                  ],
-                },
-              },
-              size: trackedAlertStatesOfRecovered.length,
-              collapse: {
-                field: 'kibana.rac.alert.uuid',
-              },
-              _source: false,
-              fields: ['*'],
-              sort: {
-                '@timestamp': 'desc' as const,
-              },
-            },
-          });
-
-          events.forEach((event) => {
-            const alertId = event['kibana.rac.alert.id']!;
-            alertsDataMap[alertId] = event;
-          });
-        }
-
-        const eventsToIndex: Array<OutputOfFieldMap<BaseRuleFieldMap>> = allAlertIds.map(
-          (alertId) => {
-            const alertData = alertsDataMap[alertId];
-
-            if (!alertData) {
-              logger.warn(`Could not find alert data for ${alertId}`);
-            }
-
-            const event: Mutable<OutputOfFieldMap<BaseRuleFieldMap>> = {
-              ...alertData,
-              '@timestamp': timestamp,
-              'event.kind': 'state',
-              'kibana.rac.alert.id': alertId,
-            };
-
-            const isNew = !state.trackedAlerts[alertId];
-            const isRecovered = !currentAlerts[alertId];
-            const isActiveButNotNew = !isNew && !isRecovered;
-            const isActive = !isRecovered;
-
-            const { alertUuid, started } = state.trackedAlerts[alertId] ?? {
-              alertUuid: v4(),
-              started: timestamp,
-            };
-
-            event['kibana.rac.alert.start'] = started;
-            event['kibana.rac.alert.uuid'] = alertUuid;
-
-            if (isNew) {
-              event['event.action'] = 'open';
-            }
-
-            if (isRecovered) {
-              event['kibana.rac.alert.end'] = timestamp;
-              event['event.action'] = 'close';
-              event['kibana.rac.alert.status'] = 'closed';
-            }
-
-            if (isActiveButNotNew) {
-              event['event.action'] = 'active';
-            }
-
-            if (isActive) {
-              event['kibana.rac.alert.status'] = 'open';
-            }
-
-            event['kibana.rac.alert.duration.us'] =
-              (options.startedAt.getTime() - new Date(event['kibana.rac.alert.start']!).getTime()) *
-              1000;
-
-            return event;
-          }
-        );
-
-        if (eventsToIndex.length && scopedRuleRegistryClient) {
-          await scopedRuleRegistryClient.bulkIndex(eventsToIndex);
-        }
-
-        const nextTrackedAlerts = Object.fromEntries(
-          eventsToIndex
-            .filter((event) => event['kibana.rac.alert.status'] !== 'closed')
-            .map((event) => {
-              const alertId = event['kibana.rac.alert.id']!;
-              const alertUuid = event['kibana.rac.alert.uuid']!;
-              const started = new Date(event['kibana.rac.alert.start']!).toISOString();
-              return [alertId, { alertId, alertUuid, started }];
-            })
-        );
-
-        return {
-          wrapped: nextWrappedState,
-          trackedAlerts: nextTrackedAlerts,
-        };
-      },
-    };
-  };
-}
diff --git a/x-pack/plugins/rule_registry/server/rule_registry/types.ts b/x-pack/plugins/rule_registry/server/rule_registry/types.ts
deleted file mode 100644
index ec7293d1c1d4c..0000000000000
--- a/x-pack/plugins/rule_registry/server/rule_registry/types.ts
+++ /dev/null
@@ -1,42 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export interface Mappings {
-  dynamic: 'strict' | boolean;
-  properties: Record<string, { type: string } | Mappings>;
-}
-
-enum ILMPolicyPhase {
-  hot = 'hot',
-  delete = 'delete',
-}
-
-enum ILMPolicyAction {
-  rollover = 'rollover',
-  delete = 'delete',
-}
-
-interface ILMActionOptions {
-  [ILMPolicyAction.rollover]: {
-    max_size: string;
-    max_age: string;
-  };
-  [ILMPolicyAction.delete]: {};
-}
-
-export interface ILMPolicy {
-  policy: {
-    phases: Record<
-      ILMPolicyPhase,
-      {
-        actions: {
-          [key in keyof ILMActionOptions]?: ILMActionOptions[key];
-        };
-      }
-    >;
-  };
-}
diff --git a/x-pack/plugins/rule_registry/server/types.ts b/x-pack/plugins/rule_registry/server/types.ts
index 0a207217eadb5..959c05fd1334e 100644
--- a/x-pack/plugins/rule_registry/server/types.ts
+++ b/x-pack/plugins/rule_registry/server/types.ts
@@ -4,97 +4,37 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-import { Type, TypeOf } from '@kbn/config-schema';
-import { Logger } from 'kibana/server';
+
 import {
-  ActionVariable,
   AlertInstanceContext,
   AlertInstanceState,
   AlertTypeParams,
   AlertTypeState,
 } from '../../alerting/common';
-import { ActionGroup, AlertExecutorOptions } from '../../alerting/server';
-import { RuleRegistry } from './rule_registry';
-import { BaseRuleFieldMap } from '../common';
-import { ScopedRuleRegistryClient } from './rule_registry/create_scoped_rule_registry_client/types';
-
-export type RuleParams = Type<any>;
+import { AlertType } from '../../alerting/server';
 
-type TypeOfRuleParams<TRuleParams extends RuleParams> = TypeOf<TRuleParams>;
+type SimpleAlertType<
+  TParams extends AlertTypeParams = {},
+  TAlertInstanceContext extends AlertInstanceContext = {}
+> = AlertType<TParams, AlertTypeState, AlertInstanceState, TAlertInstanceContext, string, string>;
 
-type RuleExecutorServices<
-  TFieldMap extends BaseRuleFieldMap,
-  TActionVariable extends ActionVariable
-> = AlertExecutorOptions<
-  AlertTypeParams,
-  AlertTypeState,
-  AlertInstanceState,
-  { [key in TActionVariable['name']]: any },
-  string
->['services'] & {
-  logger: Logger;
-  scopedRuleRegistryClient?: ScopedRuleRegistryClient<TFieldMap>;
-};
-
-type PassthroughAlertExecutorOptions = Pick<
-  AlertExecutorOptions<
-    AlertTypeParams,
-    AlertTypeState,
-    AlertInstanceState,
-    AlertInstanceContext,
-    string
-  >,
-  'previousStartedAt' | 'startedAt' | 'state'
->;
-
-type RuleExecutorFunction<
-  TFieldMap extends BaseRuleFieldMap,
-  TRuleParams extends RuleParams,
-  TActionVariable extends ActionVariable,
-  TAdditionalRuleExecutorServices extends Record<string, any>
+export type AlertTypeExecutor<
+  TParams extends AlertTypeParams = {},
+  TAlertInstanceContext extends AlertInstanceContext = {},
+  TServices extends Record<string, any> = {}
 > = (
-  options: PassthroughAlertExecutorOptions & {
-    services: RuleExecutorServices<TFieldMap, TActionVariable> & TAdditionalRuleExecutorServices;
-    params: TypeOfRuleParams<TRuleParams>;
-    rule: {
-      id: string;
-      uuid: string;
-      name: string;
-      category: string;
-    };
-    producer: string;
+  options: Parameters<SimpleAlertType<TParams, TAlertInstanceContext>['executor']>[0] & {
+    services: TServices;
   }
-) => Promise<Record<string, any>>;
-
-interface RuleTypeBase {
-  id: string;
-  name: string;
-  actionGroups: Array<ActionGroup<string>>;
-  defaultActionGroupId: string;
-  producer: string;
-  minimumLicenseRequired: 'basic' | 'gold' | 'trial';
-}
-
-export type RuleType<
-  TFieldMap extends BaseRuleFieldMap,
-  TRuleParams extends RuleParams,
-  TActionVariable extends ActionVariable,
-  TAdditionalRuleExecutorServices extends Record<string, any> = {}
-> = RuleTypeBase & {
-  validate: {
-    params: TRuleParams;
-  };
-  actionVariables: {
-    context: TActionVariable[];
-  };
-  executor: RuleExecutorFunction<
-    TFieldMap,
-    TRuleParams,
-    TActionVariable,
-    TAdditionalRuleExecutorServices
-  >;
+) => Promise<any>;
+
+export type AlertTypeWithExecutor<
+  TParams extends AlertTypeParams = {},
+  TAlertInstanceContext extends AlertInstanceContext = {},
+  TServices extends Record<string, any> = {}
+> = Omit<
+  AlertType<TParams, AlertTypeState, AlertInstanceState, TAlertInstanceContext, string, string>,
+  'executor'
+> & {
+  executor: AlertTypeExecutor<TParams, TAlertInstanceContext, TServices>;
 };
-
-export type FieldMapOf<
-  TRuleRegistry extends RuleRegistry<any>
-> = TRuleRegistry extends RuleRegistry<infer TFieldMap> ? TFieldMap : never;
diff --git a/x-pack/plugins/rule_registry/server/utils/create_lifecycle_rule_type_factory.ts b/x-pack/plugins/rule_registry/server/utils/create_lifecycle_rule_type_factory.ts
new file mode 100644
index 0000000000000..ecb3518acc994
--- /dev/null
+++ b/x-pack/plugins/rule_registry/server/utils/create_lifecycle_rule_type_factory.ts
@@ -0,0 +1,244 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { Logger } from '@kbn/logging';
+import { isLeft } from 'fp-ts/lib/Either';
+import * as t from 'io-ts';
+import { Mutable } from 'utility-types';
+import v4 from 'uuid/v4';
+import { AlertInstance } from '../../../alerting/server';
+import { RuleDataClient } from '..';
+import {
+  AlertInstanceContext,
+  AlertInstanceState,
+  AlertTypeParams,
+} from '../../../alerting/common';
+import {
+  ALERT_DURATION,
+  ALERT_END,
+  ALERT_ID,
+  ALERT_START,
+  ALERT_STATUS,
+  ALERT_UUID,
+  EVENT_ACTION,
+  EVENT_KIND,
+  RULE_UUID,
+  TIMESTAMP,
+} from '../../common/technical_rule_data_field_names';
+import { AlertTypeWithExecutor } from '../types';
+import { ParsedTechnicalFields, parseTechnicalFields } from './parse_technical_fields';
+import { getRuleExecutorData } from './get_rule_executor_data';
+
+type LifecycleAlertService<TAlertInstanceContext extends Record<string, unknown>> = (alert: {
+  id: string;
+  fields: Record<string, unknown>;
+}) => AlertInstance<AlertInstanceState, TAlertInstanceContext, string>;
+
+const trackedAlertStateRt = t.type({
+  alertId: t.string,
+  alertUuid: t.string,
+  started: t.string,
+});
+
+const wrappedStateRt = t.type({
+  wrapped: t.record(t.string, t.unknown),
+  trackedAlerts: t.record(t.string, trackedAlertStateRt),
+});
+
+type CreateLifecycleRuleTypeFactory = (options: {
+  ruleDataClient: RuleDataClient;
+  logger: Logger;
+}) => <
+  TParams extends AlertTypeParams,
+  TAlertInstanceContext extends AlertInstanceContext,
+  TServices extends { alertWithLifecycle: LifecycleAlertService<TAlertInstanceContext> }
+>(
+  type: AlertTypeWithExecutor<TParams, TAlertInstanceContext, TServices>
+) => AlertTypeWithExecutor<TParams, TAlertInstanceContext, any>;
+
+export const createLifecycleRuleTypeFactory: CreateLifecycleRuleTypeFactory = ({
+  logger,
+  ruleDataClient,
+}) => (type) => {
+  return {
+    ...type,
+    executor: async (options) => {
+      const {
+        services: { alertInstanceFactory },
+        state: previousState,
+      } = options;
+
+      const ruleData = getRuleExecutorData(type, options);
+
+      const decodedState = wrappedStateRt.decode(previousState);
+
+      const state = isLeft(decodedState)
+        ? {
+            wrapped: previousState,
+            trackedAlerts: {},
+          }
+        : decodedState.right;
+
+      const currentAlerts: Record<string, { [ALERT_ID]: string }> = {};
+
+      const timestamp = options.startedAt.toISOString();
+
+      const nextWrappedState = await type.executor({
+        ...options,
+        state: state.wrapped,
+        services: {
+          ...options.services,
+          alertWithLifecycle: ({ id, fields }) => {
+            currentAlerts[id] = {
+              ...fields,
+              [ALERT_ID]: id,
+            };
+            return alertInstanceFactory(id);
+          },
+        },
+      });
+
+      const currentAlertIds = Object.keys(currentAlerts);
+      const trackedAlertIds = Object.keys(state.trackedAlerts);
+      const newAlertIds = currentAlertIds.filter((alertId) => !trackedAlertIds.includes(alertId));
+
+      const allAlertIds = [...new Set(currentAlertIds.concat(trackedAlertIds))];
+
+      const trackedAlertStatesOfRecovered = Object.values(state.trackedAlerts).filter(
+        (trackedAlertState) => !currentAlerts[trackedAlertState.alertId]
+      );
+
+      logger.debug(
+        `Tracking ${allAlertIds.length} alerts (${newAlertIds.length} new, ${trackedAlertStatesOfRecovered.length} recovered)`
+      );
+
+      const alertsDataMap: Record<
+        string,
+        {
+          [ALERT_ID]: string;
+        }
+      > = {
+        ...currentAlerts,
+      };
+
+      if (trackedAlertStatesOfRecovered.length) {
+        const { hits } = await ruleDataClient.getReader().search({
+          body: {
+            query: {
+              bool: {
+                filter: [
+                  {
+                    term: {
+                      [RULE_UUID]: ruleData[RULE_UUID],
+                    },
+                  },
+                  {
+                    terms: {
+                      [ALERT_UUID]: trackedAlertStatesOfRecovered.map(
+                        (trackedAlertState) => trackedAlertState.alertUuid
+                      ),
+                    },
+                  },
+                ],
+              },
+            },
+            size: trackedAlertStatesOfRecovered.length,
+            collapse: {
+              field: ALERT_UUID,
+            },
+            _source: false,
+            fields: [{ field: '*', include_unmapped: true }],
+            sort: {
+              [TIMESTAMP]: 'desc' as const,
+            },
+          },
+        });
+
+        hits.hits.forEach((hit) => {
+          const fields = parseTechnicalFields(hit.fields);
+          const alertId = fields[ALERT_ID]!;
+          alertsDataMap[alertId] = {
+            ...fields,
+            [ALERT_ID]: alertId,
+          };
+        });
+      }
+
+      const eventsToIndex = allAlertIds.map((alertId) => {
+        const alertData = alertsDataMap[alertId];
+
+        if (!alertData) {
+          logger.warn(`Could not find alert data for ${alertId}`);
+        }
+
+        const event: Mutable<ParsedTechnicalFields> = {
+          ...alertData,
+          [TIMESTAMP]: timestamp,
+          [EVENT_KIND]: 'state',
+          [ALERT_ID]: alertId,
+        };
+
+        const isNew = !state.trackedAlerts[alertId];
+        const isRecovered = !currentAlerts[alertId];
+        const isActiveButNotNew = !isNew && !isRecovered;
+        const isActive = !isRecovered;
+
+        const { alertUuid, started } = state.trackedAlerts[alertId] ?? {
+          alertUuid: v4(),
+          started: timestamp,
+        };
+
+        event[ALERT_START] = started;
+        event[ALERT_UUID] = alertUuid;
+
+        if (isNew) {
+          event[EVENT_ACTION] = 'open';
+        }
+
+        if (isRecovered) {
+          event[ALERT_END] = timestamp;
+          event[EVENT_ACTION] = 'close';
+          event[ALERT_STATUS] = 'closed';
+        }
+
+        if (isActiveButNotNew) {
+          event[EVENT_ACTION] = 'active';
+        }
+
+        if (isActive) {
+          event[ALERT_STATUS] = 'open';
+        }
+
+        event[ALERT_DURATION] =
+          (options.startedAt.getTime() - new Date(event[ALERT_START]!).getTime()) * 1000;
+
+        return event;
+      });
+
+      if (eventsToIndex.length) {
+        await ruleDataClient.getWriter().bulk({
+          body: eventsToIndex.flatMap((event) => [{ index: {} }, event]),
+        });
+      }
+
+      const nextTrackedAlerts = Object.fromEntries(
+        eventsToIndex
+          .filter((event) => event[ALERT_STATUS] !== 'closed')
+          .map((event) => {
+            const alertId = event[ALERT_ID]!;
+            const alertUuid = event[ALERT_UUID]!;
+            const started = new Date(event[ALERT_START]!).toISOString();
+            return [alertId, { alertId, alertUuid, started }];
+          })
+      );
+
+      return {
+        wrapped: nextWrappedState,
+        trackedAlerts: nextTrackedAlerts,
+      };
+    },
+  };
+};
diff --git a/x-pack/plugins/rule_registry/server/utils/get_rule_executor_data.ts b/x-pack/plugins/rule_registry/server/utils/get_rule_executor_data.ts
new file mode 100644
index 0000000000000..1ea640add7b48
--- /dev/null
+++ b/x-pack/plugins/rule_registry/server/utils/get_rule_executor_data.ts
@@ -0,0 +1,39 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  PRODUCER,
+  RULE_CATEGORY,
+  RULE_ID,
+  RULE_NAME,
+  RULE_UUID,
+  TAGS,
+} from '../../common/technical_rule_data_field_names';
+import { AlertTypeExecutor, AlertTypeWithExecutor } from '../types';
+
+export interface RuleExecutorData {
+  [RULE_CATEGORY]: string;
+  [RULE_ID]: string;
+  [RULE_UUID]: string;
+  [RULE_NAME]: string;
+  [PRODUCER]: string;
+  [TAGS]: string[];
+}
+
+export function getRuleExecutorData(
+  type: AlertTypeWithExecutor<any, any, any>,
+  options: Parameters<AlertTypeExecutor>[0]
+) {
+  return {
+    [RULE_ID]: type.id,
+    [RULE_UUID]: options.alertId,
+    [RULE_CATEGORY]: type.name,
+    [RULE_NAME]: options.name,
+    [TAGS]: options.tags,
+    [PRODUCER]: type.producer,
+  };
+}
diff --git a/x-pack/plugins/rule_registry/server/rule_registry/field_map/mapping_from_field_map.ts b/x-pack/plugins/rule_registry/server/utils/mapping_from_field_map.ts
similarity index 80%
rename from x-pack/plugins/rule_registry/server/rule_registry/field_map/mapping_from_field_map.ts
rename to x-pack/plugins/rule_registry/server/utils/mapping_from_field_map.ts
index f1d7126906431..436b9faa20dce 100644
--- a/x-pack/plugins/rule_registry/server/rule_registry/field_map/mapping_from_field_map.ts
+++ b/x-pack/plugins/rule_registry/server/utils/mapping_from_field_map.ts
@@ -5,11 +5,11 @@
  * 2.0.
  */
 
+import { TypeMapping } from '@elastic/elasticsearch/api/types';
 import { set } from '@elastic/safer-lodash-set';
-import { FieldMap } from '../../../common';
-import { Mappings } from '../types';
+import { FieldMap } from '../../common';
 
-export function mappingFromFieldMap(fieldMap: FieldMap): Mappings {
+export function mappingFromFieldMap(fieldMap: FieldMap): TypeMapping {
   const mappings = {
     dynamic: 'strict' as const,
     properties: {},
diff --git a/x-pack/plugins/rule_registry/server/utils/parse_technical_fields.ts b/x-pack/plugins/rule_registry/server/utils/parse_technical_fields.ts
new file mode 100644
index 0000000000000..da07577c31424
--- /dev/null
+++ b/x-pack/plugins/rule_registry/server/utils/parse_technical_fields.ts
@@ -0,0 +1,25 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { isLeft } from 'fp-ts/lib/Either';
+import { PathReporter } from 'io-ts/lib/PathReporter';
+import { runtimeTypeFromFieldMap } from '../../common';
+import { technicalRuleFieldMap } from '../assets/field_maps/technical_rule_field_map';
+
+const technicalFieldRuntimeType = runtimeTypeFromFieldMap(technicalRuleFieldMap);
+
+export const parseTechnicalFields = (input: unknown) => {
+  const validate = technicalFieldRuntimeType.decode(input);
+
+  if (isLeft(validate)) {
+    throw new Error(PathReporter.report(validate).join('\n'));
+  }
+
+  return technicalFieldRuntimeType.encode(validate.right);
+};
+
+export type ParsedTechnicalFields = ReturnType<typeof parseTechnicalFields>;
diff --git a/x-pack/plugins/rule_registry/server/utils/with_rule_data_client_factory.ts b/x-pack/plugins/rule_registry/server/utils/with_rule_data_client_factory.ts
new file mode 100644
index 0000000000000..02ff6b10f74cf
--- /dev/null
+++ b/x-pack/plugins/rule_registry/server/utils/with_rule_data_client_factory.ts
@@ -0,0 +1,39 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { AlertInstanceContext, AlertTypeParams } from '../../../alerting/common';
+import { RuleDataClient } from '../rule_data_client';
+import { AlertTypeWithExecutor } from '../types';
+
+export const withRuleDataClientFactory = (ruleDataClient: RuleDataClient) => <
+  TParams extends AlertTypeParams,
+  TAlertInstanceContext extends AlertInstanceContext,
+  TServices extends Record<string, any> = {}
+>(
+  type: AlertTypeWithExecutor<
+    TParams,
+    TAlertInstanceContext,
+    TServices & { ruleDataClient: RuleDataClient }
+  >
+): AlertTypeWithExecutor<
+  TParams,
+  TAlertInstanceContext,
+  TServices & { ruleDataClient: RuleDataClient }
+> => {
+  return {
+    ...type,
+    executor: (options) => {
+      return type.executor({
+        ...options,
+        services: {
+          ...options.services,
+          ruleDataClient,
+        },
+      });
+    },
+  };
+};

From 85f16d9855e55ad7b95991b6a807b07800b18d0f Mon Sep 17 00:00:00 2001
From: Dario Gieselaar <dario.gieselaar@elastic.co>
Date: Fri, 30 Apr 2021 17:40:46 +0200
Subject: [PATCH 29/54] Change indexing strategy

---
 .../public/application/application.test.tsx   |  8 +-
 .../plugins/apm/public/application/csmApp.tsx | 19 ++--
 .../plugins/apm/public/application/index.tsx  | 13 +--
 .../alerting/register_apm_alerts.ts           | 98 ++++++++++---------
 .../ErrorGroupDetails/Distribution/index.tsx  |  3 +-
 .../app/Home/__snapshots__/Home.test.tsx.snap | 14 ++-
 .../service_icons/alert_details.tsx           | 30 ++++--
 .../charts/helper/get_alert_annotations.tsx   | 16 ++-
 .../shared/charts/latency_chart/index.tsx     |  5 +-
 .../transaction_error_rate_chart/index.tsx    |  3 +-
 .../context/apm_plugin/apm_plugin_context.tsx |  5 +-
 .../apm_plugin/mock_apm_plugin_context.tsx    |  9 +-
 x-pack/plugins/apm/public/plugin.ts           | 21 ++--
 ...egister_transaction_duration_alert_type.ts |  9 +-
 .../apm/server/lib/alerts/test_utils/index.ts | 24 +++--
 .../server/lib/services/get_service_alerts.ts |  4 +-
 x-pack/plugins/apm/server/plugin.ts           | 66 ++++++++++++-
 .../common/utils/formatters/duration.ts       |  3 +
 .../common/utils/formatters/formatters.ts     |  2 +
 x-pack/plugins/observability/kibana.json      |  3 +-
 .../public/application/application.test.tsx   |  4 +-
 .../public/application/index.tsx              |  8 +-
 .../components/app/section/apm/index.test.tsx |  8 +-
 .../components/app/section/ux/index.test.tsx  |  4 +-
 .../public/context/plugin_context.tsx         |  5 +-
 .../public/hooks/use_time_range.test.ts       |  6 +-
 x-pack/plugins/observability/public/index.ts  |  3 +
 .../public/pages/alerts/alerts.stories.tsx    |  4 +-
 .../alerts_flyout/alerts_flyout.stories.tsx   | 41 ++++----
 .../pages/alerts/alerts_flyout/index.tsx      | 20 ++--
 .../public/pages/alerts/alerts_table.tsx      | 10 +-
 .../public/pages/alerts/example_data.ts       | 60 ++++++------
 .../public/pages/alerts/index.tsx             | 31 ++++--
 .../pages/overview/overview.stories.tsx       |  4 +-
 x-pack/plugins/observability/public/plugin.ts | 16 ++-
 .../create_observability_rule_registry.ts     | 22 -----
 ...create_observability_rule_type_registry.ts | 31 ++++++
 .../rules/observability_rule_registry_mock.ts | 15 ---
 .../observability_rule_type_registry_mock.ts  | 16 +++
 .../public/utils/test_helper.tsx              |  6 +-
 .../server/lib/rules/get_top_alerts.ts        |  1 +
 x-pack/plugins/observability/server/plugin.ts |  7 +-
 .../observability/server/routes/rules.ts      |  2 +-
 .../ecs_component_template.ts                 |  4 +-
 .../technical_component_template.ts           |  4 +-
 .../assets/field_maps/ecs_field_map.ts        |  0
 .../field_maps/technical_rule_field_map.ts    |  0
 .../index_templates/base_index_template.ts    |  0
 .../default_lifecycle_policy.ts               |  0
 x-pack/plugins/rule_registry/common/index.ts  |  3 +-
 .../mapping_from_field_map.ts                 |  2 +-
 .../parse_technical_fields.ts                 |  4 +-
 .../types.ts                                  |  0
 x-pack/plugins/rule_registry/kibana.json      |  3 +-
 x-pack/plugins/rule_registry/server/index.ts  |  1 +
 x-pack/plugins/rule_registry/server/plugin.ts | 53 +++-------
 .../server/rule_data_client/index.ts          | 44 +++++----
 .../server/rule_data_client/types.ts          |  5 +-
 .../server/rule_data_plugin_service/index.ts  | 47 +++++++--
 .../create_lifecycle_rule_type_factory.ts     |  8 +-
 60 files changed, 498 insertions(+), 359 deletions(-)
 delete mode 100644 x-pack/plugins/observability/public/rules/create_observability_rule_registry.ts
 create mode 100644 x-pack/plugins/observability/public/rules/create_observability_rule_type_registry.ts
 delete mode 100644 x-pack/plugins/observability/public/rules/observability_rule_registry_mock.ts
 create mode 100644 x-pack/plugins/observability/public/rules/observability_rule_type_registry_mock.ts
 rename x-pack/plugins/rule_registry/{server => common}/assets/component_templates/ecs_component_template.ts (81%)
 rename x-pack/plugins/rule_registry/{server => common}/assets/component_templates/technical_component_template.ts (76%)
 rename x-pack/plugins/rule_registry/{server => common}/assets/field_maps/ecs_field_map.ts (100%)
 rename x-pack/plugins/rule_registry/{server => common}/assets/field_maps/technical_rule_field_map.ts (100%)
 rename x-pack/plugins/rule_registry/{server => common}/assets/index_templates/base_index_template.ts (100%)
 rename x-pack/plugins/rule_registry/{server => common}/assets/lifecycle_policies/default_lifecycle_policy.ts (100%)
 rename x-pack/plugins/rule_registry/{server/utils => common}/mapping_from_field_map.ts (94%)
 rename x-pack/plugins/rule_registry/{server/utils => common}/parse_technical_fields.ts (84%)
 rename x-pack/plugins/rule_registry/{server/rule_data_plugin_service => common}/types.ts (100%)

diff --git a/x-pack/plugins/apm/public/application/application.test.tsx b/x-pack/plugins/apm/public/application/application.test.tsx
index e6415f76c60dc..4ec654a6c0bfd 100644
--- a/x-pack/plugins/apm/public/application/application.test.tsx
+++ b/x-pack/plugins/apm/public/application/application.test.tsx
@@ -39,7 +39,11 @@ describe('renderApp', () => {
   });
 
   it('renders the app', () => {
-    const { core, config, apmRuleRegistry } = mockApmPluginContextValue;
+    const {
+      core,
+      config,
+      observabilityRuleTypeRegistry,
+    } = mockApmPluginContextValue;
     const plugins = {
       licensing: { license$: new Observable() },
       triggersActionsUi: { actionTypeRegistry: {}, alertTypeRegistry: {} },
@@ -92,7 +96,7 @@ describe('renderApp', () => {
         appMountParameters: params as any,
         pluginsStart: startDeps as any,
         config,
-        apmRuleRegistry,
+        observabilityRuleTypeRegistry,
       });
     });
 
diff --git a/x-pack/plugins/apm/public/application/csmApp.tsx b/x-pack/plugins/apm/public/application/csmApp.tsx
index 17905074cfec1..11a2777f47f6a 100644
--- a/x-pack/plugins/apm/public/application/csmApp.tsx
+++ b/x-pack/plugins/apm/public/application/csmApp.tsx
@@ -12,6 +12,7 @@ import React from 'react';
 import ReactDOM from 'react-dom';
 import { Route, Router } from 'react-router-dom';
 import { DefaultTheme, ThemeProvider } from 'styled-components';
+import type { ObservabilityRuleTypeRegistry } from '../../../observability/public';
 import { euiStyled } from '../../../../../src/plugins/kibana_react/common';
 import {
   KibanaContextProvider,
@@ -26,11 +27,7 @@ import { ApmPluginContext } from '../context/apm_plugin/apm_plugin_context';
 import { UrlParamsProvider } from '../context/url_params_context/url_params_context';
 import { useBreadcrumbs } from '../hooks/use_breadcrumbs';
 import { ConfigSchema } from '../index';
-import {
-  ApmPluginSetupDeps,
-  ApmPluginStartDeps,
-  ApmRuleRegistry,
-} from '../plugin';
+import { ApmPluginSetupDeps, ApmPluginStartDeps } from '../plugin';
 import { createCallApmApi } from '../services/rest/createCallApmApi';
 import { px, units } from '../style/variables';
 import { createStaticIndexPattern } from '../services/rest/index_pattern';
@@ -77,14 +74,14 @@ export function CsmAppRoot({
   deps,
   config,
   corePlugins: { embeddable, maps },
-  apmRuleRegistry,
+  observabilityRuleTypeRegistry,
 }: {
   appMountParameters: AppMountParameters;
   core: CoreStart;
   deps: ApmPluginSetupDeps;
   config: ConfigSchema;
   corePlugins: ApmPluginStartDeps;
-  apmRuleRegistry: ApmRuleRegistry;
+  observabilityRuleTypeRegistry: ObservabilityRuleTypeRegistry;
 }) {
   const { history } = appMountParameters;
   const i18nCore = core.i18n;
@@ -94,7 +91,7 @@ export function CsmAppRoot({
     config,
     core,
     plugins,
-    apmRuleRegistry,
+    observabilityRuleTypeRegistry,
   };
 
   return (
@@ -125,14 +122,14 @@ export const renderApp = ({
   appMountParameters,
   config,
   corePlugins,
-  apmRuleRegistry,
+  observabilityRuleTypeRegistry,
 }: {
   core: CoreStart;
   deps: ApmPluginSetupDeps;
   appMountParameters: AppMountParameters;
   config: ConfigSchema;
   corePlugins: ApmPluginStartDeps;
-  apmRuleRegistry: ApmRuleRegistry;
+  observabilityRuleTypeRegistry: ObservabilityRuleTypeRegistry;
 }) => {
   const { element } = appMountParameters;
 
@@ -151,7 +148,7 @@ export const renderApp = ({
       deps={deps}
       config={config}
       corePlugins={corePlugins}
-      apmRuleRegistry={apmRuleRegistry}
+      observabilityRuleTypeRegistry={observabilityRuleTypeRegistry}
     />,
     element
   );
diff --git a/x-pack/plugins/apm/public/application/index.tsx b/x-pack/plugins/apm/public/application/index.tsx
index acb55a02599f1..e2a0bdb6b48b1 100644
--- a/x-pack/plugins/apm/public/application/index.tsx
+++ b/x-pack/plugins/apm/public/application/index.tsx
@@ -13,6 +13,7 @@ import ReactDOM from 'react-dom';
 import { Route, Router, Switch } from 'react-router-dom';
 import 'react-vis/dist/style.css';
 import { DefaultTheme, ThemeProvider } from 'styled-components';
+import type { ObservabilityRuleTypeRegistry } from '../../../observability/public';
 import { euiStyled } from '../../../../../src/plugins/kibana_react/common';
 import { ConfigSchema } from '../';
 import { AppMountParameters, CoreStart } from '../../../../../src/core/public';
@@ -30,11 +31,7 @@ import {
 import { LicenseProvider } from '../context/license/license_context';
 import { UrlParamsProvider } from '../context/url_params_context/url_params_context';
 import { useBreadcrumbs } from '../hooks/use_breadcrumbs';
-import {
-  ApmPluginSetupDeps,
-  ApmPluginStartDeps,
-  ApmRuleRegistry,
-} from '../plugin';
+import { ApmPluginSetupDeps, ApmPluginStartDeps } from '../plugin';
 import { createCallApmApi } from '../services/rest/createCallApmApi';
 import { createStaticIndexPattern } from '../services/rest/index_pattern';
 import { setHelpExtension } from '../setHelpExtension';
@@ -112,14 +109,14 @@ export const renderApp = ({
   appMountParameters,
   config,
   pluginsStart,
-  apmRuleRegistry,
+  observabilityRuleTypeRegistry,
 }: {
   coreStart: CoreStart;
   pluginsSetup: ApmPluginSetupDeps;
   appMountParameters: AppMountParameters;
   config: ConfigSchema;
   pluginsStart: ApmPluginStartDeps;
-  apmRuleRegistry: ApmRuleRegistry;
+  observabilityRuleTypeRegistry: ObservabilityRuleTypeRegistry;
 }) => {
   const { element } = appMountParameters;
   const apmPluginContextValue = {
@@ -127,7 +124,7 @@ export const renderApp = ({
     config,
     core: coreStart,
     plugins: pluginsSetup,
-    apmRuleRegistry,
+    observabilityRuleTypeRegistry,
   };
 
   // render APM feedback link in global help menu
diff --git a/x-pack/plugins/apm/public/components/alerting/register_apm_alerts.ts b/x-pack/plugins/apm/public/components/alerting/register_apm_alerts.ts
index 98c8b99411bc3..6467d4c3ee61c 100644
--- a/x-pack/plugins/apm/public/components/alerting/register_apm_alerts.ts
+++ b/x-pack/plugins/apm/public/components/alerting/register_apm_alerts.ts
@@ -8,9 +8,19 @@
 import { i18n } from '@kbn/i18n';
 import { lazy } from 'react';
 import { stringify } from 'querystring';
+import {
+  ALERT_EVALUATION_THRESHOLD,
+  ALERT_EVALUATION_VALUE,
+  ALERT_SEVERITY_LEVEL,
+} from '../../../../rule_registry/common/technical_rule_data_field_names';
+import type { ObservabilityRuleTypeRegistry } from '../../../../observability/public';
 import { ENVIRONMENT_ALL } from '../../../common/environment_filter_values';
 import { AlertType } from '../../../common/alert_types';
-import type { ApmRuleRegistry } from '../../plugin';
+import {
+  SERVICE_ENVIRONMENT,
+  SERVICE_NAME,
+  TRANSACTION_TYPE,
+} from '../../../common/elasticsearch_fieldnames';
 
 const format = ({
   pathname,
@@ -22,28 +32,32 @@ const format = ({
   return `${pathname}?${stringify(query)}`;
 };
 
-export function registerApmAlerts(apmRuleRegistry: ApmRuleRegistry) {
-  apmRuleRegistry.registerType({
+export function registerApmAlerts(
+  observabilityRuleTypeRegistry: ObservabilityRuleTypeRegistry
+) {
+  observabilityRuleTypeRegistry.register({
     id: AlertType.ErrorCount,
     description: i18n.translate('xpack.apm.alertTypes.errorCount.description', {
       defaultMessage:
         'Alert when the number of errors in a service exceeds a defined threshold.',
     }),
-    format: ({ alert }) => {
+    format: ({ fields }) => {
       return {
         reason: i18n.translate('xpack.apm.alertTypes.errorCount.reason', {
           defaultMessage: `Error count is greater than {threshold} (current value is {measured}) for {serviceName}`,
           values: {
-            threshold: alert['kibana.observability.evaluation.threshold'],
-            measured: alert['kibana.observability.evaluation.value'],
-            serviceName: alert['service.name']!,
+            threshold: fields[ALERT_EVALUATION_THRESHOLD],
+            measured: fields[ALERT_EVALUATION_VALUE],
+            serviceName: String(fields[SERVICE_NAME][0]),
           },
         }),
         link: format({
-          pathname: `/app/apm/services/${alert['service.name']!}/errors`,
+          pathname: `/app/apm/services/${String(
+            fields[SERVICE_NAME][0]
+          )}/errors`,
           query: {
-            ...(alert['service.environment']
-              ? { environment: alert['service.environment'] }
+            ...(fields[SERVICE_ENVIRONMENT]?.[0]
+              ? { environment: String(fields[SERVICE_ENVIRONMENT][0]) }
               : { environment: ENVIRONMENT_ALL.value }),
           },
         }),
@@ -71,7 +85,7 @@ export function registerApmAlerts(apmRuleRegistry: ApmRuleRegistry) {
     ),
   });
 
-  apmRuleRegistry.registerType({
+  observabilityRuleTypeRegistry.register({
     id: AlertType.TransactionDuration,
     description: i18n.translate(
       'xpack.apm.alertTypes.transactionDuration.description',
@@ -80,28 +94,24 @@ export function registerApmAlerts(apmRuleRegistry: ApmRuleRegistry) {
           'Alert when the latency of a specific transaction type in a service exceeds a defined threshold.',
       }
     ),
-    format: ({ alert, formatters: { asDuration } }) => ({
+    format: ({ fields, formatters: { asDuration } }) => ({
       reason: i18n.translate(
         'xpack.apm.alertTypes.transactionDuration.reason',
         {
           defaultMessage: `Latency is above {threshold} (current value is {measured}) for {serviceName}`,
           values: {
-            threshold: asDuration(
-              alert['kibana.observability.evaluation.threshold']
-            ),
-            measured: asDuration(
-              alert['kibana.observability.evaluation.value']
-            ),
-            serviceName: alert['service.name']!,
+            threshold: asDuration(fields[ALERT_EVALUATION_THRESHOLD]),
+            measured: asDuration(fields[ALERT_EVALUATION_VALUE]),
+            serviceName: String(fields[SERVICE_NAME][0]),
           },
         }
       ),
       link: format({
-        pathname: `/app/apm/services/${alert['service.name']!}`,
+        pathname: `/app/apm/services/${fields[SERVICE_NAME][0]!}`,
         query: {
-          transactionType: alert['transaction.type']!,
-          ...(alert['service.environment']
-            ? { environment: alert['service.environment'] }
+          transactionType: fields[TRANSACTION_TYPE][0]!,
+          ...(fields[SERVICE_ENVIRONMENT]?.[0]
+            ? { environment: String(fields[SERVICE_ENVIRONMENT][0]) }
             : { environment: ENVIRONMENT_ALL.value }),
         },
       }),
@@ -131,7 +141,7 @@ export function registerApmAlerts(apmRuleRegistry: ApmRuleRegistry) {
     ),
   });
 
-  apmRuleRegistry.registerType({
+  observabilityRuleTypeRegistry.register({
     id: AlertType.TransactionErrorRate,
     description: i18n.translate(
       'xpack.apm.alertTypes.transactionErrorRate.description',
@@ -140,30 +150,24 @@ export function registerApmAlerts(apmRuleRegistry: ApmRuleRegistry) {
           'Alert when the rate of transaction errors in a service exceeds a defined threshold.',
       }
     ),
-    format: ({ alert, formatters: { asPercent } }) => ({
+    format: ({ fields, formatters: { asPercent } }) => ({
       reason: i18n.translate(
         'xpack.apm.alertTypes.transactionErrorRate.reason',
         {
           defaultMessage: `Transaction error rate is greater than {threshold} (current value is {measured}) for {serviceName}`,
           values: {
-            threshold: asPercent(
-              alert['kibana.observability.evaluation.threshold'],
-              100
-            ),
-            measured: asPercent(
-              alert['kibana.observability.evaluation.value'],
-              100
-            ),
-            serviceName: alert['service.name']!,
+            threshold: asPercent(fields[ALERT_EVALUATION_THRESHOLD], 100),
+            measured: asPercent(fields[ALERT_EVALUATION_VALUE], 100),
+            serviceName: String(fields[SERVICE_NAME][0]),
           },
         }
       ),
       link: format({
-        pathname: `/app/apm/services/${alert['service.name']!}`,
+        pathname: `/app/apm/services/${String(fields[SERVICE_NAME][0]!)}`,
         query: {
-          transactionType: alert['transaction.type']!,
-          ...(alert['service.environment']
-            ? { environment: alert['service.environment'] }
+          transactionType: String(fields[TRANSACTION_TYPE][0]!),
+          ...(fields[SERVICE_ENVIRONMENT]?.[0]
+            ? { environment: String(fields[SERVICE_ENVIRONMENT][0]) }
             : { environment: ENVIRONMENT_ALL.value }),
         },
       }),
@@ -193,7 +197,7 @@ export function registerApmAlerts(apmRuleRegistry: ApmRuleRegistry) {
     ),
   });
 
-  apmRuleRegistry.registerType({
+  observabilityRuleTypeRegistry.register({
     id: AlertType.TransactionDurationAnomaly,
     description: i18n.translate(
       'xpack.apm.alertTypes.transactionDurationAnomaly.description',
@@ -201,24 +205,24 @@ export function registerApmAlerts(apmRuleRegistry: ApmRuleRegistry) {
         defaultMessage: 'Alert when the latency of a service is abnormal.',
       }
     ),
-    format: ({ alert }) => ({
+    format: ({ fields }) => ({
       reason: i18n.translate(
         'xpack.apm.alertTypes.transactionDurationAnomaly.reason',
         {
           defaultMessage: `{severityLevel} anomaly detected for {serviceName} (score was {measured})`,
           values: {
-            serviceName: alert['service.name'],
-            severityLevel: alert['kibana.rac.alert.severity.level'],
-            measured: alert['kibana.observability.evaluation.value'],
+            serviceName: String(fields[SERVICE_NAME][0]),
+            severityLevel: String(fields[ALERT_SEVERITY_LEVEL]),
+            measured: Number(fields[ALERT_EVALUATION_VALUE]),
           },
         }
       ),
       link: format({
-        pathname: `/app/apm/services/${alert['service.name']!}`,
+        pathname: `/app/apm/services/${String(fields[SERVICE_NAME][0])}`,
         query: {
-          transactionType: alert['transaction.type']!,
-          ...(alert['service.environment']
-            ? { environment: alert['service.environment'] }
+          transactionType: String(fields[TRANSACTION_TYPE][0]),
+          ...(fields[SERVICE_ENVIRONMENT]?.[0]
+            ? { environment: String(fields[SERVICE_ENVIRONMENT][0]) }
             : { environment: ENVIRONMENT_ALL.value }),
         },
       }),
diff --git a/x-pack/plugins/apm/public/components/app/ErrorGroupDetails/Distribution/index.tsx b/x-pack/plugins/apm/public/components/app/ErrorGroupDetails/Distribution/index.tsx
index 19a567a3866bd..aa11eb06d853f 100644
--- a/x-pack/plugins/apm/public/components/app/ErrorGroupDetails/Distribution/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/ErrorGroupDetails/Distribution/index.tsx
@@ -19,6 +19,7 @@ import {
 import { EuiTitle } from '@elastic/eui';
 import d3 from 'd3';
 import React from 'react';
+import { RULE_ID } from '../../../../../../rule_registry/common/technical_rule_data_field_names';
 import { useApmServiceContext } from '../../../../context/apm_service/use_apm_service_context';
 import { APIReturnType } from '../../../../services/rest/createCallApmApi';
 import { asRelativeDateTimeRange } from '../../../../../common/utils/formatters';
@@ -115,7 +116,7 @@ export function ErrorDistribution({ distribution, title }: Props) {
           />
           {getAlertAnnotations({
             alerts: alerts?.filter(
-              (alert) => alert['rule.id'] === AlertType.ErrorCount
+              (alert) => alert[RULE_ID]?.[0] === AlertType.ErrorCount
             ),
             theme,
           })}
diff --git a/x-pack/plugins/apm/public/components/app/Home/__snapshots__/Home.test.tsx.snap b/x-pack/plugins/apm/public/components/app/Home/__snapshots__/Home.test.tsx.snap
index b1bcf561bed84..f13cce3fd9b40 100644
--- a/x-pack/plugins/apm/public/components/app/Home/__snapshots__/Home.test.tsx.snap
+++ b/x-pack/plugins/apm/public/components/app/Home/__snapshots__/Home.test.tsx.snap
@@ -4,10 +4,6 @@ exports[`Home component should render services 1`] = `
 <ContextProvider
   value={
     Object {
-      "apmRuleRegistry": Object {
-        "getTypeByRuleId": [Function],
-        "registerType": [Function],
-      },
       "appMountParameters": Object {
         "setHeaderActionMenu": [Function],
       },
@@ -61,6 +57,9 @@ exports[`Home component should render services 1`] = `
           "get$": [Function],
         },
       },
+      "observabilityRuleTypeRegistry": Object {
+        "registerFormatter": [Function],
+      },
       "plugins": Object {
         "data": Object {
           "query": Object {
@@ -99,10 +98,6 @@ exports[`Home component should render traces 1`] = `
 <ContextProvider
   value={
     Object {
-      "apmRuleRegistry": Object {
-        "getTypeByRuleId": [Function],
-        "registerType": [Function],
-      },
       "appMountParameters": Object {
         "setHeaderActionMenu": [Function],
       },
@@ -156,6 +151,9 @@ exports[`Home component should render traces 1`] = `
           "get$": [Function],
         },
       },
+      "observabilityRuleTypeRegistry": Object {
+        "registerFormatter": [Function],
+      },
       "plugins": Object {
         "data": Object {
           "query": Object {
diff --git a/x-pack/plugins/apm/public/components/app/service_details/service_icons/alert_details.tsx b/x-pack/plugins/apm/public/components/app/service_details/service_icons/alert_details.tsx
index 7607b6fd91392..47dfb64a8b7ef 100644
--- a/x-pack/plugins/apm/public/components/app/service_details/service_icons/alert_details.tsx
+++ b/x-pack/plugins/apm/public/components/app/service_details/service_icons/alert_details.tsx
@@ -8,6 +8,13 @@ import React from 'react';
 import { EuiFlexGroup, EuiFlexItem, EuiLink } from '@elastic/eui';
 import { parse, format } from 'url';
 import { uniqBy } from 'lodash';
+import { parseTechnicalFields } from '../../../../../../rule_registry/common';
+import {
+  ALERT_ID,
+  ALERT_START,
+  RULE_ID,
+  RULE_NAME,
+} from '../../../../../../rule_registry/common/technical_rule_data_field_names';
 import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
 import { useApmPluginContext } from '../../../../context/apm_plugin/use_apm_plugin_context';
 import { APIReturnType } from '../../../../services/rest/createCallApmApi';
@@ -20,7 +27,7 @@ interface AlertDetailProps {
 
 export function AlertDetails({ alerts }: AlertDetailProps) {
   const {
-    apmRuleRegistry,
+    observabilityRuleTypeRegistry,
     core: {
       http: {
         basePath: { prepend },
@@ -32,20 +39,23 @@ export function AlertDetails({ alerts }: AlertDetailProps) {
     urlParams: { rangeFrom, rangeTo },
   } = useUrlParams();
 
-  const collapsedAlerts = uniqBy(
-    alerts,
-    (alert) => alert['kibana.rac.alert.id']!
+  const collapsedAlerts = uniqBy(alerts, (alert) => alert[ALERT_ID]![0]!).map(
+    (alert) => {
+      return parseTechnicalFields(alert);
+    }
   );
 
   return (
     <EuiFlexGroup direction="column" gutterSize="s">
       {collapsedAlerts.map((alert) => {
-        const ruleType = apmRuleRegistry.getTypeByRuleId(alert['rule.id']!);
+        const formatter = observabilityRuleTypeRegistry.getFormatter(
+          alert[RULE_ID]!
+        );
         const formatted = {
           link: undefined,
-          reason: alert['rule.name'],
-          ...(ruleType?.format?.({
-            alert,
+          reason: alert[RULE_NAME],
+          ...(formatter?.({
+            fields: alert,
             formatters: { asDuration, asPercent },
           }) ?? {}),
         };
@@ -55,7 +65,7 @@ export function AlertDetails({ alerts }: AlertDetailProps) {
           : undefined;
 
         return (
-          <EuiFlexItem grow>
+          <EuiFlexItem grow key={alert[ALERT_ID]}>
             <EuiFlexGroup direction="row" gutterSize="s">
               <EuiFlexItem grow>
                 {parsedLink ? (
@@ -79,7 +89,7 @@ export function AlertDetails({ alerts }: AlertDetailProps) {
               </EuiFlexItem>
               <EuiFlexItem grow={false}>
                 <TimestampTooltip
-                  time={new Date(alert['kibana.rac.alert.start']!).getTime()}
+                  time={new Date(alert[ALERT_START]!).getTime()}
                 />
               </EuiFlexItem>
             </EuiFlexGroup>
diff --git a/x-pack/plugins/apm/public/components/shared/charts/helper/get_alert_annotations.tsx b/x-pack/plugins/apm/public/components/shared/charts/helper/get_alert_annotations.tsx
index 2c086dbb17222..310f5a165a5c8 100644
--- a/x-pack/plugins/apm/public/components/shared/charts/helper/get_alert_annotations.tsx
+++ b/x-pack/plugins/apm/public/components/shared/charts/helper/get_alert_annotations.tsx
@@ -9,6 +9,13 @@ import { ValuesType } from 'utility-types';
 import { RectAnnotation } from '@elastic/charts';
 import { EuiTheme } from 'src/plugins/kibana_react/common';
 import { rgba } from 'polished';
+import {
+  ALERT_DURATION,
+  RULE_ID,
+  ALERT_START,
+  ALERT_UUID,
+} from '../../../../../../rule_registry/common/technical_rule_data_field_names';
+import { parseTechnicalFields } from '../../../../../../rule_registry/common';
 import { APIReturnType } from '../../../../services/rest/createCallApmApi';
 
 type Alert = ValuesType<
@@ -30,10 +37,11 @@ export function getAlertAnnotations({
   theme: EuiTheme;
 }) {
   return alerts?.flatMap((alert) => {
-    const uuid = alert['kibana.rac.alert.uuid']!;
-    const start = new Date(alert['kibana.rac.alert.start']!).getTime();
-    const end = start + alert['kibana.rac.alert.duration.us']! / 1000;
-    const color = getAlertColor({ ruleId: alert['rule.id']!, theme });
+    const parsed = parseTechnicalFields(alert);
+    const uuid = parsed[ALERT_UUID]!;
+    const start = new Date(parsed[ALERT_START]!).getTime();
+    const end = start + parsed[ALERT_DURATION]! / 1000;
+    const color = getAlertColor({ ruleId: parsed[RULE_ID]!, theme });
 
     return [
       <RectAnnotation
diff --git a/x-pack/plugins/apm/public/components/shared/charts/latency_chart/index.tsx b/x-pack/plugins/apm/public/components/shared/charts/latency_chart/index.tsx
index a20f7325f9376..81965080240bf 100644
--- a/x-pack/plugins/apm/public/components/shared/charts/latency_chart/index.tsx
+++ b/x-pack/plugins/apm/public/components/shared/charts/latency_chart/index.tsx
@@ -9,6 +9,7 @@ import { EuiFlexGroup, EuiFlexItem, EuiSelect, EuiTitle } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import React from 'react';
 import { useHistory } from 'react-router-dom';
+import { RULE_ID } from '../../../../../../rule_registry/common/technical_rule_data_field_names';
 import { AlertType } from '../../../../../common/alert_types';
 import { useApmServiceContext } from '../../../../context/apm_service/use_apm_service_context';
 import { LatencyAggregationType } from '../../../../../common/latency_aggregation_types';
@@ -127,8 +128,8 @@ export function LatencyChart({ height }: Props) {
           anomalyTimeseries={anomalyTimeseries}
           alerts={alerts.filter(
             (alert) =>
-              alert['rule.id'] === AlertType.TransactionDuration ||
-              alert['rule.id'] === AlertType.TransactionDurationAnomaly
+              alert[RULE_ID]?.[0] === AlertType.TransactionDuration ||
+              alert[RULE_ID]?.[0] === AlertType.TransactionDurationAnomaly
           )}
         />
       </EuiFlexItem>
diff --git a/x-pack/plugins/apm/public/components/shared/charts/transaction_error_rate_chart/index.tsx b/x-pack/plugins/apm/public/components/shared/charts/transaction_error_rate_chart/index.tsx
index 9aefa55aaaa36..7eceaf5ca8e5d 100644
--- a/x-pack/plugins/apm/public/components/shared/charts/transaction_error_rate_chart/index.tsx
+++ b/x-pack/plugins/apm/public/components/shared/charts/transaction_error_rate_chart/index.tsx
@@ -9,6 +9,7 @@ import { EuiPanel, EuiTitle } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import React from 'react';
 import { useParams } from 'react-router-dom';
+import { RULE_ID } from '../../../../../../rule_registry/common/technical_rule_data_field_names';
 import { AlertType } from '../../../../../common/alert_types';
 import { APIReturnType } from '../../../../services/rest/createCallApmApi';
 import { asPercent } from '../../../../../common/utils/formatters';
@@ -152,7 +153,7 @@ export function TransactionErrorRateChart({
         yDomain={{ min: 0, max: 1 }}
         customTheme={comparisonChartThem}
         alerts={alerts.filter(
-          (alert) => alert['rule.id'] === AlertType.TransactionErrorRate
+          (alert) => alert[RULE_ID]?.[0] === AlertType.TransactionErrorRate
         )}
       />
     </EuiPanel>
diff --git a/x-pack/plugins/apm/public/context/apm_plugin/apm_plugin_context.tsx b/x-pack/plugins/apm/public/context/apm_plugin/apm_plugin_context.tsx
index 175471e7ae817..ec42a11783273 100644
--- a/x-pack/plugins/apm/public/context/apm_plugin/apm_plugin_context.tsx
+++ b/x-pack/plugins/apm/public/context/apm_plugin/apm_plugin_context.tsx
@@ -7,8 +7,9 @@
 
 import { AppMountParameters, CoreStart } from 'kibana/public';
 import { createContext } from 'react';
+import type { ObservabilityRuleTypeRegistry } from '../../../../observability/public';
 import { ConfigSchema } from '../..';
-import { ApmPluginSetupDeps, ApmRuleRegistry } from '../../plugin';
+import { ApmPluginSetupDeps } from '../../plugin';
 import { MapsStartApi } from '../../../../maps/public';
 
 export interface ApmPluginContextValue {
@@ -16,7 +17,7 @@ export interface ApmPluginContextValue {
   config: ConfigSchema;
   core: CoreStart;
   plugins: ApmPluginSetupDeps & { maps?: MapsStartApi };
-  apmRuleRegistry: ApmRuleRegistry;
+  observabilityRuleTypeRegistry: ObservabilityRuleTypeRegistry;
 }
 
 export const ApmPluginContext = createContext({} as ApmPluginContextValue);
diff --git a/x-pack/plugins/apm/public/context/apm_plugin/mock_apm_plugin_context.tsx b/x-pack/plugins/apm/public/context/apm_plugin/mock_apm_plugin_context.tsx
index 07da5ea7f6c1f..a16f81826636b 100644
--- a/x-pack/plugins/apm/public/context/apm_plugin/mock_apm_plugin_context.tsx
+++ b/x-pack/plugins/apm/public/context/apm_plugin/mock_apm_plugin_context.tsx
@@ -7,12 +7,12 @@
 
 import React, { ReactNode } from 'react';
 import { Observable, of } from 'rxjs';
+import { createObservabilityRuleTypeRegistryMock } from '../../../../observability/public';
 import { ApmPluginContext, ApmPluginContextValue } from './apm_plugin_context';
 import { ConfigSchema } from '../..';
 import { UI_SETTINGS } from '../../../../../../src/plugins/data/common';
 import { createCallApmApi } from '../../services/rest/createCallApmApi';
 import { MlUrlGenerator } from '../../../../ml/public';
-import { ApmRuleRegistry } from '../../plugin';
 
 const uiSettings: Record<string, unknown> = {
   [UI_SETTINGS.TIMEPICKER_QUICK_RANGES]: [
@@ -77,11 +77,6 @@ const mockCore = {
   },
 };
 
-const mockApmRuleRegistry = ({
-  getTypeByRuleId: () => undefined,
-  registerType: () => undefined,
-} as unknown) as ApmRuleRegistry;
-
 const mockConfig: ConfigSchema = {
   serviceMapEnabled: true,
   ui: {
@@ -116,7 +111,7 @@ export const mockApmPluginContextValue = {
   config: mockConfig,
   core: mockCore,
   plugins: mockPlugin,
-  apmRuleRegistry: mockApmRuleRegistry,
+  observabilityRuleTypeRegistry: createObservabilityRuleTypeRegistryMock(),
 };
 
 export function MockApmPluginContextWrapper({
diff --git a/x-pack/plugins/apm/public/plugin.ts b/x-pack/plugins/apm/public/plugin.ts
index f7bbe647d8e37..b493363d98f7a 100644
--- a/x-pack/plugins/apm/public/plugin.ts
+++ b/x-pack/plugins/apm/public/plugin.ts
@@ -34,19 +34,15 @@ import type {
   HasDataParams,
   ObservabilityPublicSetup,
 } from '../../observability/public';
-import { FormatterRuleRegistry } from '../../observability/public';
 import type {
   TriggersAndActionsUIPublicPluginSetup,
   TriggersAndActionsUIPublicPluginStart,
 } from '../../triggers_actions_ui/public';
-import { apmRuleRegistrySettings } from '../common/rules/apm_rule_registry_settings';
-import type { APMRuleFieldMap } from '../common/rules/apm_rule_field_map';
 import { registerApmAlerts } from './components/alerting/register_apm_alerts';
 import { featureCatalogueEntry } from './featureCatalogueEntry';
 import { toggleAppLinkInNav } from './toggleAppLinkInNav';
 
 export type ApmPluginSetup = ReturnType<ApmPlugin['setup']>;
-export type ApmRuleRegistry = ApmPluginSetup['ruleRegistry'];
 
 export type ApmPluginStart = void;
 
@@ -87,11 +83,6 @@ export class ApmPlugin implements Plugin<ApmPluginSetup, ApmPluginStart> {
       pluginSetupDeps.home.featureCatalogue.register(featureCatalogueEntry);
     }
 
-    const apmRuleRegistry = plugins.observability.ruleRegistry.create({
-      ...apmRuleRegistrySettings,
-      fieldMap: {} as APMRuleFieldMap,
-      ctor: FormatterRuleRegistry,
-    });
     const getApmDataHelper = async () => {
       const {
         fetchObservabilityOverviewPageData,
@@ -127,6 +118,8 @@ export class ApmPlugin implements Plugin<ApmPluginSetup, ApmPluginStart> {
       return { fetchUxOverviewDate, hasRumData };
     };
 
+    const { observabilityRuleTypeRegistry } = plugins.observability;
+
     plugins.observability.dashboard.register({
       appName: 'ux',
       hasData: async (params?: HasDataParams) => {
@@ -187,12 +180,12 @@ export class ApmPlugin implements Plugin<ApmPluginSetup, ApmPluginStart> {
           appMountParameters,
           config,
           pluginsStart: pluginsStart as ApmPluginStartDeps,
-          apmRuleRegistry,
+          observabilityRuleTypeRegistry,
         });
       },
     });
 
-    registerApmAlerts(apmRuleRegistry);
+    registerApmAlerts(observabilityRuleTypeRegistry);
 
     core.application.register({
       id: 'ux',
@@ -231,14 +224,12 @@ export class ApmPlugin implements Plugin<ApmPluginSetup, ApmPluginStart> {
           appMountParameters,
           config,
           corePlugins: corePlugins as ApmPluginStartDeps,
-          apmRuleRegistry,
+          observabilityRuleTypeRegistry,
         });
       },
     });
 
-    return {
-      ruleRegistry: apmRuleRegistry,
-    };
+    return {};
   }
   public start(core: CoreStart, plugins: ApmPluginStartDeps) {
     toggleAppLinkInNav(core, this.initializerContext.config.get());
diff --git a/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_alert_type.ts b/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_alert_type.ts
index a5c9a7315787b..ec60ef7916e04 100644
--- a/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_alert_type.ts
+++ b/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_alert_type.ts
@@ -8,6 +8,10 @@
 import { schema } from '@kbn/config-schema';
 import { take } from 'rxjs/operators';
 import { QueryContainer } from '@elastic/elasticsearch/api/types';
+import {
+  ALERT_EVALUATION_THRESHOLD,
+  ALERT_EVALUATION_VALUE,
+} from '../../../../rule_registry/common/technical_rule_data_field_names';
 import { createLifecycleRuleTypeFactory } from '../../../../rule_registry/server';
 import { parseEnvironmentUrlParam } from '../../../common/environment_filter_values';
 import { AlertType, ALERT_TYPES_CONFIG } from '../../../common/alert_types';
@@ -162,9 +166,8 @@ export function registerTransactionDurationAlertType({
                 : {}),
               [TRANSACTION_TYPE]: alertParams.transactionType,
               [PROCESSOR_EVENT]: ProcessorEvent.transaction,
-              'kibana.observability.evaluation.value': transactionDuration,
-              'kibana.observability.evaluation.threshold':
-                alertParams.threshold * 1000,
+              [ALERT_EVALUATION_VALUE]: transactionDuration,
+              [ALERT_EVALUATION_THRESHOLD]: alertParams.threshold * 1000,
             },
           })
           .scheduleActions(alertTypeConfig.defaultActionGroupId, {
diff --git a/x-pack/plugins/apm/server/lib/alerts/test_utils/index.ts b/x-pack/plugins/apm/server/lib/alerts/test_utils/index.ts
index 37b3e282d0a59..ce1466bff01a9 100644
--- a/x-pack/plugins/apm/server/lib/alerts/test_utils/index.ts
+++ b/x-pack/plugins/apm/server/lib/alerts/test_utils/index.ts
@@ -8,8 +8,9 @@
 import { Logger } from 'kibana/server';
 import { of } from 'rxjs';
 import { elasticsearchServiceMock } from 'src/core/server/mocks';
+import type { RuleDataClient } from '../../../../../rule_registry/server';
+import { PluginSetupContract as AlertingPluginSetupContract } from '../../../../../alerting/server';
 import { APMConfig } from '../../..';
-import { APMRuleRegistry } from '../../../plugin';
 
 export const createRuleTypeMocks = () => {
   let alertExecutor: (...args: any[]) => Promise<any>;
@@ -27,19 +28,16 @@ export const createRuleTypeMocks = () => {
     error: jest.fn(),
   } as unknown) as Logger;
 
-  const registry = {
+  const alerting = {
     registerType: ({ executor }) => {
       alertExecutor = executor;
     },
-  } as APMRuleRegistry;
+  } as AlertingPluginSetupContract;
 
   const scheduleActions = jest.fn();
 
   const services = {
     scopedClusterClient: elasticsearchServiceMock.createScopedClusterClient(),
-    scopedRuleRegistryClient: {
-      bulkIndex: jest.fn(),
-    },
     alertInstanceFactory: jest.fn(() => ({ scheduleActions })),
     alertWithLifecycle: jest.fn(),
     logger: loggerMock,
@@ -47,9 +45,21 @@ export const createRuleTypeMocks = () => {
 
   return {
     dependencies: {
-      registry,
+      alerting,
       config$: mockedConfig$,
       logger: loggerMock,
+      ruleDataClient: ({
+        getReader: () => {
+          return {
+            search: jest.fn(),
+          };
+        },
+        getWriter: () => {
+          return {
+            bulk: jest.fn(),
+          };
+        },
+      } as unknown) as RuleDataClient,
     },
     services,
     scheduleActions,
diff --git a/x-pack/plugins/apm/server/lib/services/get_service_alerts.ts b/x-pack/plugins/apm/server/lib/services/get_service_alerts.ts
index 90275ed676a44..42a95afc65ad3 100644
--- a/x-pack/plugins/apm/server/lib/services/get_service_alerts.ts
+++ b/x-pack/plugins/apm/server/lib/services/get_service_alerts.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { ALERT_UUID } from '../../../../rule_registry/common/technical_rule_data_field_names';
 import { RuleDataClient } from '../../../../rule_registry/server';
 import {
   SERVICE_NAME,
@@ -64,12 +65,13 @@ export async function getServiceAlerts({
       size: 100,
       fields: ['*'],
       collapse: {
-        field: 'kibana.rac.alert.uuid',
+        field: ALERT_UUID,
       },
       sort: {
         '@timestamp': 'desc',
       },
     },
+    allow_no_indices: true,
   });
 
   return response.hits.hits.map((hit) => hit.fields);
diff --git a/x-pack/plugins/apm/server/plugin.ts b/x-pack/plugins/apm/server/plugin.ts
index fd19c659694d6..0479fe1be17ce 100644
--- a/x-pack/plugins/apm/server/plugin.ts
+++ b/x-pack/plugins/apm/server/plugin.ts
@@ -16,7 +16,9 @@ import {
   Plugin,
   PluginInitializerContext,
 } from 'src/core/server';
-import { mapValues } from 'lodash';
+import { mapValues, once } from 'lodash';
+import { TECHNICAL_COMPONENT_TEMPLATE_NAME } from '../../rule_registry/common/assets';
+import { mappingFromFieldMap } from '../../rule_registry/common/mapping_from_field_map';
 import { RuleDataClient } from '../../rule_registry/server';
 import { APMConfig, APMXPackConfig } from '.';
 import { mergeConfigs } from './index';
@@ -43,6 +45,12 @@ import {
 } from './types';
 import { registerRoutes } from './routes/register_routes';
 import { getGlobalApmServerRouteRepository } from './routes/get_global_apm_server_route_repository';
+import {
+  PROCESSOR_EVENT,
+  SERVICE_ENVIRONMENT,
+  SERVICE_NAME,
+  TRANSACTION_TYPE,
+} from '../common/elasticsearch_fieldnames';
 
 export class APMPlugin
   implements
@@ -124,12 +132,62 @@ export class APMPlugin
     const getCoreStart = () =>
       core.getStartServices().then(([coreStart]) => coreStart);
 
+    const ready = once(async () => {
+      const componentTemplateName = plugins.ruleRegistry.getFullAssetName(
+        'apm-mappings'
+      );
+      await plugins.ruleRegistry.createOrUpdateComponentTemplate({
+        name: componentTemplateName,
+        body: {
+          template: {
+            settings: {
+              number_of_shards: 1,
+            },
+            mappings: mappingFromFieldMap({
+              [SERVICE_NAME]: {
+                type: 'keyword',
+              },
+              [SERVICE_ENVIRONMENT]: {
+                type: 'keyword',
+              },
+              [TRANSACTION_TYPE]: {
+                type: 'keyword',
+              },
+              [PROCESSOR_EVENT]: {
+                type: 'keyword',
+              },
+            }),
+          },
+        },
+      });
+
+      await plugins.ruleRegistry.createOrUpdateIndexTemplate({
+        name: plugins.ruleRegistry.getFullAssetName('apm-index-template'),
+        body: {
+          index_patterns: [
+            plugins.ruleRegistry.getFullAssetName('observability-apm*'),
+          ],
+          composed_of: [
+            plugins.ruleRegistry.getFullAssetName(
+              TECHNICAL_COMPONENT_TEMPLATE_NAME
+            ),
+            componentTemplateName,
+          ],
+        },
+      });
+    });
+
+    ready().catch((err) => {
+      this.logger!.error(err);
+    });
+
     const ruleDataClient = new RuleDataClient({
-      alias: plugins.ruleRegistry.getFullAssetName('apm'),
-      ready: async () => {
+      alias: plugins.ruleRegistry.getFullAssetName('observability-apm'),
+      getClusterClient: async () => {
         const coreStart = await getCoreStart();
-        return { clusterClient: coreStart.elasticsearch.client.asInternalUser };
+        return coreStart.elasticsearch.client.asInternalUser;
       },
+      ready,
     });
 
     registerRoutes({
diff --git a/x-pack/plugins/observability/common/utils/formatters/duration.ts b/x-pack/plugins/observability/common/utils/formatters/duration.ts
index 6bbeb44ef06af..481005332cc30 100644
--- a/x-pack/plugins/observability/common/utils/formatters/duration.ts
+++ b/x-pack/plugins/observability/common/utils/formatters/duration.ts
@@ -201,6 +201,9 @@ export function asDuration(
   const formatter = getDurationFormatter(value);
   return formatter(value, { defaultValue, extended }).formatted;
 }
+
+export type AsDuration = typeof asDuration;
+
 /**
  * Convert a microsecond value to decimal milliseconds. Normally we use
  * `asDuration`, but this is used in places like tables where we always want
diff --git a/x-pack/plugins/observability/common/utils/formatters/formatters.ts b/x-pack/plugins/observability/common/utils/formatters/formatters.ts
index 3c307f64fa0a9..9bdccc7e9edfe 100644
--- a/x-pack/plugins/observability/common/utils/formatters/formatters.ts
+++ b/x-pack/plugins/observability/common/utils/formatters/formatters.ts
@@ -47,6 +47,8 @@ export function asPercent(
   return numeral(decimal).format('0.0%');
 }
 
+export type AsPercent = typeof asPercent;
+
 export function asDecimalOrInteger(value: number) {
   // exact 0 or above 10 should not have decimal
   if (value === 0 || value >= 10) {
diff --git a/x-pack/plugins/observability/kibana.json b/x-pack/plugins/observability/kibana.json
index 0ee978c75d6c0..52d5493ae69a4 100644
--- a/x-pack/plugins/observability/kibana.json
+++ b/x-pack/plugins/observability/kibana.json
@@ -15,7 +15,8 @@
   "requiredPlugins": [
     "data",
     "alerting",
-    "ruleRegistry"
+    "ruleRegistry",
+    "triggersActionsUi"
   ],
   "ui": true,
   "server": true,
diff --git a/x-pack/plugins/observability/public/application/application.test.tsx b/x-pack/plugins/observability/public/application/application.test.tsx
index c0b51652a7d0e..9182a0e8196c8 100644
--- a/x-pack/plugins/observability/public/application/application.test.tsx
+++ b/x-pack/plugins/observability/public/application/application.test.tsx
@@ -10,7 +10,7 @@ import React from 'react';
 import { Observable } from 'rxjs';
 import { AppMountParameters, CoreStart } from 'src/core/public';
 import { ObservabilityPublicPluginsStart } from '../plugin';
-import { createObservabilityRuleRegistryMock } from '../rules/observability_rule_registry_mock';
+import { createObservabilityRuleTypeRegistryMock } from '../rules/observability_rule_type_registry_mock';
 import { renderApp } from './';
 
 describe('renderApp', () => {
@@ -58,7 +58,7 @@ describe('renderApp', () => {
         core,
         plugins,
         appMountParameters: params,
-        observabilityRuleRegistry: createObservabilityRuleRegistryMock(),
+        observabilityRuleTypeRegistry: createObservabilityRuleTypeRegistryMock(),
       });
       unmount();
     }).not.toThrowError();
diff --git a/x-pack/plugins/observability/public/application/index.tsx b/x-pack/plugins/observability/public/application/index.tsx
index 0b9542fe262a3..460aa6c35bdb8 100644
--- a/x-pack/plugins/observability/public/application/index.tsx
+++ b/x-pack/plugins/observability/public/application/index.tsx
@@ -23,7 +23,7 @@ import { HasDataContextProvider } from '../context/has_data_context';
 import { Breadcrumbs, routes } from '../routes';
 import { Storage } from '../../../../../src/plugins/kibana_utils/public';
 import { ConfigSchema } from '..';
-import { ObservabilityRuleRegistry } from '../rules/create_observability_rule_registry';
+import { ObservabilityRuleTypeRegistry } from '../rules/create_observability_rule_type_registry';
 
 function getTitleFromBreadCrumbs(breadcrumbs: Breadcrumbs) {
   return breadcrumbs.map(({ text }) => text).reverse();
@@ -73,12 +73,12 @@ export const renderApp = ({
   core,
   plugins,
   appMountParameters,
-  observabilityRuleRegistry,
+  observabilityRuleTypeRegistry,
 }: {
   config: ConfigSchema;
   core: CoreStart;
   plugins: ObservabilityPublicPluginsStart;
-  observabilityRuleRegistry: ObservabilityRuleRegistry;
+  observabilityRuleTypeRegistry: ObservabilityRuleTypeRegistry;
   appMountParameters: AppMountParameters;
 }) => {
   const { element, history } = appMountParameters;
@@ -95,7 +95,7 @@ export const renderApp = ({
   ReactDOM.render(
     <KibanaContextProvider services={{ ...core, ...plugins, storage: new Storage(localStorage) }}>
       <PluginContext.Provider
-        value={{ appMountParameters, config, core, plugins, observabilityRuleRegistry }}
+        value={{ appMountParameters, config, core, plugins, observabilityRuleTypeRegistry }}
       >
         <Router history={history}>
           <EuiThemeProvider darkMode={isDarkMode}>
diff --git a/x-pack/plugins/observability/public/components/app/section/apm/index.test.tsx b/x-pack/plugins/observability/public/components/app/section/apm/index.test.tsx
index d41f131ef521b..e2669d87d6776 100644
--- a/x-pack/plugins/observability/public/components/app/section/apm/index.test.tsx
+++ b/x-pack/plugins/observability/public/components/app/section/apm/index.test.tsx
@@ -14,7 +14,8 @@ import * as hasDataHook from '../../../../hooks/use_has_data';
 import * as pluginContext from '../../../../hooks/use_plugin_context';
 import { HasDataContextValue } from '../../../../context/has_data_context';
 import { AppMountParameters, CoreStart } from 'kibana/public';
-import { ObservabilityPublicPluginsStart, ObservabilityRuleRegistry } from '../../../../plugin';
+import { ObservabilityPublicPluginsStart } from '../../../../plugin';
+import { createObservabilityRuleTypeRegistryMock } from '../../../../rules/observability_rule_type_registry_mock';
 
 jest.mock('react-router-dom', () => ({
   useLocation: () => ({
@@ -41,10 +42,7 @@ describe('APMSection', () => {
       } as unknown) as CoreStart,
       appMountParameters: {} as AppMountParameters,
       config: { unsafe: { alertingExperience: { enabled: true } } },
-      observabilityRuleRegistry: ({
-        registerType: jest.fn(),
-        getTypeByRuleId: jest.fn(),
-      } as unknown) as ObservabilityRuleRegistry,
+      observabilityRuleTypeRegistry: createObservabilityRuleTypeRegistryMock(),
       plugins: ({
         data: {
           query: {
diff --git a/x-pack/plugins/observability/public/components/app/section/ux/index.test.tsx b/x-pack/plugins/observability/public/components/app/section/ux/index.test.tsx
index fa4d1a744e3ea..b4227cc122dde 100644
--- a/x-pack/plugins/observability/public/components/app/section/ux/index.test.tsx
+++ b/x-pack/plugins/observability/public/components/app/section/ux/index.test.tsx
@@ -7,7 +7,6 @@
 
 import { AppMountParameters, CoreStart } from 'kibana/public';
 import React from 'react';
-import { createObservabilityRuleRegistryMock } from '../../../../rules/observability_rule_registry_mock';
 import { HasDataContextValue } from '../../../../context/has_data_context';
 import * as fetcherHook from '../../../../hooks/use_fetcher';
 import * as hasDataHook from '../../../../hooks/use_has_data';
@@ -16,6 +15,7 @@ import { ObservabilityPublicPluginsStart } from '../../../../plugin';
 import { render } from '../../../../utils/test_helper';
 import { UXSection } from './';
 import { response } from './mock_data/ux.mock';
+import { createObservabilityRuleTypeRegistryMock } from '../../../../rules/observability_rule_type_registry_mock';
 
 jest.mock('react-router-dom', () => ({
   useLocation: () => ({
@@ -55,7 +55,7 @@ describe('UXSection', () => {
           },
         },
       } as unknown) as ObservabilityPublicPluginsStart,
-      observabilityRuleRegistry: createObservabilityRuleRegistryMock(),
+      observabilityRuleTypeRegistry: createObservabilityRuleTypeRegistryMock(),
     }));
   });
   it('renders with core web vitals', () => {
diff --git a/x-pack/plugins/observability/public/context/plugin_context.tsx b/x-pack/plugins/observability/public/context/plugin_context.tsx
index eea259b36d5b9..9b0bacc4c1174 100644
--- a/x-pack/plugins/observability/public/context/plugin_context.tsx
+++ b/x-pack/plugins/observability/public/context/plugin_context.tsx
@@ -7,15 +7,16 @@
 
 import { createContext } from 'react';
 import { AppMountParameters, CoreStart } from 'kibana/public';
-import { ObservabilityPublicPluginsStart, ObservabilityRuleRegistry } from '../plugin';
+import { ObservabilityPublicPluginsStart } from '../plugin';
 import { ConfigSchema } from '..';
+import { ObservabilityRuleTypeRegistry } from '../rules/create_observability_rule_type_registry';
 
 export interface PluginContextValue {
   appMountParameters: AppMountParameters;
   config: ConfigSchema;
   core: CoreStart;
   plugins: ObservabilityPublicPluginsStart;
-  observabilityRuleRegistry: ObservabilityRuleRegistry;
+  observabilityRuleTypeRegistry: ObservabilityRuleTypeRegistry;
 }
 
 export const PluginContext = createContext({} as PluginContextValue);
diff --git a/x-pack/plugins/observability/public/hooks/use_time_range.test.ts b/x-pack/plugins/observability/public/hooks/use_time_range.test.ts
index 43fbc18062b75..8808d6390e365 100644
--- a/x-pack/plugins/observability/public/hooks/use_time_range.test.ts
+++ b/x-pack/plugins/observability/public/hooks/use_time_range.test.ts
@@ -10,7 +10,7 @@ import * as pluginContext from './use_plugin_context';
 import { AppMountParameters, CoreStart } from 'kibana/public';
 import { ObservabilityPublicPluginsStart } from '../plugin';
 import * as kibanaUISettings from './use_kibana_ui_settings';
-import { createObservabilityRuleRegistryMock } from '../rules/observability_rule_registry_mock';
+import { createObservabilityRuleTypeRegistryMock } from '../rules/observability_rule_type_registry_mock';
 
 jest.mock('react-router-dom', () => ({
   useLocation: () => ({
@@ -39,7 +39,7 @@ describe('useTimeRange', () => {
           },
         },
       } as unknown) as ObservabilityPublicPluginsStart,
-      observabilityRuleRegistry: createObservabilityRuleRegistryMock(),
+      observabilityRuleTypeRegistry: createObservabilityRuleTypeRegistryMock(),
     }));
     jest.spyOn(kibanaUISettings, 'useKibanaUISettings').mockImplementation(() => ({
       from: '2020-10-08T05:00:00.000Z',
@@ -81,7 +81,7 @@ describe('useTimeRange', () => {
               },
             },
           } as unknown) as ObservabilityPublicPluginsStart,
-          observabilityRuleRegistry: createObservabilityRuleRegistryMock(),
+          observabilityRuleTypeRegistry: createObservabilityRuleTypeRegistryMock(),
         }));
       });
       it('returns ranges and absolute times from kibana default settings', () => {
diff --git a/x-pack/plugins/observability/public/index.ts b/x-pack/plugins/observability/public/index.ts
index a011d1fc2c414..1561cf515a58e 100644
--- a/x-pack/plugins/observability/public/index.ts
+++ b/x-pack/plugins/observability/public/index.ts
@@ -63,3 +63,6 @@ export { createExploratoryViewUrl } from './components/shared/exploratory_view/c
 export type { SeriesUrl } from './components/shared/exploratory_view/types';
 
 export { FormatterRuleRegistry } from './rules/formatter_rule_registry';
+
+export type { ObservabilityRuleTypeRegistry } from './rules/create_observability_rule_type_registry';
+export { createObservabilityRuleTypeRegistryMock } from './rules/observability_rule_type_registry_mock';
diff --git a/x-pack/plugins/observability/public/pages/alerts/alerts.stories.tsx b/x-pack/plugins/observability/public/pages/alerts/alerts.stories.tsx
index 6940f6aaad692..0d47f3da89d36 100644
--- a/x-pack/plugins/observability/public/pages/alerts/alerts.stories.tsx
+++ b/x-pack/plugins/observability/public/pages/alerts/alerts.stories.tsx
@@ -13,7 +13,7 @@ import { AlertsPage } from '.';
 import { HttpSetup } from '../../../../../../src/core/public';
 import { KibanaContextProvider } from '../../../../../../src/plugins/kibana_react/public';
 import { PluginContext, PluginContextValue } from '../../context/plugin_context';
-import { createObservabilityRuleRegistryMock } from '../../rules/observability_rule_registry_mock';
+import { createObservabilityRuleTypeRegistryMock } from '../../rules/observability_rule_type_registry_mock';
 import { createCallObservabilityApi } from '../../services/call_observability_api';
 import type { ObservabilityAPIReturnType } from '../../services/call_observability_api/types';
 import { apmAlertResponseExample, dynamicIndexPattern } from './example_data';
@@ -62,7 +62,7 @@ export default {
                     core: {
                       http: { basePath: { prepend: (_: string) => '' } },
                     },
-                    observabilityRuleRegistry: createObservabilityRuleRegistryMock(),
+                    observabilityRuleTypeRegistry: createObservabilityRuleTypeRegistryMock(),
                   } as unknown) as PluginContextValue
                 }
               >
diff --git a/x-pack/plugins/observability/public/pages/alerts/alerts_flyout/alerts_flyout.stories.tsx b/x-pack/plugins/observability/public/pages/alerts/alerts_flyout/alerts_flyout.stories.tsx
index 96d3c1fc9c390..90c75a70c0813 100644
--- a/x-pack/plugins/observability/public/pages/alerts/alerts_flyout/alerts_flyout.stories.tsx
+++ b/x-pack/plugins/observability/public/pages/alerts/alerts_flyout/alerts_flyout.stories.tsx
@@ -62,25 +62,26 @@ Example.args = {
     reason: 'Error count for opbeans-java was above the threshold',
     active: true,
     start: 1618235449493,
-
-    'rule.id': 'apm.error_rate',
-    'service.environment': 'production',
-    'service.name': 'opbeans-java',
-    'rule.name': 'Error count threshold | opbeans-java (smith test)',
-    'kibana.rac.alert.duration.us': 61787000,
-    'kibana.observability.evaluation.threshold': 0,
-    'kibana.rac.alert.status': 'open',
-    tags: ['apm', 'service.name:opbeans-java'],
-    'kibana.rac.alert.uuid': 'c50fbc70-0d77-462d-ac0a-f2bd0b8512e4',
-    'rule.uuid': '474920d0-93e9-11eb-ac86-0b455460de81',
-    'event.action': 'active',
-    '@timestamp': '2021-04-14T21:43:42.966Z',
-    'kibana.rac.alert.id': 'apm.error_rate_opbeans-java_production',
-    'processor.event': 'error',
-    'kibana.rac.alert.start': '2021-04-14T21:42:41.179Z',
-    'kibana.rac.producer': 'apm',
-    'event.kind': 'state',
-    'rule.category': 'Error count threshold',
-    'kibana.observability.evaluation.value': 1,
+    fields: {
+      'rule.id': 'apm.error_rate',
+      'service.environment': ['production'],
+      'service.name': ['opbeans-java'],
+      'rule.name': 'Error count threshold | opbeans-java (smith test)',
+      'kibana.rac.alert.duration.us': 61787000,
+      'kibana.rac.alert.evaluation.threshold': 0,
+      'kibana.rac.alert.status': 'open',
+      tags: ['apm', 'service.name:opbeans-java'],
+      'kibana.rac.alert.uuid': 'c50fbc70-0d77-462d-ac0a-f2bd0b8512e4',
+      'rule.uuid': '474920d0-93e9-11eb-ac86-0b455460de81',
+      'event.action': 'active',
+      '@timestamp': '2021-04-14T21:43:42.966Z',
+      'kibana.rac.alert.id': 'apm.error_rate_opbeans-java_production',
+      'processor.event': ['error'],
+      'kibana.rac.alert.start': '2021-04-14T21:42:41.179Z',
+      'kibana.rac.producer': 'apm',
+      'event.kind': 'state',
+      'rule.category': 'Error count threshold',
+      'kibana.rac.alert.evaluation.value': 1,
+    },
   },
 } as Args;
diff --git a/x-pack/plugins/observability/public/pages/alerts/alerts_flyout/index.tsx b/x-pack/plugins/observability/public/pages/alerts/alerts_flyout/index.tsx
index 09fe464aa8cb5..4856686f0495e 100644
--- a/x-pack/plugins/observability/public/pages/alerts/alerts_flyout/index.tsx
+++ b/x-pack/plugins/observability/public/pages/alerts/alerts_flyout/index.tsx
@@ -23,6 +23,14 @@ import { i18n } from '@kbn/i18n';
 import moment from 'moment-timezone';
 import React from 'react';
 import { TopAlert } from '../';
+import {
+  ALERT_DURATION,
+  ALERT_EVALUATION_THRESHOLD,
+  ALERT_EVALUATION_VALUE,
+  ALERT_SEVERITY_LEVEL,
+  RULE_CATEGORY,
+  RULE_NAME,
+} from '../../../../../rule_registry/common/technical_rule_data_field_names';
 import { useUiSetting } from '../../../../../../../src/plugins/kibana_react/public';
 import { asDuration } from '../../../../common/utils/formatters';
 import { usePluginContext } from '../../../hooks/use_plugin_context';
@@ -46,7 +54,7 @@ export function AlertsFlyout({ onClose, alert }: AlertsFlyoutProps) {
       title: i18n.translate('xpack.observability.alertsFlyout.severityLabel', {
         defaultMessage: 'Severity',
       }),
-      description: <SeverityBadge severityLevel={alert['kibana.rac.alert.severity.level']} />,
+      description: <SeverityBadge severityLevel={alert.fields[ALERT_SEVERITY_LEVEL]} />,
     },
     {
       title: i18n.translate('xpack.observability.alertsFlyout.triggeredLabel', {
@@ -60,25 +68,25 @@ export function AlertsFlyout({ onClose, alert }: AlertsFlyoutProps) {
       title: i18n.translate('xpack.observability.alertsFlyout.durationLabel', {
         defaultMessage: 'Duration',
       }),
-      description: asDuration(alert['kibana.rac.alert.duration.us'], { extended: true }),
+      description: asDuration(alert.fields[ALERT_DURATION], { extended: true }),
     },
     {
       title: i18n.translate('xpack.observability.alertsFlyout.expectedValueLabel', {
         defaultMessage: 'Expected value',
       }),
-      description: alert['kibana.observability.evaluation.threshold'] ?? '-',
+      description: alert.fields[ALERT_EVALUATION_THRESHOLD] ?? '-',
     },
     {
       title: i18n.translate('xpack.observability.alertsFlyout.actualValueLabel', {
         defaultMessage: 'Actual value',
       }),
-      description: alert['kibana.observability.evaluation.value'] ?? '-',
+      description: alert.fields[ALERT_EVALUATION_VALUE] ?? '-',
     },
     {
       title: i18n.translate('xpack.observability.alertsFlyout.ruleTypeLabel', {
         defaultMessage: 'Rule type',
       }),
-      description: alert['rule.category'] ?? '-',
+      description: alert.fields[RULE_CATEGORY] ?? '-',
     },
   ];
 
@@ -86,7 +94,7 @@ export function AlertsFlyout({ onClose, alert }: AlertsFlyoutProps) {
     <EuiFlyout onClose={onClose} size="s">
       <EuiFlyoutHeader>
         <EuiTitle size="m">
-          <h2>{alert['rule.name']}</h2>
+          <h2>{alert.fields[RULE_NAME]}</h2>
         </EuiTitle>
         <EuiSpacer size="s" />
         <EuiText size="s">{alert.reason}</EuiText>
diff --git a/x-pack/plugins/observability/public/pages/alerts/alerts_table.tsx b/x-pack/plugins/observability/public/pages/alerts/alerts_table.tsx
index b0ff156fde377..5a7317da95f88 100644
--- a/x-pack/plugins/observability/public/pages/alerts/alerts_table.tsx
+++ b/x-pack/plugins/observability/public/pages/alerts/alerts_table.tsx
@@ -16,6 +16,10 @@ import {
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import React, { useState } from 'react';
+import {
+  ALERT_DURATION,
+  ALERT_SEVERITY_LEVEL,
+} from '../../../../rule_registry/common/technical_rule_data_field_names';
 import { asDuration } from '../../../common/utils/formatters';
 import { TimestampTooltip } from '../../components/shared/timestamp_tooltip';
 import { usePluginContext } from '../../hooks/use_plugin_context';
@@ -94,9 +98,7 @@ export function AlertsTable(props: AlertsTableProps) {
       }),
       render: (_, alert) => {
         const { active } = alert;
-        return active
-          ? null
-          : asDuration(alert['kibana.rac.alert.duration.us'], { extended: true });
+        return active ? null : asDuration(alert.fields[ALERT_DURATION], { extended: true });
       },
     },
     {
@@ -105,7 +107,7 @@ export function AlertsTable(props: AlertsTableProps) {
         defaultMessage: 'Severity',
       }),
       render: (_, alert) => {
-        return <SeverityBadge severityLevel={alert['kibana.rac.alert.severity.level']} />;
+        return <SeverityBadge severityLevel={alert.fields[ALERT_SEVERITY_LEVEL]} />;
       },
     },
     {
diff --git a/x-pack/plugins/observability/public/pages/alerts/example_data.ts b/x-pack/plugins/observability/public/pages/alerts/example_data.ts
index dba6f1e9aaa2f..5318fce82c1d3 100644
--- a/x-pack/plugins/observability/public/pages/alerts/example_data.ts
+++ b/x-pack/plugins/observability/public/pages/alerts/example_data.ts
@@ -7,42 +7,42 @@
 
 export const apmAlertResponseExample = [
   {
-    'rule.id': 'apm.error_rate',
-    'service.name': 'opbeans-java',
-    'rule.name': 'Error count threshold | opbeans-java (smith test)',
-    'kibana.rac.alert.duration.us': 180057000,
-    'kibana.rac.alert.status': 'open',
-    'kibana.rac.alert.severity.level': 'warning',
+    'rule.id': ['apm.error_rate'],
+    'service.name': ['opbeans-java'],
+    'rule.name': ['Error count threshold | opbeans-java (smith test)'],
+    'kibana.rac.alert.duration.us': [180057000],
+    'kibana.rac.alert.status': ['open'],
+    'kibana.rac.alert.severity.level': ['warning'],
     tags: ['apm', 'service.name:opbeans-java'],
-    'kibana.rac.alert.uuid': '0175ec0a-a3b1-4d41-b557-e21c2d024352',
-    'rule.uuid': '474920d0-93e9-11eb-ac86-0b455460de81',
-    'event.action': 'active',
-    '@timestamp': '2021-04-12T13:53:49.550Z',
-    'kibana.rac.alert.id': 'apm.error_rate_opbeans-java_production',
-    'kibana.rac.alert.start': '2021-04-12T13:50:49.493Z',
-    'kibana.rac.producer': 'apm',
-    'event.kind': 'state',
-    'rule.category': 'Error count threshold',
+    'kibana.rac.alert.uuid': ['0175ec0a-a3b1-4d41-b557-e21c2d024352'],
+    'rule.uuid': ['474920d0-93e9-11eb-ac86-0b455460de81'],
+    'event.action': ['active'],
+    '@timestamp': ['2021-04-12T13:53:49.550Z'],
+    'kibana.rac.alert.id': ['apm.error_rate_opbeans-java_production'],
+    'kibana.rac.alert.start': ['2021-04-12T13:50:49.493Z'],
+    'kibana.rac.producer': ['apm'],
+    'event.kind': ['state'],
+    'rule.category': ['Error count threshold'],
     'service.environment': ['production'],
     'processor.event': ['error'],
   },
   {
-    'rule.id': 'apm.error_rate',
-    'service.name': 'opbeans-java',
-    'rule.name': 'Error count threshold | opbeans-java (smith test)',
-    'kibana.rac.alert.duration.us': 2419005000,
-    'kibana.rac.alert.end': '2021-04-12T13:49:49.446Z',
-    'kibana.rac.alert.status': 'closed',
+    'rule.id': ['apm.error_rate'],
+    'service.name': ['opbeans-java'],
+    'rule.name': ['Error count threshold | opbeans-java (smith test)'],
+    'kibana.rac.alert.duration.us': [2419005000],
+    'kibana.rac.alert.end': ['2021-04-12T13:49:49.446Z'],
+    'kibana.rac.alert.status': ['closed'],
     tags: ['apm', 'service.name:opbeans-java'],
-    'kibana.rac.alert.uuid': '32b940e1-3809-4c12-8eee-f027cbb385e2',
-    'rule.uuid': '474920d0-93e9-11eb-ac86-0b455460de81',
-    'event.action': 'close',
-    '@timestamp': '2021-04-12T13:49:49.446Z',
-    'kibana.rac.alert.id': 'apm.error_rate_opbeans-java_production',
-    'kibana.rac.alert.start': '2021-04-12T13:09:30.441Z',
-    'kibana.rac.producer': 'apm',
-    'event.kind': 'state',
-    'rule.category': 'Error count threshold',
+    'kibana.rac.alert.uuid': ['32b940e1-3809-4c12-8eee-f027cbb385e2'],
+    'rule.uuid': ['474920d0-93e9-11eb-ac86-0b455460de81'],
+    'event.action': ['close'],
+    '@timestamp': ['2021-04-12T13:49:49.446Z'],
+    'kibana.rac.alert.id': ['apm.error_rate_opbeans-java_production'],
+    'kibana.rac.alert.start': ['2021-04-12T13:09:30.441Z'],
+    'kibana.rac.producer': ['apm'],
+    'event.kind': ['state'],
+    'rule.category': ['Error count threshold'],
     'service.environment': ['production'],
     'processor.event': ['error'],
   },
diff --git a/x-pack/plugins/observability/public/pages/alerts/index.tsx b/x-pack/plugins/observability/public/pages/alerts/index.tsx
index a6d5c6926973e..ef7805d3be81c 100644
--- a/x-pack/plugins/observability/public/pages/alerts/index.tsx
+++ b/x-pack/plugins/observability/public/pages/alerts/index.tsx
@@ -18,6 +18,17 @@ import React from 'react';
 import { useHistory } from 'react-router-dom';
 import { format, parse } from 'url';
 import { asDuration, asPercent } from '../../../common/utils/formatters';
+import {
+  ParsedTechnicalFields,
+  parseTechnicalFields,
+} from '../../../../rule_registry/common/parse_technical_fields';
+import {
+  ALERT_START,
+  EVENT_ACTION,
+  RULE_ID,
+  RULE_NAME,
+} from '../../../../rule_registry/common/technical_rule_data_field_names';
+import type { ObservabilityAPIReturnType } from '../../services/call_observability_api/types';
 import { ExperimentalBadge } from '../../components/shared/experimental_badge';
 import { useFetcher } from '../../hooks/use_fetcher';
 import { usePluginContext } from '../../hooks/use_plugin_context';
@@ -30,7 +41,8 @@ import { AlertsTable } from './alerts_table';
 
 export type TopAlertResponse = ObservabilityAPIReturnType<'GET /api/observability/rules/alerts/top'>[number];
 
-export interface TopAlert extends TopAlertResponse {
+export interface TopAlert {
+  fields: ParsedTechnicalFields;
   start: number;
   reason: string;
   link?: string;
@@ -42,7 +54,7 @@ interface AlertsPageProps {
 }
 
 export function AlertsPage({ routeParams }: AlertsPageProps) {
-  const { core, observabilityRuleRegistry } = usePluginContext();
+  const { core, observabilityRuleTypeRegistry } = usePluginContext();
   const { prepend } = core.http.basePath;
   const history = useHistory();
   const {
@@ -74,18 +86,19 @@ export function AlertsPage({ routeParams }: AlertsPageProps) {
         },
       }).then((alerts) => {
         return alerts.map((alert) => {
-          const ruleType = observabilityRuleRegistry.getTypeByRuleId(alert['rule.id']);
+          const parsedFields = parseTechnicalFields(alert);
+          const formatter = observabilityRuleTypeRegistry.getFormatter(parsedFields[RULE_ID]!);
           const formatted = {
             link: undefined,
-            reason: alert['rule.name'],
-            ...(ruleType?.format?.({ alert, formatters: { asDuration, asPercent } }) ?? {}),
+            reason: parsedFields[RULE_NAME]!,
+            ...(formatter?.({ fields: parsedFields, formatters: { asDuration, asPercent } }) ?? {}),
           };
 
           const parsedLink = formatted.link ? parse(formatted.link, true) : undefined;
 
           return {
-            ...alert,
             ...formatted,
+            fields: parsedFields,
             link: parsedLink
               ? format({
                   ...parsedLink,
@@ -96,13 +109,13 @@ export function AlertsPage({ routeParams }: AlertsPageProps) {
                   },
                 })
               : undefined,
-            active: alert['event.action'] !== 'close',
-            start: new Date(alert['kibana.rac.alert.start']).getTime(),
+            active: parsedFields[EVENT_ACTION] !== 'close',
+            start: new Date(parsedFields[ALERT_START]!).getTime(),
           };
         });
       });
     },
-    [kuery, observabilityRuleRegistry, rangeFrom, rangeTo]
+    [kuery, observabilityRuleTypeRegistry, rangeFrom, rangeTo]
   );
 
   return (
diff --git a/x-pack/plugins/observability/public/pages/overview/overview.stories.tsx b/x-pack/plugins/observability/public/pages/overview/overview.stories.tsx
index 559aa8d5884a9..ebd1c73859169 100644
--- a/x-pack/plugins/observability/public/pages/overview/overview.stories.tsx
+++ b/x-pack/plugins/observability/public/pages/overview/overview.stories.tsx
@@ -23,7 +23,7 @@ import { emptyResponse as emptyLogsResponse, fetchLogsData } from './mock/logs.m
 import { emptyResponse as emptyMetricsResponse, fetchMetricsData } from './mock/metrics.mock';
 import { newsFeedFetchData } from './mock/news_feed.mock';
 import { emptyResponse as emptyUptimeResponse, fetchUptimeData } from './mock/uptime.mock';
-import { createObservabilityRuleRegistryMock } from '../../rules/observability_rule_registry_mock';
+import { createObservabilityRuleTypeRegistryMock } from '../../rules/observability_rule_type_registry_mock';
 
 function unregisterAll() {
   unregisterDataHandler({ appName: 'apm' });
@@ -54,7 +54,7 @@ const withCore = makeDecorator({
                 },
               },
             } as unknown) as ObservabilityPublicPluginsStart,
-            observabilityRuleRegistry: createObservabilityRuleRegistryMock(),
+            observabilityRuleTypeRegistry: createObservabilityRuleTypeRegistryMock(),
           }}
         >
           <EuiThemeProvider>
diff --git a/x-pack/plugins/observability/public/plugin.ts b/x-pack/plugins/observability/public/plugin.ts
index 5779dd11f816d..6856bc97b4a36 100644
--- a/x-pack/plugins/observability/public/plugin.ts
+++ b/x-pack/plugins/observability/public/plugin.ts
@@ -7,6 +7,10 @@
 
 import { i18n } from '@kbn/i18n';
 import { BehaviorSubject } from 'rxjs';
+import {
+  TriggersAndActionsUIPublicPluginSetup,
+  TriggersAndActionsUIPublicPluginStart,
+} from '../../triggers_actions_ui/public';
 import {
   AppMountParameters,
   AppUpdater,
@@ -29,17 +33,19 @@ import { registerDataHandler } from './data_handler';
 import { createCallObservabilityApi } from './services/call_observability_api';
 import { toggleOverviewLinkInNav } from './toggle_overview_link_in_nav';
 import { ConfigSchema } from '.';
-import { createObservabilityRuleRegistry } from './rules/create_observability_rule_registry';
+import { createObservabilityRuleTypeRegistry } from './rules/create_observability_rule_type_registry';
 
 export type ObservabilityPublicSetup = ReturnType<Plugin['setup']>;
 
 export interface ObservabilityPublicPluginsSetup {
   data: DataPublicPluginSetup;
+  triggersActionsUi: TriggersAndActionsUIPublicPluginSetup;
   home?: HomePublicPluginSetup;
 }
 
 export interface ObservabilityPublicPluginsStart {
   home?: HomePublicPluginStart;
+  triggersActionsUi: TriggersAndActionsUIPublicPluginStart;
   data: DataPublicPluginStart;
   lens: LensPublicStart;
 }
@@ -70,7 +76,9 @@ export class Plugin
 
     createCallObservabilityApi(coreSetup.http);
 
-    const observabilityRuleRegistry = createObservabilityRuleRegistry();
+    const observabilityRuleTypeRegistry = createObservabilityRuleTypeRegistry(
+      pluginsSetup.triggersActionsUi.alertTypeRegistry
+    );
 
     const mount = async (params: AppMountParameters<unknown>) => {
       // Load application bundle
@@ -83,7 +91,7 @@ export class Plugin
         core: coreStart,
         plugins: pluginsStart,
         appMountParameters: params,
-        observabilityRuleRegistry,
+        observabilityRuleTypeRegistry,
       });
     };
 
@@ -156,7 +164,7 @@ export class Plugin
 
     return {
       dashboard: { register: registerDataHandler },
-      ruleRegistry: observabilityRuleRegistry,
+      observabilityRuleTypeRegistry,
       isAlertingExperienceEnabled: () => config.unsafe.alertingExperience.enabled,
     };
   }
diff --git a/x-pack/plugins/observability/public/rules/create_observability_rule_registry.ts b/x-pack/plugins/observability/public/rules/create_observability_rule_registry.ts
deleted file mode 100644
index 455a817edc0d2..0000000000000
--- a/x-pack/plugins/observability/public/rules/create_observability_rule_registry.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import type { TechnicalRuleDataFieldName } from '../../../rule_registry/common/technical_rule_data_field_names';
-
-type Formatter = (
-  fields: Record<TechnicalRuleDataFieldName, unknown[]>
-) => { reason: string; link: string };
-
-export function createObservabilityRuleRegistry() {
-  const formatters: Formatter[] = [];
-  return {
-    registerFormatter: (typeId: string, formatter: Formatter) => {},
-    getFormatters: () => formatters.concat(),
-  };
-}
-
-export type ObservabilityRuleRegistry = ReturnType<typeof createObservabilityRuleRegistry>;
diff --git a/x-pack/plugins/observability/public/rules/create_observability_rule_type_registry.ts b/x-pack/plugins/observability/public/rules/create_observability_rule_type_registry.ts
new file mode 100644
index 0000000000000..cba9df83c6fe3
--- /dev/null
+++ b/x-pack/plugins/observability/public/rules/create_observability_rule_type_registry.ts
@@ -0,0 +1,31 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { AlertTypeModel, AlertTypeRegistryContract } from '../../../triggers_actions_ui/public';
+import { ParsedTechnicalFields } from '../../../rule_registry/common/parse_technical_fields';
+import { AsDuration, AsPercent } from '../../common/utils/formatters';
+
+type Formatter = (options: {
+  fields: ParsedTechnicalFields & Record<string, any>;
+  formatters: { asDuration: AsDuration; asPercent: AsPercent };
+}) => { reason: string; link: string };
+
+export function createObservabilityRuleTypeRegistry(alertTypeRegistry: AlertTypeRegistryContract) {
+  const formatters: Array<{ typeId: string; fn: Formatter }> = [];
+  return {
+    register: (type: AlertTypeModel<any> & { format: Formatter }) => {
+      const { format, ...rest } = type;
+      formatters.push({ typeId: type.id, fn: format });
+      alertTypeRegistry.register(rest);
+    },
+    getFormatter: (typeId: string) => {
+      return formatters.find((formatter) => formatter.typeId === typeId)?.fn;
+    },
+  };
+}
+
+export type ObservabilityRuleTypeRegistry = ReturnType<typeof createObservabilityRuleTypeRegistry>;
diff --git a/x-pack/plugins/observability/public/rules/observability_rule_registry_mock.ts b/x-pack/plugins/observability/public/rules/observability_rule_registry_mock.ts
deleted file mode 100644
index 1daa915bd0a6d..0000000000000
--- a/x-pack/plugins/observability/public/rules/observability_rule_registry_mock.ts
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { ObservabilityRuleRegistry } from './create_observability_rule_registry';
-
-const createRuleRegistryMock = () => ({
-  registerFormatter: () => {},
-});
-
-export const createObservabilityRuleRegistryMock = () =>
-  createRuleRegistryMock() as ObservabilityRuleRegistry & ReturnType<typeof createRuleRegistryMock>;
diff --git a/x-pack/plugins/observability/public/rules/observability_rule_type_registry_mock.ts b/x-pack/plugins/observability/public/rules/observability_rule_type_registry_mock.ts
new file mode 100644
index 0000000000000..b2cf48f8e1c32
--- /dev/null
+++ b/x-pack/plugins/observability/public/rules/observability_rule_type_registry_mock.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ObservabilityRuleTypeRegistry } from './create_observability_rule_type_registry';
+
+const createRuleTypeRegistryMock = () => ({
+  registerFormatter: () => {},
+});
+
+export const createObservabilityRuleTypeRegistryMock = () =>
+  createRuleTypeRegistryMock() as ObservabilityRuleTypeRegistry &
+    ReturnType<typeof createRuleTypeRegistryMock>;
diff --git a/x-pack/plugins/observability/public/utils/test_helper.tsx b/x-pack/plugins/observability/public/utils/test_helper.tsx
index 63e34b018aed0..ef7c62a143f25 100644
--- a/x-pack/plugins/observability/public/utils/test_helper.tsx
+++ b/x-pack/plugins/observability/public/utils/test_helper.tsx
@@ -15,7 +15,7 @@ import translations from '../../../translations/translations/ja-JP.json';
 import { PluginContext } from '../context/plugin_context';
 import { ObservabilityPublicPluginsStart } from '../plugin';
 import { EuiThemeProvider } from '../../../../../src/plugins/kibana_react/common';
-import { createObservabilityRuleRegistryMock } from '../rules/observability_rule_registry_mock';
+import { createObservabilityRuleTypeRegistryMock } from '../rules/observability_rule_type_registry_mock';
 
 const appMountParameters = ({ setHeaderActionMenu: () => {} } as unknown) as AppMountParameters;
 
@@ -37,14 +37,14 @@ const plugins = ({
   data: { query: { timefilter: { timefilter: { setTime: jest.fn() } } } },
 } as unknown) as ObservabilityPublicPluginsStart;
 
-const observabilityRuleRegistry = createObservabilityRuleRegistryMock();
+const observabilityRuleTypeRegistry = createObservabilityRuleTypeRegistryMock();
 
 export const render = (component: React.ReactNode) => {
   return testLibRender(
     <IntlProvider locale="en-US" messages={translations.messages}>
       <KibanaContextProvider services={{ ...core }}>
         <PluginContext.Provider
-          value={{ appMountParameters, config, core, plugins, observabilityRuleRegistry }}
+          value={{ appMountParameters, config, core, plugins, observabilityRuleTypeRegistry }}
         >
           <EuiThemeProvider>{component}</EuiThemeProvider>
         </PluginContext.Provider>
diff --git a/x-pack/plugins/observability/server/lib/rules/get_top_alerts.ts b/x-pack/plugins/observability/server/lib/rules/get_top_alerts.ts
index 9ac860b5a37a6..52043efc506e8 100644
--- a/x-pack/plugins/observability/server/lib/rules/get_top_alerts.ts
+++ b/x-pack/plugins/observability/server/lib/rules/get_top_alerts.ts
@@ -41,6 +41,7 @@ export async function getTopAlerts({
       },
       _source: false,
     },
+    allow_no_indices: true,
   });
 
   return response.hits.hits.map((hit) => {
diff --git a/x-pack/plugins/observability/server/plugin.ts b/x-pack/plugins/observability/server/plugin.ts
index 8b02d9c8225d2..046a9a62d5fa7 100644
--- a/x-pack/plugins/observability/server/plugin.ts
+++ b/x-pack/plugins/observability/server/plugin.ts
@@ -52,12 +52,11 @@ export class ObservabilityPlugin implements Plugin<ObservabilityPluginSetup> {
     const start = () => core.getStartServices().then(([coreStart]) => coreStart);
 
     const ruleDataClient = new RuleDataClient({
-      ready: async () => {
+      getClusterClient: async () => {
         const coreStart = await start();
-        return {
-          clusterClient: coreStart.elasticsearch.client.asInternalUser,
-        };
+        return coreStart.elasticsearch.client.asInternalUser;
       },
+      ready: () => Promise.resolve(),
       alias: plugins.ruleRegistry.getFullAssetName(),
     });
 
diff --git a/x-pack/plugins/observability/server/routes/rules.ts b/x-pack/plugins/observability/server/routes/rules.ts
index 848f0489985fc..1f500adff5dcf 100644
--- a/x-pack/plugins/observability/server/routes/rules.ts
+++ b/x-pack/plugins/observability/server/routes/rules.ts
@@ -48,7 +48,7 @@ const alertsDynamicIndexPatternRoute = createObservabilityServerRoute({
     tags: [],
   },
   handler: async ({ ruleDataClient }) => {
-    const reader = ruleDataClient.getReader();
+    const reader = ruleDataClient.getReader({ namespace: 'observability' });
 
     return reader.getDynamicIndexPattern();
   },
diff --git a/x-pack/plugins/rule_registry/server/assets/component_templates/ecs_component_template.ts b/x-pack/plugins/rule_registry/common/assets/component_templates/ecs_component_template.ts
similarity index 81%
rename from x-pack/plugins/rule_registry/server/assets/component_templates/ecs_component_template.ts
rename to x-pack/plugins/rule_registry/common/assets/component_templates/ecs_component_template.ts
index 45e6b9a748cbf..7acbe0bc1227b 100644
--- a/x-pack/plugins/rule_registry/server/assets/component_templates/ecs_component_template.ts
+++ b/x-pack/plugins/rule_registry/common/assets/component_templates/ecs_component_template.ts
@@ -5,8 +5,8 @@
  * 2.0.
  */
 import { merge } from 'lodash';
-import { ClusterPutComponentTemplateBody } from '../../rule_data_plugin_service/types';
-import { mappingFromFieldMap } from '../../utils/mapping_from_field_map';
+import { mappingFromFieldMap } from '../../mapping_from_field_map';
+import { ClusterPutComponentTemplateBody } from '../../types';
 import { ecsFieldMap } from '../field_maps/ecs_field_map';
 import { technicalRuleFieldMap } from '../field_maps/technical_rule_field_map';
 
diff --git a/x-pack/plugins/rule_registry/server/assets/component_templates/technical_component_template.ts b/x-pack/plugins/rule_registry/common/assets/component_templates/technical_component_template.ts
similarity index 76%
rename from x-pack/plugins/rule_registry/server/assets/component_templates/technical_component_template.ts
rename to x-pack/plugins/rule_registry/common/assets/component_templates/technical_component_template.ts
index 46aaa8845ca21..cc096faba387e 100644
--- a/x-pack/plugins/rule_registry/server/assets/component_templates/technical_component_template.ts
+++ b/x-pack/plugins/rule_registry/common/assets/component_templates/technical_component_template.ts
@@ -5,8 +5,8 @@
  * 2.0.
  */
 
-import { ClusterPutComponentTemplateBody } from '../../rule_data_plugin_service/types';
-import { mappingFromFieldMap } from '../../utils/mapping_from_field_map';
+import { mappingFromFieldMap } from '../../mapping_from_field_map';
+import { ClusterPutComponentTemplateBody } from '../../types';
 import { technicalRuleFieldMap } from '../field_maps/technical_rule_field_map';
 
 export const technicalComponentTemplate: ClusterPutComponentTemplateBody = {
diff --git a/x-pack/plugins/rule_registry/server/assets/field_maps/ecs_field_map.ts b/x-pack/plugins/rule_registry/common/assets/field_maps/ecs_field_map.ts
similarity index 100%
rename from x-pack/plugins/rule_registry/server/assets/field_maps/ecs_field_map.ts
rename to x-pack/plugins/rule_registry/common/assets/field_maps/ecs_field_map.ts
diff --git a/x-pack/plugins/rule_registry/server/assets/field_maps/technical_rule_field_map.ts b/x-pack/plugins/rule_registry/common/assets/field_maps/technical_rule_field_map.ts
similarity index 100%
rename from x-pack/plugins/rule_registry/server/assets/field_maps/technical_rule_field_map.ts
rename to x-pack/plugins/rule_registry/common/assets/field_maps/technical_rule_field_map.ts
diff --git a/x-pack/plugins/rule_registry/server/assets/index_templates/base_index_template.ts b/x-pack/plugins/rule_registry/common/assets/index_templates/base_index_template.ts
similarity index 100%
rename from x-pack/plugins/rule_registry/server/assets/index_templates/base_index_template.ts
rename to x-pack/plugins/rule_registry/common/assets/index_templates/base_index_template.ts
diff --git a/x-pack/plugins/rule_registry/server/assets/lifecycle_policies/default_lifecycle_policy.ts b/x-pack/plugins/rule_registry/common/assets/lifecycle_policies/default_lifecycle_policy.ts
similarity index 100%
rename from x-pack/plugins/rule_registry/server/assets/lifecycle_policies/default_lifecycle_policy.ts
rename to x-pack/plugins/rule_registry/common/assets/lifecycle_policies/default_lifecycle_policy.ts
diff --git a/x-pack/plugins/rule_registry/common/index.ts b/x-pack/plugins/rule_registry/common/index.ts
index b614feebc974a..5d36cd8cad7be 100644
--- a/x-pack/plugins/rule_registry/common/index.ts
+++ b/x-pack/plugins/rule_registry/common/index.ts
@@ -4,5 +4,4 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-export * from './field_map';
-export * from './pick_with_patterns';
+export { parseTechnicalFields } from './parse_technical_fields';
diff --git a/x-pack/plugins/rule_registry/server/utils/mapping_from_field_map.ts b/x-pack/plugins/rule_registry/common/mapping_from_field_map.ts
similarity index 94%
rename from x-pack/plugins/rule_registry/server/utils/mapping_from_field_map.ts
rename to x-pack/plugins/rule_registry/common/mapping_from_field_map.ts
index 436b9faa20dce..17eb5ae8967af 100644
--- a/x-pack/plugins/rule_registry/server/utils/mapping_from_field_map.ts
+++ b/x-pack/plugins/rule_registry/common/mapping_from_field_map.ts
@@ -7,7 +7,7 @@
 
 import { TypeMapping } from '@elastic/elasticsearch/api/types';
 import { set } from '@elastic/safer-lodash-set';
-import { FieldMap } from '../../common';
+import { FieldMap } from './field_map/types';
 
 export function mappingFromFieldMap(fieldMap: FieldMap): TypeMapping {
   const mappings = {
diff --git a/x-pack/plugins/rule_registry/server/utils/parse_technical_fields.ts b/x-pack/plugins/rule_registry/common/parse_technical_fields.ts
similarity index 84%
rename from x-pack/plugins/rule_registry/server/utils/parse_technical_fields.ts
rename to x-pack/plugins/rule_registry/common/parse_technical_fields.ts
index da07577c31424..9d92c657468a3 100644
--- a/x-pack/plugins/rule_registry/server/utils/parse_technical_fields.ts
+++ b/x-pack/plugins/rule_registry/common/parse_technical_fields.ts
@@ -7,8 +7,8 @@
 
 import { isLeft } from 'fp-ts/lib/Either';
 import { PathReporter } from 'io-ts/lib/PathReporter';
-import { runtimeTypeFromFieldMap } from '../../common';
-import { technicalRuleFieldMap } from '../assets/field_maps/technical_rule_field_map';
+import { technicalRuleFieldMap } from './assets/field_maps/technical_rule_field_map';
+import { runtimeTypeFromFieldMap } from './field_map';
 
 const technicalFieldRuntimeType = runtimeTypeFromFieldMap(technicalRuleFieldMap);
 
diff --git a/x-pack/plugins/rule_registry/server/rule_data_plugin_service/types.ts b/x-pack/plugins/rule_registry/common/types.ts
similarity index 100%
rename from x-pack/plugins/rule_registry/server/rule_data_plugin_service/types.ts
rename to x-pack/plugins/rule_registry/common/types.ts
diff --git a/x-pack/plugins/rule_registry/kibana.json b/x-pack/plugins/rule_registry/kibana.json
index ec2b366f739e6..7e3f8bf6afb72 100644
--- a/x-pack/plugins/rule_registry/kibana.json
+++ b/x-pack/plugins/rule_registry/kibana.json
@@ -10,6 +10,5 @@
     "alerting",
     "triggersActionsUi"
   ],
-  "server": true,
-  "ui": true
+  "server": true
 }
diff --git a/x-pack/plugins/rule_registry/server/index.ts b/x-pack/plugins/rule_registry/server/index.ts
index 8ac41497d3e94..08b043657bf98 100644
--- a/x-pack/plugins/rule_registry/server/index.ts
+++ b/x-pack/plugins/rule_registry/server/index.ts
@@ -11,6 +11,7 @@ import { RuleRegistryPlugin } from './plugin';
 
 export type { RuleRegistryPluginSetupContract, RuleRegistryPluginStartContract } from './plugin';
 export { RuleDataClient } from './rule_data_client';
+export { IRuleDataClient } from './rule_data_client/types';
 export { getRuleExecutorData, RuleExecutorData } from './utils/get_rule_executor_data';
 export { createLifecycleRuleTypeFactory } from './utils/create_lifecycle_rule_type_factory';
 export { createPersistenceRuleTypeFactory } from './rule_registry/rule_type_helpers/create_persistence_rule_type_factory';
diff --git a/x-pack/plugins/rule_registry/server/plugin.ts b/x-pack/plugins/rule_registry/server/plugin.ts
index 12eb06c93bde0..86eaa1661a884 100644
--- a/x-pack/plugins/rule_registry/server/plugin.ts
+++ b/x-pack/plugins/rule_registry/server/plugin.ts
@@ -6,17 +6,8 @@
  */
 
 import { PluginInitializerContext, Plugin, CoreSetup } from 'src/core/server';
-import { once } from 'lodash';
 import { RuleDataPluginService } from './rule_data_plugin_service';
 import { RuleRegistryPluginConfig } from '.';
-import { technicalComponentTemplate } from './assets/component_templates/technical_component_template';
-import {
-  DEFAULT_ILM_POLICY_ID,
-  ECS_COMPONENT_TEMPLATE_NAME,
-  TECHNICAL_COMPONENT_TEMPLATE_NAME,
-} from '../common/assets';
-import { ecsComponentTemplate } from './assets/component_templates/ecs_component_template';
-import { defaultLifecyclePolicy } from './assets/lifecycle_policies/default_lifecycle_policy';
 
 export type RuleRegistryPluginSetupContract = RuleDataPluginService;
 export type RuleRegistryPluginStartContract = void;
@@ -32,46 +23,24 @@ export class RuleRegistryPlugin implements Plugin<RuleRegistryPluginSetupContrac
 
     const logger = this.initContext.logger.get();
 
-    const ready = once(async () => {
-      logger.debug('Installing assets');
-
-      const startServicesPromise = core.getStartServices();
-
-      await service.createOrUpdateLifecyclePolicy({
-        policy_id: service.getFullAssetName(DEFAULT_ILM_POLICY_ID),
-        body: defaultLifecyclePolicy,
-      });
-
-      await service.createOrUpdateComponentTemplate({
-        name: service.getFullAssetName(TECHNICAL_COMPONENT_TEMPLATE_NAME),
-        body: technicalComponentTemplate,
-      });
-
-      await service.createOrUpdateComponentTemplate({
-        name: service.getFullAssetName(ECS_COMPONENT_TEMPLATE_NAME),
-        body: ecsComponentTemplate,
-      });
-
-      const [coreStart] = await startServicesPromise;
+    const service = new RuleDataPluginService({
+      logger,
+      isWriteEnabled: config.unsafe.write.enabled,
+      kibanaIndex: globalConfig.kibana.index,
+      getClusterClient: async () => {
+        const [coreStart] = await core.getStartServices();
 
-      return {
-        clusterClient: coreStart.elasticsearch.client.asInternalUser,
-      };
+        return coreStart.elasticsearch.client.asInternalUser;
+      },
     });
 
-    ready().catch((originalError) => {
+    service.init().catch((originalError) => {
       const error = new Error('Failed installing assets');
-      Object.assign(error, { originalError });
+      // @ts-ignore
+      error.stack = originalError.stack;
       logger.error(error);
     });
 
-    const service = new RuleDataPluginService({
-      logger,
-      isWriteEnabled: config.unsafe.write.enabled,
-      kibanaIndex: globalConfig.kibana.index,
-      ready,
-    });
-
     return service;
   }
 
diff --git a/x-pack/plugins/rule_registry/server/rule_data_client/index.ts b/x-pack/plugins/rule_registry/server/rule_data_client/index.ts
index b110091515d19..dfed305f32c9d 100644
--- a/x-pack/plugins/rule_registry/server/rule_data_client/index.ts
+++ b/x-pack/plugins/rule_registry/server/rule_data_client/index.ts
@@ -4,10 +4,9 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-
 import { TypeMapping } from '@elastic/elasticsearch/api/types';
 import { ResponseError } from '@elastic/elasticsearch/lib/errors';
-import { IndexPatternsFetcher } from 'src/plugins/data/server';
+import { IndexPatternsFetcher } from '../../../../../src/plugins/data/server';
 import {
   IRuleDataClient,
   RuleDataClientConstructorOptions,
@@ -23,32 +22,36 @@ export class RuleDataClient implements IRuleDataClient {
   constructor(private readonly options: RuleDataClientConstructorOptions) {}
 
   private async getClusterClient() {
-    const { clusterClient } = await this.options.ready();
-    return clusterClient;
+    await this.options.ready();
+    return await this.options.getClusterClient();
   }
 
-  getReader(): RuleDataReader {
+  getReader(options: { namespace?: string } = {}): RuleDataReader {
+    const index = `${[this.options.alias, options.namespace].filter(Boolean).join('-')}*`;
+
     return {
       search: async (request) => {
         const clusterClient = await this.getClusterClient();
 
-        return clusterClient.search({
+        const { body } = (await clusterClient.search({
           ...request,
-          index: this.options.alias,
-        }) as Promise<any>;
+          index,
+        })) as { body: any };
+
+        return body;
       },
-      getDynamicIndexPattern: async (pattern: string = this.options.alias) => {
+      getDynamicIndexPattern: async () => {
         const clusterClient = await this.getClusterClient();
         const indexPatternsFetcher = new IndexPatternsFetcher(clusterClient);
 
         const fields = await indexPatternsFetcher.getFieldsForWildcard({
-          pattern,
+          pattern: index,
         });
 
         return {
           fields,
           timeFieldName: '@timestamp',
-          title: pattern,
+          title: index,
         };
       },
     };
@@ -67,13 +70,20 @@ export class RuleDataClient implements IRuleDataClient {
           index: alias,
         };
 
-        return clusterClient.bulk(requestWithDefaultParameters).catch((error) => {
-          if (error instanceof ResponseError && error.name === 'index_not_found_exception') {
-            return this.createOrUpdateWriteTarget({ namespace }).then(() => {
-              return clusterClient.bulk(requestWithDefaultParameters);
-            });
+        return clusterClient.bulk(requestWithDefaultParameters).then((response) => {
+          if (response.body.errors) {
+            if (
+              response.body.items.length === 1 &&
+              response.body.items[0]?.index?.error?.type === 'index_not_found_exception'
+            ) {
+              return this.createOrUpdateWriteTarget({ namespace }).then(() => {
+                return clusterClient.bulk(requestWithDefaultParameters);
+              });
+            }
+            const error = new ResponseError(response);
+            throw error;
           }
-          throw error;
+          return response;
         });
       },
     };
diff --git a/x-pack/plugins/rule_registry/server/rule_data_client/types.ts b/x-pack/plugins/rule_registry/server/rule_data_client/types.ts
index 8868ee3dbb530..348fca6a58188 100644
--- a/x-pack/plugins/rule_registry/server/rule_data_client/types.ts
+++ b/x-pack/plugins/rule_registry/server/rule_data_client/types.ts
@@ -32,12 +32,13 @@ export interface RuleDataWriter {
 }
 
 export interface IRuleDataClient {
-  getReader(): RuleDataReader;
+  getReader(options?: { namespace?: string }): RuleDataReader;
   getWriter(options?: { namespace?: string }): RuleDataWriter;
   createOrUpdateWriteTarget(options: { namespace?: string }): Promise<void>;
 }
 
 export interface RuleDataClientConstructorOptions {
-  ready: () => Promise<{ clusterClient: ElasticsearchClient }>;
+  getClusterClient: () => Promise<ElasticsearchClient>;
+  ready: () => Promise<void>;
   alias: string;
 }
diff --git a/x-pack/plugins/rule_registry/server/rule_data_plugin_service/index.ts b/x-pack/plugins/rule_registry/server/rule_data_plugin_service/index.ts
index c11c3151a3259..d692546c51d64 100644
--- a/x-pack/plugins/rule_registry/server/rule_data_plugin_service/index.ts
+++ b/x-pack/plugins/rule_registry/server/rule_data_plugin_service/index.ts
@@ -4,15 +4,22 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-
 import { ClusterPutComponentTemplate } from '@elastic/elasticsearch/api/requestParams';
 import { estypes } from '@elastic/elasticsearch';
 import { ElasticsearchClient, Logger } from 'kibana/server';
-import { ClusterPutComponentTemplateBody } from './types';
 import { DEFAULT_ASSET_NAMESPACE } from '../../common/assets';
+import { technicalComponentTemplate } from '../../common/assets/component_templates/technical_component_template';
+import {
+  DEFAULT_ILM_POLICY_ID,
+  ECS_COMPONENT_TEMPLATE_NAME,
+  TECHNICAL_COMPONENT_TEMPLATE_NAME,
+} from '../../common/assets';
+import { ecsComponentTemplate } from '../../common/assets/component_templates/ecs_component_template';
+import { defaultLifecyclePolicy } from '../../common/assets/lifecycle_policies/default_lifecycle_policy';
+import { ClusterPutComponentTemplateBody } from '../../common/types';
 
 interface RuleDataPluginServiceConstructorOptions {
-  ready: () => Promise<{ clusterClient: ElasticsearchClient }>;
+  getClusterClient: () => Promise<ElasticsearchClient>;
   logger: Logger;
   isWriteEnabled: boolean;
   kibanaIndex: string;
@@ -21,26 +28,46 @@ interface RuleDataPluginServiceConstructorOptions {
 export class RuleDataPluginService {
   constructor(private readonly options: RuleDataPluginServiceConstructorOptions) {}
 
-  private async getClusterClient() {
-    const { clusterClient } = await this.options.ready();
+  async init() {
+    this.options.logger.info(`Installing assets in namespace ${this.getFullAssetName()}`);
+
+    await this.createOrUpdateLifecyclePolicy({
+      policy: this.getFullAssetName(DEFAULT_ILM_POLICY_ID),
+      body: defaultLifecyclePolicy,
+    });
+
+    await this.createOrUpdateComponentTemplate({
+      name: this.getFullAssetName(TECHNICAL_COMPONENT_TEMPLATE_NAME),
+      body: technicalComponentTemplate,
+    });
 
-    return clusterClient;
+    await this.createOrUpdateComponentTemplate({
+      name: this.getFullAssetName(ECS_COMPONENT_TEMPLATE_NAME),
+      body: ecsComponentTemplate,
+    });
+
+    this.options.logger.info(`Installed all assets`);
   }
 
   async createOrUpdateComponentTemplate(
     template: ClusterPutComponentTemplate<ClusterPutComponentTemplateBody>
   ) {
-    const clusterClient = await this.getClusterClient();
+    this.options.logger.debug(`Installing component template ${template.name}`);
+    const clusterClient = await this.options.getClusterClient();
     return clusterClient.cluster.putComponentTemplate(template);
   }
 
-  async createOrUpdateIndexTemplate(template: estypes.PutIndexTemplateRequest) {
-    const clusterClient = await this.getClusterClient();
+  async createOrUpdateIndexTemplate(
+    template: estypes.PutIndexTemplateRequest & { body?: { composed_of?: string[] } }
+  ) {
+    this.options.logger.debug(`Installing index template ${template.name}`);
+    const clusterClient = await this.options.getClusterClient();
     return clusterClient.indices.putIndexTemplate(template);
   }
 
   async createOrUpdateLifecyclePolicy(policy: estypes.PutLifecycleRequest) {
-    const clusterClient = await this.getClusterClient();
+    this.options.logger.debug(`Installing lifecycle policy ${policy.policy}`);
+    const clusterClient = await this.options.getClusterClient();
     return clusterClient.ilm.putLifecycle(policy);
   }
 
diff --git a/x-pack/plugins/rule_registry/server/utils/create_lifecycle_rule_type_factory.ts b/x-pack/plugins/rule_registry/server/utils/create_lifecycle_rule_type_factory.ts
index ecb3518acc994..b523dd6770b9f 100644
--- a/x-pack/plugins/rule_registry/server/utils/create_lifecycle_rule_type_factory.ts
+++ b/x-pack/plugins/rule_registry/server/utils/create_lifecycle_rule_type_factory.ts
@@ -29,7 +29,7 @@ import {
   TIMESTAMP,
 } from '../../common/technical_rule_data_field_names';
 import { AlertTypeWithExecutor } from '../types';
-import { ParsedTechnicalFields, parseTechnicalFields } from './parse_technical_fields';
+import { ParsedTechnicalFields, parseTechnicalFields } from '../../common/parse_technical_fields';
 import { getRuleExecutorData } from './get_rule_executor_data';
 
 type LifecycleAlertService<TAlertInstanceContext extends Record<string, unknown>> = (alert: {
@@ -71,7 +71,7 @@ export const createLifecycleRuleTypeFactory: CreateLifecycleRuleTypeFactory = ({
         state: previousState,
       } = options;
 
-      const ruleData = getRuleExecutorData(type, options);
+      const ruleExecutorData = getRuleExecutorData(type, options);
 
       const decodedState = wrappedStateRt.decode(previousState);
 
@@ -132,7 +132,7 @@ export const createLifecycleRuleTypeFactory: CreateLifecycleRuleTypeFactory = ({
                 filter: [
                   {
                     term: {
-                      [RULE_UUID]: ruleData[RULE_UUID],
+                      [RULE_UUID]: ruleExecutorData[RULE_UUID],
                     },
                   },
                   {
@@ -155,6 +155,7 @@ export const createLifecycleRuleTypeFactory: CreateLifecycleRuleTypeFactory = ({
               [TIMESTAMP]: 'desc' as const,
             },
           },
+          allow_no_indices: true,
         });
 
         hits.hits.forEach((hit) => {
@@ -176,6 +177,7 @@ export const createLifecycleRuleTypeFactory: CreateLifecycleRuleTypeFactory = ({
 
         const event: Mutable<ParsedTechnicalFields> = {
           ...alertData,
+          ...ruleExecutorData,
           [TIMESTAMP]: timestamp,
           [EVENT_KIND]: 'state',
           [ALERT_ID]: alertId,

From 8d60f13df303124253ad195e53acbf64f1c53a0e Mon Sep 17 00:00:00 2001
From: Dario Gieselaar <dario.gieselaar@elastic.co>
Date: Thu, 6 May 2021 14:53:43 +0200
Subject: [PATCH 30/54] Fix tests, startup race conditions

---
 .../server/task_runner/task_runner.ts         |   1 +
 .../alerts/register_error_count_alert_type.ts |   9 +-
 ...transaction_duration_anomaly_alert_type.ts |  14 +-
 ...ister_transaction_error_rate_alert_type.ts |   9 +-
 x-pack/plugins/apm/server/plugin.ts           |   5 +
 x-pack/plugins/rule_registry/common/types.ts  |   4 +
 .../server/rule_data_client/index.ts          |   2 +-
 .../server/rule_data_plugin_service/index.ts  | 102 +++++++-
 .../tests/alerts/rule_registry.ts             | 232 +++++++++++++-----
 9 files changed, 291 insertions(+), 87 deletions(-)

diff --git a/x-pack/plugins/alerting/server/task_runner/task_runner.ts b/x-pack/plugins/alerting/server/task_runner/task_runner.ts
index 8c3d22eeb2e7f..d3b0231f5cd55 100644
--- a/x-pack/plugins/alerting/server/task_runner/task_runner.ts
+++ b/x-pack/plugins/alerting/server/task_runner/task_runner.ts
@@ -547,6 +547,7 @@ export class TaskRunner<
           if (isAlertSavedObjectNotFoundError(err, alertId)) {
             this.logger.debug(message);
           } else {
+            this.logger.error(require('util').inspect(err, { depth: null }));
             this.logger.error(message);
           }
           return originalState;
diff --git a/x-pack/plugins/apm/server/lib/alerts/register_error_count_alert_type.ts b/x-pack/plugins/apm/server/lib/alerts/register_error_count_alert_type.ts
index 4ccfb002dd890..992393f36631c 100644
--- a/x-pack/plugins/apm/server/lib/alerts/register_error_count_alert_type.ts
+++ b/x-pack/plugins/apm/server/lib/alerts/register_error_count_alert_type.ts
@@ -7,6 +7,10 @@
 
 import { schema } from '@kbn/config-schema';
 import { take } from 'rxjs/operators';
+import {
+  ALERT_EVALUATION_THRESHOLD,
+  ALERT_EVALUATION_VALUE,
+} from '../../../../rule_registry/common/technical_rule_data_field_names';
 import { createLifecycleRuleTypeFactory } from '../../../../rule_registry/server';
 import { ENVIRONMENT_NOT_DEFINED } from '../../../common/environment_filter_values';
 import { asMutableArray } from '../../../common/utils/as_mutable_array';
@@ -153,9 +157,8 @@ export function registerErrorCountAlertType({
                     ? { [SERVICE_ENVIRONMENT]: environment }
                     : {}),
                   [PROCESSOR_EVENT]: ProcessorEvent.error,
-                  'kibana.observability.evaluation.value': errorCount,
-                  'kibana.observability.evaluation.threshold':
-                    alertParams.threshold,
+                  [ALERT_EVALUATION_VALUE]: errorCount,
+                  [ALERT_EVALUATION_THRESHOLD]: alertParams.threshold,
                 },
               })
               .scheduleActions(alertTypeConfig.defaultActionGroupId, {
diff --git a/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_anomaly_alert_type.ts b/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_anomaly_alert_type.ts
index ef2218eeae9e0..5b093671f70f5 100644
--- a/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_anomaly_alert_type.ts
+++ b/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_anomaly_alert_type.ts
@@ -30,6 +30,12 @@ import { getMLJobs } from '../service_map/get_service_anomalies';
 import { apmActionVariables } from './action_variables';
 import { RegisterRuleDependencies } from './register_apm_alerts';
 import { parseEnvironmentUrlParam } from '../../../common/environment_filter_values';
+import {
+  ALERT_EVALUATION_THRESHOLD,
+  ALERT_EVALUATION_VALUE,
+  ALERT_SEVERITY_LEVEL,
+  ALERT_SEVERITY_VALUE,
+} from '../../../../rule_registry/common/technical_rule_data_field_names';
 
 const paramsSchema = schema.object({
   serviceName: schema.maybe(schema.string()),
@@ -238,10 +244,10 @@ export function registerTransactionDurationAnomalyAlertType({
                   : {}),
                 [TRANSACTION_TYPE]: transactionType,
                 [PROCESSOR_EVENT]: ProcessorEvent.transaction,
-                'kibana.rac.alert.severity.level': severityLevel,
-                'kibana.rac.alert.severity.value': score,
-                'kibana.observability.evaluation.value': score,
-                'kibana.observability.evaluation.threshold': threshold,
+                [ALERT_SEVERITY_LEVEL]: severityLevel,
+                [ALERT_SEVERITY_VALUE]: score,
+                [ALERT_EVALUATION_VALUE]: score,
+                [ALERT_EVALUATION_THRESHOLD]: threshold,
               },
             })
             .scheduleActions(alertTypeConfig.defaultActionGroupId, {
diff --git a/x-pack/plugins/apm/server/lib/alerts/register_transaction_error_rate_alert_type.ts b/x-pack/plugins/apm/server/lib/alerts/register_transaction_error_rate_alert_type.ts
index c6c3b473cc2a5..3c6197c8a02a1 100644
--- a/x-pack/plugins/apm/server/lib/alerts/register_transaction_error_rate_alert_type.ts
+++ b/x-pack/plugins/apm/server/lib/alerts/register_transaction_error_rate_alert_type.ts
@@ -7,6 +7,10 @@
 
 import { schema } from '@kbn/config-schema';
 import { take } from 'rxjs/operators';
+import {
+  ALERT_EVALUATION_THRESHOLD,
+  ALERT_EVALUATION_VALUE,
+} from '../../../../rule_registry/common/technical_rule_data_field_names';
 import { createLifecycleRuleTypeFactory } from '../../../../rule_registry/server';
 import { AlertType, ALERT_TYPES_CONFIG } from '../../../common/alert_types';
 import {
@@ -190,9 +194,8 @@ export function registerTransactionErrorRateAlertType({
                 ...(environment ? { [SERVICE_ENVIRONMENT]: environment } : {}),
                 [TRANSACTION_TYPE]: transactionType,
                 [PROCESSOR_EVENT]: ProcessorEvent.transaction,
-                'kibana.observability.evaluation.value': errorRate,
-                'kibana.observability.evaluation.threshold':
-                  alertParams.threshold,
+                [ALERT_EVALUATION_VALUE]: errorRate,
+                [ALERT_EVALUATION_THRESHOLD]: alertParams.threshold,
               },
             })
             .scheduleActions(alertTypeConfig.defaultActionGroupId, {
diff --git a/x-pack/plugins/apm/server/plugin.ts b/x-pack/plugins/apm/server/plugin.ts
index 0479fe1be17ce..44334889128c4 100644
--- a/x-pack/plugins/apm/server/plugin.ts
+++ b/x-pack/plugins/apm/server/plugin.ts
@@ -136,6 +136,11 @@ export class APMPlugin
       const componentTemplateName = plugins.ruleRegistry.getFullAssetName(
         'apm-mappings'
       );
+
+      if (!plugins.ruleRegistry.isWriteEnabled()) {
+        return;
+      }
+
       await plugins.ruleRegistry.createOrUpdateComponentTemplate({
         name: componentTemplateName,
         body: {
diff --git a/x-pack/plugins/rule_registry/common/types.ts b/x-pack/plugins/rule_registry/common/types.ts
index 156622877aa24..299d2c300ab49 100644
--- a/x-pack/plugins/rule_registry/common/types.ts
+++ b/x-pack/plugins/rule_registry/common/types.ts
@@ -7,6 +7,10 @@
 
 import { estypes } from '@elastic/elasticsearch';
 
+export type PutIndexTemplateRequest = estypes.PutIndexTemplateRequest & {
+  body?: { composed_of?: string[] };
+};
+
 export interface ClusterPutComponentTemplateBody {
   template: {
     settings: {
diff --git a/x-pack/plugins/rule_registry/server/rule_data_client/index.ts b/x-pack/plugins/rule_registry/server/rule_data_client/index.ts
index dfed305f32c9d..9de1c9a882289 100644
--- a/x-pack/plugins/rule_registry/server/rule_data_client/index.ts
+++ b/x-pack/plugins/rule_registry/server/rule_data_client/index.ts
@@ -118,7 +118,7 @@ export class RuleDataClient implements IRuleDataClient {
       path: `/_index_template/_simulate_index/${concreteIndexName}`,
     });
 
-    const mappings: TypeMapping = simulateResponse.mappings;
+    const mappings: TypeMapping = simulateResponse.template.mappings;
 
     await clusterClient.indices.putMapping({ index: `${alias}*`, body: mappings });
   }
diff --git a/x-pack/plugins/rule_registry/server/rule_data_plugin_service/index.ts b/x-pack/plugins/rule_registry/server/rule_data_plugin_service/index.ts
index d692546c51d64..f8a3ae6d4d8c2 100644
--- a/x-pack/plugins/rule_registry/server/rule_data_plugin_service/index.ts
+++ b/x-pack/plugins/rule_registry/server/rule_data_plugin_service/index.ts
@@ -16,7 +16,9 @@ import {
 } from '../../common/assets';
 import { ecsComponentTemplate } from '../../common/assets/component_templates/ecs_component_template';
 import { defaultLifecyclePolicy } from '../../common/assets/lifecycle_policies/default_lifecycle_policy';
-import { ClusterPutComponentTemplateBody } from '../../common/types';
+import { ClusterPutComponentTemplateBody, PutIndexTemplateRequest } from '../../common/types';
+
+const BOOTSTRAP_TIMEOUT = 60000;
 
 interface RuleDataPluginServiceConstructorOptions {
   getClusterClient: () => Promise<ElasticsearchClient>;
@@ -25,52 +27,128 @@ interface RuleDataPluginServiceConstructorOptions {
   kibanaIndex: string;
 }
 
+function createSignal() {
+  let resolver: () => void;
+
+  let ready: boolean = false;
+
+  const promise = new Promise<void>((resolve) => {
+    resolver = resolve;
+  });
+
+  function wait(): Promise<void> {
+    return promise.then(() => {
+      ready = true;
+    });
+  }
+
+  function complete() {
+    resolver();
+  }
+
+  return { wait, complete, isReady: () => ready };
+}
+
 export class RuleDataPluginService {
+  signal = createSignal();
+
   constructor(private readonly options: RuleDataPluginServiceConstructorOptions) {}
 
+  private assertWriteEnabled() {
+    if (!this.isWriteEnabled) {
+      throw new Error('Write operations are disabled');
+    }
+  }
+
+  private async getClusterClient() {
+    return await this.options.getClusterClient();
+  }
+
   async init() {
+    if (!this.isWriteEnabled) {
+      this.options.logger.info('Write is disabled, not installing assets');
+      this.signal.complete();
+      return;
+    }
+
     this.options.logger.info(`Installing assets in namespace ${this.getFullAssetName()}`);
 
-    await this.createOrUpdateLifecyclePolicy({
+    await this._createOrUpdateLifecyclePolicy({
       policy: this.getFullAssetName(DEFAULT_ILM_POLICY_ID),
       body: defaultLifecyclePolicy,
     });
 
-    await this.createOrUpdateComponentTemplate({
+    await this._createOrUpdateComponentTemplate({
       name: this.getFullAssetName(TECHNICAL_COMPONENT_TEMPLATE_NAME),
       body: technicalComponentTemplate,
     });
 
-    await this.createOrUpdateComponentTemplate({
+    await this._createOrUpdateComponentTemplate({
       name: this.getFullAssetName(ECS_COMPONENT_TEMPLATE_NAME),
       body: ecsComponentTemplate,
     });
 
     this.options.logger.info(`Installed all assets`);
+
+    this.signal.complete();
   }
 
-  async createOrUpdateComponentTemplate(
+  private async _createOrUpdateComponentTemplate(
     template: ClusterPutComponentTemplate<ClusterPutComponentTemplateBody>
   ) {
+    this.assertWriteEnabled();
+
+    const clusterClient = await this.getClusterClient();
     this.options.logger.debug(`Installing component template ${template.name}`);
-    const clusterClient = await this.options.getClusterClient();
     return clusterClient.cluster.putComponentTemplate(template);
   }
 
-  async createOrUpdateIndexTemplate(
-    template: estypes.PutIndexTemplateRequest & { body?: { composed_of?: string[] } }
-  ) {
+  private async _createOrUpdateIndexTemplate(template: PutIndexTemplateRequest) {
+    this.assertWriteEnabled();
+
+    const clusterClient = await this.getClusterClient();
     this.options.logger.debug(`Installing index template ${template.name}`);
-    const clusterClient = await this.options.getClusterClient();
     return clusterClient.indices.putIndexTemplate(template);
   }
 
-  async createOrUpdateLifecyclePolicy(policy: estypes.PutLifecycleRequest) {
+  private async _createOrUpdateLifecyclePolicy(policy: estypes.PutLifecycleRequest) {
+    this.assertWriteEnabled();
+    const clusterClient = await this.getClusterClient();
+
     this.options.logger.debug(`Installing lifecycle policy ${policy.policy}`);
-    const clusterClient = await this.options.getClusterClient();
     return clusterClient.ilm.putLifecycle(policy);
   }
 
+  async createOrUpdateComponentTemplate(
+    template: ClusterPutComponentTemplate<ClusterPutComponentTemplateBody>
+  ) {
+    await this.wait();
+    return this._createOrUpdateComponentTemplate(template);
+  }
+
+  async createOrUpdateIndexTemplate(template: PutIndexTemplateRequest) {
+    await this.wait();
+    return this._createOrUpdateIndexTemplate(template);
+  }
+
+  async createOrUpdateLifecyclePolicy(policy: estypes.PutLifecycleRequest) {
+    await this.wait();
+    return this._createOrUpdateLifecyclePolicy(policy);
+  }
+
+  isReady() {
+    return this.signal.isReady();
+  }
+
+  wait() {
+    return Promise.race([
+      this.signal.wait(),
+      new Promise((resolve, reject) => {
+        setTimeout(reject, BOOTSTRAP_TIMEOUT);
+      }),
+    ]);
+  }
+
   isWriteEnabled(): boolean {
     return this.options.isWriteEnabled;
   }
diff --git a/x-pack/test/apm_api_integration/tests/alerts/rule_registry.ts b/x-pack/test/apm_api_integration/tests/alerts/rule_registry.ts
index 8d0b87782ff7c..7e9db3743b0a7 100644
--- a/x-pack/test/apm_api_integration/tests/alerts/rule_registry.ts
+++ b/x-pack/test/apm_api_integration/tests/alerts/rule_registry.ts
@@ -6,7 +6,7 @@
  */
 
 import expect from '@kbn/expect';
-import { get, merge, omit } from 'lodash';
+import { merge, omit } from 'lodash';
 import { format } from 'url';
 import { FtrProviderContext } from '../../common/ftr_provider_context';
 import { registry } from '../../common/registry';
@@ -30,7 +30,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
   const supertest = getService('supertestAsApmWriteUser');
   const es = getService('es');
 
-  const MAX_POLLS = 5;
+  const MAX_POLLS = 10;
   const BULK_INDEX_DELAY = 1000;
   const INDEXING_DELAY = 5000;
 
@@ -73,6 +73,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
     intervalInSeconds: number = 1,
     count: number = 0
   ): Promise<Alert> {
+    console.log('waitUntilNextExecution');
     await new Promise((resolve) => {
       setTimeout(resolve, intervalInSeconds * 1000);
     });
@@ -90,6 +91,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
     const nextAlert = body as Alert;
 
     if (nextAlert.executionStatus.lastExecutionDate !== alert.executionStatus.lastExecutionDate) {
+      console.log('next execution completed');
       await new Promise((resolve) => {
         setTimeout(resolve, BULK_INDEX_DELAY);
       });
@@ -108,11 +110,11 @@ export default function ApiTest({ getService }: FtrProviderContext) {
   }
 
   registry.when('Rule registry with write enabled', { config: 'rules', archives: [] }, () => {
-    it('bootstraps the apm alert indices', async () => {
+    it('does not bootstrap indices on plugin startup', async () => {
       const { body } = await es.indices.get({
         index: ALERTS_INDEX_TARGET,
         expand_wildcards: 'open',
-        allow_no_indices: false,
+        allow_no_indices: true,
       });
 
       const indices = Object.entries(body).map(([indexName, index]) => {
@@ -122,23 +124,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
         };
       });
 
-      const indexNames = indices.map((index) => index.indexName);
-
-      const apmIndex = indices[0];
-
-      // make sure it only creates one index
-      expect(indices.length).to.be(1);
-
-      const apmIndexName = apmIndex.indexName;
-
-      expect(apmIndexName.split('-').includes('observability')).to.be(true);
-      expect(apmIndexName.split('-').includes('apm')).to.be(true);
-
-      expect(indexNames[0].startsWith('.kibana-alerts-observability-apm')).to.be(true);
-
-      expect(get(apmIndex, 'index.mappings.properties.service.properties.environment.type')).to.be(
-        'keyword'
-      );
+      expect(indices.length).to.be(0);
     });
 
     describe('when creating a rule', () => {
@@ -282,6 +268,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
               '@timestamp': 'desc',
             },
           },
+          allow_no_indices: true,
         });
 
         expect(beforeDataResponse.body.hits.hits.length).to.be(0);
@@ -335,12 +322,14 @@ export default function ApiTest({ getService }: FtrProviderContext) {
             sort: {
               '@timestamp': 'desc',
             },
+            _source: false,
+            fields: [{ field: '*', include_unmapped: true }],
           },
         });
 
         expect(afterViolatingDataResponse.body.hits.hits.length).to.be(1);
 
-        const alertEvent = afterViolatingDataResponse.body.hits.hits[0]._source as Record<
+        const alertEvent = afterViolatingDataResponse.body.hits.hits[0].fields as Record<
           string,
           any
         >;
@@ -354,23 +343,56 @@ export default function ApiTest({ getService }: FtrProviderContext) {
 
         const toCompare = omit(alertEvent, exclude);
 
-        expect(toCompare).to.eql({
-          'event.action': 'open',
-          'event.kind': 'state',
-          'kibana.rac.alert.duration.us': 0,
-          'kibana.rac.alert.id': 'apm.transaction_error_rate_opbeans-go_request',
-          'kibana.rac.alert.status': 'open',
-          'kibana.rac.producer': 'apm',
-          'kibana.observability.evaluation.threshold': 30,
-          'kibana.observability.evaluation.value': 50,
-          'processor.event': 'transaction',
-          'rule.category': 'Transaction error rate threshold',
-          'rule.id': 'apm.transaction_error_rate',
-          'rule.name': 'Transaction error rate threshold | opbeans-go',
-          'service.name': 'opbeans-go',
-          tags: ['apm', 'service.name:opbeans-go'],
-          'transaction.type': 'request',
-        });
+        expectSnapshot(toCompare).toMatchInline(`
+          Object {
+            "event.action": Array [
+              "open",
+            ],
+            "event.kind": Array [
+              "state",
+            ],
+            "kibana.rac.alert.duration.us": Array [
+              0,
+            ],
+            "kibana.rac.alert.evaluation.threshold": Array [
+              30,
+            ],
+            "kibana.rac.alert.evaluation.value": Array [
+              50,
+            ],
+            "kibana.rac.alert.id": Array [
+              "apm.transaction_error_rate_opbeans-go_request",
+            ],
+            "kibana.rac.alert.producer": Array [
+              "apm",
+            ],
+            "kibana.rac.alert.status": Array [
+              "open",
+            ],
+            "processor.event": Array [
+              "transaction",
+            ],
+            "rule.category": Array [
+              "Transaction error rate threshold",
+            ],
+            "rule.id": Array [
+              "apm.transaction_error_rate",
+            ],
+            "rule.name": Array [
+              "Transaction error rate threshold | opbeans-go",
+            ],
+            "service.name": Array [
+              "opbeans-go",
+            ],
+            "tags": Array [
+              "apm",
+              "service.name:opbeans-go",
+            ],
+            "transaction.type": Array [
+              "request",
+            ],
+          }
+        `);
 
         const now = new Date().getTime();
 
@@ -390,7 +412,56 @@ export default function ApiTest({ getService }: FtrProviderContext) {
 
         expect(topAlerts.length).to.be.greaterThan(0);
 
-        expect(omit(topAlerts[0], exclude)).to.eql(toCompare);
+        expectSnapshot(omit(topAlerts[0], exclude)).toMatchInline(`
+          Object {
+            "event.action": Array [
+              "open",
+            ],
+            "event.kind": Array [
+              "state",
+            ],
+            "kibana.rac.alert.duration.us": Array [
+              0,
+            ],
+            "kibana.rac.alert.evaluation.threshold": Array [
+              30,
+            ],
+            "kibana.rac.alert.evaluation.value": Array [
+              50,
+            ],
+            "kibana.rac.alert.id": Array [
+              "apm.transaction_error_rate_opbeans-go_request",
+            ],
+            "kibana.rac.alert.producer": Array [
+              "apm",
+            ],
+            "kibana.rac.alert.status": Array [
+              "open",
+            ],
+            "processor.event": Array [
+              "transaction",
+            ],
+            "rule.category": Array [
+              "Transaction error rate threshold",
+            ],
+            "rule.id": Array [
+              "apm.transaction_error_rate",
+            ],
+            "rule.name": Array [
+              "Transaction error rate threshold | opbeans-go",
+            ],
+            "service.name": Array [
+              "opbeans-go",
+            ],
+            "tags": Array [
+              "apm",
+              "service.name:opbeans-go",
+            ],
+            "transaction.type": Array [
+              "request",
+            ],
+          }
+        `);
 
         await es.bulk({
           index: APM_TRANSACTION_INDEX_NAME,
@@ -423,43 +494,76 @@ export default function ApiTest({ getService }: FtrProviderContext) {
             sort: {
               '@timestamp': 'desc',
             },
+            _source: false,
+            fields: [{ field: '*', include_unmapped: true }],
           },
         });
 
         expect(afterRecoveryResponse.body.hits.hits.length).to.be(1);
 
-        const recoveredAlertEvent = afterRecoveryResponse.body.hits.hits[0]._source as Record<
+        const recoveredAlertEvent = afterRecoveryResponse.body.hits.hits[0].fields as Record<
           string,
           any
         >;
 
-        expect(recoveredAlertEvent['kibana.rac.alert.status']).to.eql('closed');
-        expect(recoveredAlertEvent['kibana.rac.alert.duration.us']).to.be.greaterThan(0);
-        expect(new Date(recoveredAlertEvent['kibana.rac.alert.end']).getTime()).to.be.greaterThan(
-          0
-        );
-
+        expect(recoveredAlertEvent['kibana.rac.alert.status']?.[0]).to.eql('closed');
+        expect(recoveredAlertEvent['kibana.rac.alert.duration.us']?.[0]).to.be.greaterThan(0);
         expect(
+          new Date(recoveredAlertEvent['kibana.rac.alert.end']?.[0]).getTime()
+        ).to.be.greaterThan(0);
+
+        expectSnapshot(
           omit(
             recoveredAlertEvent,
             exclude.concat(['kibana.rac.alert.duration.us', 'kibana.rac.alert.end'])
           )
-        ).to.eql({
-          'event.action': 'close',
-          'event.kind': 'state',
-          'kibana.rac.alert.id': 'apm.transaction_error_rate_opbeans-go_request',
-          'kibana.rac.alert.status': 'closed',
-          'kibana.rac.producer': 'apm',
-          'kibana.observability.evaluation.threshold': 30,
-          'kibana.observability.evaluation.value': 50,
-          'processor.event': 'transaction',
-          'rule.category': 'Transaction error rate threshold',
-          'rule.id': 'apm.transaction_error_rate',
-          'rule.name': 'Transaction error rate threshold | opbeans-go',
-          'service.name': 'opbeans-go',
-          tags: ['apm', 'service.name:opbeans-go'],
-          'transaction.type': 'request',
-        });
+        ).toMatchInline(`
+          Object {
+            "event.action": Array [
+              "close",
+            ],
+            "event.kind": Array [
+              "state",
+            ],
+            "kibana.rac.alert.evaluation.threshold": Array [
+              30,
+            ],
+            "kibana.rac.alert.evaluation.value": Array [
+              50,
+            ],
+            "kibana.rac.alert.id": Array [
+              "apm.transaction_error_rate_opbeans-go_request",
+            ],
+            "kibana.rac.alert.producer": Array [
+              "apm",
+            ],
+            "kibana.rac.alert.status": Array [
+              "closed",
+            ],
+            "processor.event": Array [
+              "transaction",
+            ],
+            "rule.category": Array [
+              "Transaction error rate threshold",
+            ],
+            "rule.id": Array [
+              "apm.transaction_error_rate",
+            ],
+            "rule.name": Array [
+              "Transaction error rate threshold | opbeans-go",
+            ],
+            "service.name": Array [
+              "opbeans-go",
+            ],
+            "tags": Array [
+              "apm",
+              "service.name:opbeans-go",
+            ],
+            "transaction.type": Array [
+              "request",
+            ],
+          }
+        `);
 
         const {
           body: topAlertsAfterRecovery,
@@ -480,7 +584,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
 
         expect(topAlertsAfterRecovery.length).to.be(1);
 
-        expect(topAlertsAfterRecovery[0]['kibana.rac.alert.status']).to.be('closed');
+        expect(topAlertsAfterRecovery[0]['kibana.rac.alert.status']?.[0]).to.be('closed');
       });
     });
   });

From 778e4c609b02b7b2cb3a2ad1365db899a05d554d Mon Sep 17 00:00:00 2001
From: Madison Caldwell <madison.caldwell@elastic.co>
Date: Mon, 10 May 2021 10:26:55 -0400
Subject: [PATCH 31/54] Get ruleDataClient where it needs to be

---
 .../detection_engine/reference_rules/eql.ts   | 184 ++++++-------
 .../detection_engine/reference_rules/query.ts | 102 +++----
 .../reference_rules/threshold.ts              | 248 +++++++++---------
 .../routes/rules/create_rules_route.ts        |   4 +-
 .../routes/rules/delete_rules_route.ts        |   6 +-
 .../routes/rules/find_rules_route.ts          |   6 +-
 .../routes/rules/patch_rules_route.ts         |   7 +-
 .../routes/rules/read_rules_route.ts          |   6 +-
 .../routes/rules/update_rules_route.ts        |   7 +-
 .../security_solution/server/plugin.ts        |  48 ++--
 .../security_solution/server/routes/index.ts  |  19 +-
 11 files changed, 340 insertions(+), 297 deletions(-)

diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.ts
index af973f2865ce4..e620d3d4d003e 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.ts
@@ -10,9 +10,11 @@ import v4 from 'uuid/v4';
 
 import { ApiResponse } from '@elastic/elasticsearch';
 import { schema } from '@kbn/config-schema';
-import { BaseRuleFieldMap, OutputOfFieldMap } from '../../../../../rule_registry/common';
 
-import { createPersistenceRuleTypeFactory } from '../../../../../rule_registry/server';
+import {
+  RuleDataClient,
+  createPersistenceRuleTypeFactory,
+} from '../../../../../rule_registry/server';
 import { EQL_ALERT_TYPE_ID } from '../../../../common/constants';
 import { buildEqlSearchRequest } from '../../../../common/detection_engine/get_query_filter';
 import { SecurityRuleRegistry } from '../../../plugin';
@@ -20,99 +22,99 @@ import { BaseSignalHit, EqlSignalSearchResponse } from '../signals/types';
 
 const createSecurityEQLRuleType = createPersistenceRuleTypeFactory<SecurityRuleRegistry>();
 
-type AlertType = OutputOfFieldMap<BaseRuleFieldMap>;
-
-export const eqlAlertType = createSecurityEQLRuleType({
-  id: EQL_ALERT_TYPE_ID,
-  name: 'EQL Rule',
-  validate: {
-    params: schema.object({
-      eqlQuery: schema.string(),
-      indexPatterns: schema.arrayOf(schema.string()),
-    }),
-  },
-  actionGroups: [
-    {
-      id: 'default',
-      name: 'Default',
+export const createEqlAlertType = (ruleDataClient: RuleDataClient) => {
+  return createSecurityEQLRuleType({
+    id: EQL_ALERT_TYPE_ID,
+    name: 'EQL Rule',
+    validate: {
+      params: schema.object({
+        eqlQuery: schema.string(),
+        indexPatterns: schema.arrayOf(schema.string()),
+      }),
+    },
+    actionGroups: [
+      {
+        id: 'default',
+        name: 'Default',
+      },
+    ],
+    defaultActionGroupId: 'default',
+    actionVariables: {
+      context: [{ name: 'server', description: 'the server' }],
     },
-  ],
-  defaultActionGroupId: 'default',
-  actionVariables: {
-    context: [{ name: 'server', description: 'the server' }],
-  },
-  minimumLicenseRequired: 'basic',
-  producer: 'security-solution',
-  async executor({
-    // previousStartedAt,
-    rule,
-    startedAt,
-    services: { alertWithPersistence, findAlerts, scopedClusterClient },
-    params: { indexPatterns, eqlQuery },
-  }) {
-    const from = moment(startedAt).subtract(moment.duration(5, 'm')).toISOString(); // hardcoded 5-minute rule interval
-    const to = startedAt.toISOString();
+    minimumLicenseRequired: 'basic',
+    producer: 'security-solution',
+    async executor({
+      // previousStartedAt,
+      rule,
+      startedAt,
+      services: { alertWithPersistence, findAlerts, scopedClusterClient },
+      params: { indexPatterns, eqlQuery },
+    }) {
+      const from = moment(startedAt).subtract(moment.duration(5, 'm')).toISOString(); // hardcoded 5-minute rule interval
+      const to = startedAt.toISOString();
 
-    const request = buildEqlSearchRequest(
-      eqlQuery,
-      indexPatterns,
-      from,
-      to,
-      10,
-      undefined,
-      [],
-      undefined
-    );
-    const { body: response } = (await scopedClusterClient.asCurrentUser.transport.request(
-      request
-    )) as ApiResponse<EqlSignalSearchResponse>;
+      const request = buildEqlSearchRequest(
+        eqlQuery,
+        indexPatterns,
+        from,
+        to,
+        10,
+        undefined,
+        [],
+        undefined
+      );
+      const { body: response } = (await scopedClusterClient.asCurrentUser.transport.request(
+        request
+      )) as ApiResponse<EqlSignalSearchResponse>;
 
-    const buildSignalFromEvent = (event: BaseSignalHit): AlertType => {
-      return {
-        ...event,
-        'event.kind': 'signal',
-        'kibana.rac.alert.id': '???',
-        'kibana.rac.alert.uuid': v4(),
-        '@timestamp': new Date().toISOString(),
+      const buildSignalFromEvent = (event: BaseSignalHit) => {
+        return {
+          ...event,
+          'event.kind': 'signal',
+          'kibana.rac.alert.id': '???',
+          'kibana.rac.alert.uuid': v4(),
+          '@timestamp': new Date().toISOString(),
+        };
       };
-    };
 
-    let alerts: AlertType[] = [];
-    if (response.hits.sequences !== undefined) {
-      alerts = response.hits.sequences.reduce((allAlerts: AlertType[], sequence) => {
-        let previousAlertUuid: string | undefined;
-        return [
-          ...allAlerts,
-          ...sequence.events.map((event, idx) => {
-            const alert = {
-              ...buildSignalFromEvent(event),
-              'kibana.rac.alert.ancestors': previousAlertUuid != null ? [previousAlertUuid] : [],
-              'kibana.rac.alert.building_block_type': 'default',
-              'kibana.rac.alert.depth': idx,
-            };
-            previousAlertUuid = alert['kibana.rac.alert.uuid'];
-            return alert;
-          }),
-        ];
-      }, []);
-    } else if (response.hits.events !== undefined) {
-      alerts = response.hits.events.map((event) => {
-        return buildSignalFromEvent(event);
-      }, []);
-    } else {
-      throw new Error(
-        'eql query response should have either `sequences` or `events` but had neither'
-      );
-    }
+      let alerts: any[] = [];
+      if (response.hits.sequences !== undefined) {
+        alerts = response.hits.sequences.reduce((allAlerts: any[], sequence) => {
+          let previousAlertUuid: string | undefined;
+          return [
+            ...allAlerts,
+            ...sequence.events.map((event, idx) => {
+              const alert = {
+                ...buildSignalFromEvent(event),
+                'kibana.rac.alert.ancestors': previousAlertUuid != null ? [previousAlertUuid] : [],
+                'kibana.rac.alert.building_block_type': 'default',
+                'kibana.rac.alert.depth': idx,
+              };
+              previousAlertUuid = alert['kibana.rac.alert.uuid'];
+              return alert;
+            }),
+          ];
+        }, []);
+      } else if (response.hits.events !== undefined) {
+        alerts = response.hits.events.map((event) => {
+          return buildSignalFromEvent(event);
+        }, []);
+      } else {
+        throw new Error(
+          'eql query response should have either `sequences` or `events` but had neither'
+        );
+      }
 
-    if (alerts.length > 0) {
-      alertWithPersistence(alerts).forEach((alert) => {
-        alert.scheduleActions('default', { server: 'server-test' });
-      });
-    }
+      if (alerts.length > 0) {
+        alertWithPersistence(alerts).forEach((alert) => {
+          alert.scheduleActions('default', { server: 'server-test' });
+        });
+      }
 
-    return {
-      lastChecked: new Date(),
-    };
-  },
-});
+      return {
+        lastChecked: new Date(),
+      };
+    },
+  });
+};
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/query.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/query.ts
index 65654937869e9..a96a835e08ebb 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/query.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/query.ts
@@ -9,63 +9,67 @@ import { schema } from '@kbn/config-schema';
 
 import { buildEsQuery, IIndexPattern } from '../../../../../../../src/plugins/data/common';
 
-import { createPersistenceRuleTypeFactory } from '../../../../../rule_registry/server';
+import {
+  RuleDataClient,
+  createPersistenceRuleTypeFactory,
+} from '../../../../../rule_registry/server';
 import { CUSTOM_ALERT_TYPE_ID } from '../../../../common/constants';
 import { SecurityRuleRegistry } from '../../../plugin';
 
 const createSecurityCustomRuleType = createPersistenceRuleTypeFactory<SecurityRuleRegistry>();
 
-export const queryAlertType = createSecurityCustomRuleType({
-  id: CUSTOM_ALERT_TYPE_ID,
-  name: 'Custom Query Rule',
-  validate: {
-    params: schema.object({
-      indexPatterns: schema.arrayOf(schema.string()),
-      customQuery: schema.string(),
-    }),
-  },
-  actionGroups: [
-    {
-      id: 'default',
-      name: 'Default',
+export const createQueryAlertType = (ruleDataClient: RuleDataClient) => {
+  return createSecurityCustomRuleType({
+    id: CUSTOM_ALERT_TYPE_ID,
+    name: 'Custom Query Rule',
+    validate: {
+      params: schema.object({
+        indexPatterns: schema.arrayOf(schema.string()),
+        customQuery: schema.string(),
+      }),
     },
-  ],
-  defaultActionGroupId: 'default',
-  actionVariables: {
-    context: [{ name: 'server', description: 'the server' }],
-  },
-  minimumLicenseRequired: 'basic',
-  producer: 'security-solution',
-  async executor({
-    services: { alertWithPersistence, findAlerts },
-    params: { indexPatterns, customQuery },
-  }) {
-    const indexPattern: IIndexPattern = {
-      fields: [],
-      title: indexPatterns.join(),
-    };
+    actionGroups: [
+      {
+        id: 'default',
+        name: 'Default',
+      },
+    ],
+    defaultActionGroupId: 'default',
+    actionVariables: {
+      context: [{ name: 'server', description: 'the server' }],
+    },
+    minimumLicenseRequired: 'basic',
+    producer: 'security-solution',
+    async executor({
+      services: { alertWithPersistence, findAlerts },
+      params: { indexPatterns, customQuery },
+    }) {
+      const indexPattern: IIndexPattern = {
+        fields: [],
+        title: indexPatterns.join(),
+      };
 
-    // TODO: kql or lucene?
+      // TODO: kql or lucene?
 
-    const esQuery = buildEsQuery(indexPattern, { query: customQuery, language: 'kuery' }, []);
-    const query = {
-      body: {
-        query: esQuery,
-        fields: ['*'],
-        sort: {
-          '@timestamp': 'asc' as const,
+      const esQuery = buildEsQuery(indexPattern, { query: customQuery, language: 'kuery' }, []);
+      const query = {
+        body: {
+          query: esQuery,
+          fields: ['*'],
+          sort: {
+            '@timestamp': 'asc' as const,
+          },
         },
-      },
-    };
+      };
 
-    // @ts-expect-error Filter[] is not assignable to QueryContainer[]
-    const alerts = await findAlerts(query);
-    alertWithPersistence(alerts).forEach((alert) => {
-      alert.scheduleActions('default', { server: 'server-test' });
-    });
+      const alerts = await findAlerts(query);
+      alertWithPersistence(alerts).forEach((alert) => {
+        alert.scheduleActions('default', { server: 'server-test' });
+      });
 
-    return {
-      lastChecked: new Date(),
-    };
-  },
-});
+      return {
+        lastChecked: new Date(),
+      };
+    },
+  });
+};
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.ts
index 6aa8994d6f37c..4ba8603ccd019 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.ts
@@ -13,8 +13,10 @@ import { schema } from '@kbn/config-schema';
 import { Logger } from '../../../../../../../src/core/server';
 
 import { AlertServices } from '../../../../../alerting/server';
-import { BaseRuleFieldMap, OutputOfFieldMap } from '../../../../../rule_registry/common';
-import { createPersistenceRuleTypeFactory } from '../../../../../rule_registry/server';
+import {
+  RuleDataClient,
+  createPersistenceRuleTypeFactory,
+} from '../../../../../rule_registry/server';
 import { THRESHOLD_ALERT_TYPE_ID } from '../../../../common/constants';
 import { SecurityRuleRegistry } from '../../../plugin';
 import { SignalSearchResponse, ThresholdSignalHistory } from '../signals/types';
@@ -29,8 +31,6 @@ import { BuildRuleMessage } from '../signals/rule_messages';
 
 const createSecurityThresholdRuleType = createPersistenceRuleTypeFactory<SecurityRuleRegistry>();
 
-type AlertType = OutputOfFieldMap<BaseRuleFieldMap>;
-
 interface Rule {
   id: string;
   uuid: string;
@@ -61,7 +61,7 @@ interface BulkCreateThresholdSignalParams {
   buildRuleMessage: BuildRuleMessage;
 }
 
-const formatThresholdSignals = (params: BulkCreateThresholdSignalParams): AlertType[] => {
+const formatThresholdSignals = (params: BulkCreateThresholdSignalParams): any[] => {
   const thresholdResults = params.results;
   const threshold = {
     field: params.ruleParams.thresholdFields,
@@ -90,127 +90,129 @@ const formatThresholdSignals = (params: BulkCreateThresholdSignalParams): AlertT
   });
 };
 
-export const thresholdAlertType = createSecurityThresholdRuleType({
-  id: THRESHOLD_ALERT_TYPE_ID,
-  name: 'Threshold Rule',
-  validate: {
-    params: schema.object({
-      indexPatterns: schema.arrayOf(schema.string()),
-      customQuery: schema.string(),
-      thresholdFields: schema.arrayOf(schema.string()),
-      thresholdValue: schema.number(),
-      thresholdCardinality: schema.arrayOf(
-        schema.object({
-          field: schema.string(),
-          value: schema.number(),
-        })
-      ),
-    }),
-  },
-  actionGroups: [
-    {
-      id: 'default',
-      name: 'Default',
+export const createThresholdAlertType = (ruleDataClient: RuleDataClient) => {
+  return createSecurityThresholdRuleType({
+    id: THRESHOLD_ALERT_TYPE_ID,
+    name: 'Threshold Rule',
+    validate: {
+      params: schema.object({
+        indexPatterns: schema.arrayOf(schema.string()),
+        customQuery: schema.string(),
+        thresholdFields: schema.arrayOf(schema.string()),
+        thresholdValue: schema.number(),
+        thresholdCardinality: schema.arrayOf(
+          schema.object({
+            field: schema.string(),
+            value: schema.number(),
+          })
+        ),
+      }),
     },
-  ],
-  defaultActionGroupId: 'default',
-  actionVariables: {
-    context: [{ name: 'server', description: 'the server' }],
-  },
-  minimumLicenseRequired: 'basic',
-  producer: 'security-solution',
-  async executor({
-    // previousStartedAt,
-    rule,
-    startedAt,
-    services,
-    params,
-  }) {
-    const fromDate = moment(startedAt).subtract(moment.duration(5, 'm')); // hardcoded 5-minute rule interval
-    const from = fromDate.toISOString();
-    const to = startedAt.toISOString();
-
-    // TODO: how to get the output index?
-    const outputIndex = ['.kibana-madi-8-alerts-security-solution-8.0.0-000001'];
-    const buildRuleMessage = (...messages: string[]) => messages.join();
-    const timestampOverride = undefined;
-
-    const {
-      thresholdSignalHistory,
-      searchErrors: previousSearchErrors,
-    } = await getThresholdSignalHistory({
-      indexPattern: outputIndex,
-      from,
-      to,
-      services: (services as unknown) as AlertServices,
-      logger: services.logger,
-      ruleId: rule.id,
-      bucketByFields: params.thresholdFields,
-      timestampOverride,
-      buildRuleMessage,
-    });
-
-    const bucketFilters = await getThresholdBucketFilters({
-      thresholdSignalHistory,
-      timestampOverride,
-    });
-
-    const esFilter = await getFilter({
-      type: 'threshold',
-      filters: bucketFilters,
-      language: 'kuery',
-      query: params.customQuery,
-      savedId: undefined,
-      services: (services as unknown) as AlertServices,
-      index: params.indexPatterns,
-      lists: [],
-    });
-
-    const {
-      searchResult: thresholdResults,
-      searchErrors,
-      searchDuration: thresholdSearchDuration,
-    } = await findThresholdSignals({
-      inputIndexPattern: params.indexPatterns,
-      from,
-      to,
-      services: (services as unknown) as AlertServices,
-      logger: services.logger,
-      filter: esFilter,
-      threshold: {
-        field: params.thresholdFields,
-        value: params.thresholdValue,
-        cardinality: params.thresholdCardinality,
+    actionGroups: [
+      {
+        id: 'default',
+        name: 'Default',
       },
-      timestampOverride,
-      buildRuleMessage,
-    });
-
-    services.logger.info(`Threshold search took ${thresholdSearchDuration}ms`); // TODO: rule status service
-
-    const alerts = formatThresholdSignals({
-      results: thresholdResults,
-      ruleParams: params,
-      services: (services as unknown) as AlertServices & { logger: Logger },
-      inputIndexPattern: ['TODO'],
+    ],
+    defaultActionGroupId: 'default',
+    actionVariables: {
+      context: [{ name: 'server', description: 'the server' }],
+    },
+    minimumLicenseRequired: 'basic',
+    producer: 'security-solution',
+    async executor({
+      // previousStartedAt,
       rule,
       startedAt,
-      from: fromDate.toDate(),
-      thresholdSignalHistory,
-      buildRuleMessage,
-    });
-
-    const errors = searchErrors.concat(previousSearchErrors);
-    if (errors.length === 0) {
-      services.alertWithPersistence(alerts).forEach((alert) => {
-        alert.scheduleActions('default', { server: 'server-test' });
+      services,
+      params,
+    }) {
+      const fromDate = moment(startedAt).subtract(moment.duration(5, 'm')); // hardcoded 5-minute rule interval
+      const from = fromDate.toISOString();
+      const to = startedAt.toISOString();
+
+      // TODO: how to get the output index?
+      const outputIndex = ['.kibana-madi-8-alerts-security-solution-8.0.0-000001'];
+      const buildRuleMessage = (...messages: string[]) => messages.join();
+      const timestampOverride = undefined;
+
+      const {
+        thresholdSignalHistory,
+        searchErrors: previousSearchErrors,
+      } = await getThresholdSignalHistory({
+        indexPattern: outputIndex,
+        from,
+        to,
+        services: (services as unknown) as AlertServices,
+        logger: services.logger,
+        ruleId: rule.id,
+        bucketByFields: params.thresholdFields,
+        timestampOverride,
+        buildRuleMessage,
       });
-    } else {
-      throw new Error(errors.join('\n'));
-    }
 
-    return {
-      lastChecked: new Date(),
-    };
-  },
-});
+      const bucketFilters = await getThresholdBucketFilters({
+        thresholdSignalHistory,
+        timestampOverride,
+      });
+
+      const esFilter = await getFilter({
+        type: 'threshold',
+        filters: bucketFilters,
+        language: 'kuery',
+        query: params.customQuery,
+        savedId: undefined,
+        services: (services as unknown) as AlertServices,
+        index: params.indexPatterns,
+        lists: [],
+      });
+
+      const {
+        searchResult: thresholdResults,
+        searchErrors,
+        searchDuration: thresholdSearchDuration,
+      } = await findThresholdSignals({
+        inputIndexPattern: params.indexPatterns,
+        from,
+        to,
+        services: (services as unknown) as AlertServices,
+        logger: services.logger,
+        filter: esFilter,
+        threshold: {
+          field: params.thresholdFields,
+          value: params.thresholdValue,
+          cardinality: params.thresholdCardinality,
+        },
+        timestampOverride,
+        buildRuleMessage,
+      });
+
+      services.logger.info(`Threshold search took ${thresholdSearchDuration}ms`); // TODO: rule status service
+
+      const alerts = formatThresholdSignals({
+        results: thresholdResults,
+        ruleParams: params,
+        services: (services as unknown) as AlertServices & { logger: Logger },
+        inputIndexPattern: ['TODO'],
+        rule,
+        startedAt,
+        from: fromDate.toDate(),
+        thresholdSignalHistory,
+        buildRuleMessage,
+      });
+
+      const errors = searchErrors.concat(previousSearchErrors);
+      if (errors.length === 0) {
+        services.alertWithPersistence(alerts).forEach((alert) => {
+          alert.scheduleActions('default', { server: 'server-test' });
+        });
+      } else {
+        throw new Error(errors.join('\n'));
+      }
+
+      return {
+        lastChecked: new Date(),
+      };
+    },
+  });
+};
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/create_rules_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/create_rules_route.ts
index 1e34bbbbe4749..cdd344ecfb111 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/create_rules_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/create_rules_route.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { RuleDataClient } from '../../../../../../rule_registry/server';
 import { buildRouteValidation } from '../../../../utils/build_validation/route_validation';
 import { DETECTION_ENGINE_RULES_URL } from '../../../../../common/constants';
 import { SetupPlugins } from '../../../../plugin';
@@ -23,7 +24,8 @@ import { convertCreateAPIToInternalSchema } from '../../schemas/rule_converters'
 
 export const createRulesRoute = (
   router: SecuritySolutionPluginRouter,
-  ml: SetupPlugins['ml']
+  ml: SetupPlugins['ml'],
+  ruleDataClient: RuleDataClient | null
 ): void => {
   router.post(
     {
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/delete_rules_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/delete_rules_route.ts
index 3bd7c7f8730b3..bb8699fa024fd 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/delete_rules_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/delete_rules_route.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { RuleDataClient } from '../../../../../../rule_registry/server';
 import { queryRuleValidateTypeDependents } from '../../../../../common/detection_engine/schemas/request/query_rules_type_dependents';
 import {
   queryRulesSchema,
@@ -20,7 +21,10 @@ import { deleteNotifications } from '../../notifications/delete_notifications';
 import { deleteRuleActionsSavedObject } from '../../rule_actions/delete_rule_actions_saved_object';
 import { ruleStatusSavedObjectsClientFactory } from '../../signals/rule_status_saved_objects_client';
 
-export const deleteRulesRoute = (router: SecuritySolutionPluginRouter) => {
+export const deleteRulesRoute = (
+  router: SecuritySolutionPluginRouter,
+  ruleDataClient: RuleDataClient | null
+) => {
   router.delete(
     {
       path: DETECTION_ENGINE_RULES_URL,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/find_rules_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/find_rules_route.ts
index 005266f5c178f..ad5661ceb0f67 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/find_rules_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/find_rules_route.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { RuleDataClient } from '../../../../../../rule_registry/server';
 import { findRuleValidateTypeDependents } from '../../../../../common/detection_engine/schemas/request/find_rules_type_dependents';
 import {
   findRulesSchema,
@@ -19,7 +20,10 @@ import { ruleStatusSavedObjectsClientFactory } from '../../signals/rule_status_s
 import { buildRouteValidation } from '../../../../utils/build_validation/route_validation';
 import { transformFindAlerts } from './utils';
 
-export const findRulesRoute = (router: SecuritySolutionPluginRouter) => {
+export const findRulesRoute = (
+  router: SecuritySolutionPluginRouter,
+  ruleDataClient: RuleDataClient | null
+) => {
   router.get(
     {
       path: `${DETECTION_ENGINE_RULES_URL}/_find`,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/patch_rules_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/patch_rules_route.ts
index fd5c33f126fef..f14840fedd4e0 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/patch_rules_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/patch_rules_route.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { RuleDataClient } from '../../../../../../rule_registry/server';
 import { RuleAlertAction } from '../../../../../common/detection_engine/types';
 import { patchRuleValidateTypeDependents } from '../../../../../common/detection_engine/schemas/request/patch_rules_type_dependents';
 import { buildRouteValidation } from '../../../../utils/build_validation/route_validation';
@@ -26,7 +27,11 @@ import { ruleStatusSavedObjectsClientFactory } from '../../signals/rule_status_s
 import { readRules } from '../../rules/read_rules';
 import { PartialFilter } from '../../types';
 
-export const patchRulesRoute = (router: SecuritySolutionPluginRouter, ml: SetupPlugins['ml']) => {
+export const patchRulesRoute = (
+  router: SecuritySolutionPluginRouter,
+  ml: SetupPlugins['ml'],
+  ruleDataClient: RuleDataClient | null
+) => {
   router.patch(
     {
       path: DETECTION_ENGINE_RULES_URL,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/read_rules_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/read_rules_route.ts
index b2dd9ea8fb796..dd4170c01991d 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/read_rules_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/read_rules_route.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { RuleDataClient } from '../../../../../../rule_registry/server';
 import { queryRuleValidateTypeDependents } from '../../../../../common/detection_engine/schemas/request/query_rules_type_dependents';
 import {
   queryRulesSchema,
@@ -19,7 +20,10 @@ import { readRules } from '../../rules/read_rules';
 import { getRuleActionsSavedObject } from '../../rule_actions/get_rule_actions_saved_object';
 import { ruleStatusSavedObjectsClientFactory } from '../../signals/rule_status_saved_objects_client';
 
-export const readRulesRoute = (router: SecuritySolutionPluginRouter) => {
+export const readRulesRoute = (
+  router: SecuritySolutionPluginRouter,
+  ruleDataClient: RuleDataClient | null
+) => {
   router.get(
     {
       path: DETECTION_ENGINE_RULES_URL,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_route.ts
index b883b7b3462e7..25d925b7772bb 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_route.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { RuleDataClient } from '../../../../../../rule_registry/server';
 import { updateRulesSchema } from '../../../../../common/detection_engine/schemas/request';
 import { updateRuleValidateTypeDependents } from '../../../../../common/detection_engine/schemas/request/update_rules_type_dependents';
 import type { SecuritySolutionPluginRouter } from '../../../../types';
@@ -20,7 +21,11 @@ import { updateRulesNotifications } from '../../rules/update_rules_notifications
 import { ruleStatusSavedObjectsClientFactory } from '../../signals/rule_status_saved_objects_client';
 import { buildRouteValidation } from '../../../../utils/build_validation/route_validation';
 
-export const updateRulesRoute = (router: SecuritySolutionPluginRouter, ml: SetupPlugins['ml']) => {
+export const updateRulesRoute = (
+  router: SecuritySolutionPluginRouter,
+  ml: SetupPlugins['ml'],
+  ruleDataClient: RuleDataClient | null
+) => {
   router.put(
     {
       path: DETECTION_ENGINE_RULES_URL,
diff --git a/x-pack/plugins/security_solution/server/plugin.ts b/x-pack/plugins/security_solution/server/plugin.ts
index d9a24893087c7..94fb19b6e586e 100644
--- a/x-pack/plugins/security_solution/server/plugin.ts
+++ b/x-pack/plugins/security_solution/server/plugin.ts
@@ -30,6 +30,7 @@ import {
 import { ecsFieldMap, pickWithPatterns } from '../../rule_registry/common';
 import { RuleRegistryPluginSetupContract } from '../../rule_registry/server';
 import { SecurityPluginSetup as SecuritySetup, SecurityPluginStart } from '../../security/server';
+import { RuleDataClient, RuleRegistryPluginSetupContract } from '../../rule_registry/server';
 import { PluginSetupContract as FeaturesSetup } from '../../features/server';
 import { MlPluginSetup as MlSetup } from '../../ml/server';
 import { ListPluginSetup } from '../../lists/server';
@@ -39,9 +40,9 @@ import { ILicense, LicensingPluginStart } from '../../licensing/server';
 import { FleetStartContract } from '../../fleet/server';
 import { TaskManagerSetupContract, TaskManagerStartContract } from '../../task_manager/server';
 import { compose } from './lib/compose/kibana';
-import { queryAlertType } from './lib/detection_engine/reference_rules/query';
-import { eqlAlertType } from './lib/detection_engine/reference_rules/eql';
-import { thresholdAlertType } from './lib/detection_engine/reference_rules/threshold';
+import { createQueryAlertType } from './lib/detection_engine/reference_rules/query';
+import { createEqlAlertType } from './lib/detection_engine/reference_rules/eql';
+import { createThresholdAlertType } from './lib/detection_engine/reference_rules/threshold';
 import { initRoutes } from './routes';
 import { isAlertExecutor } from './lib/detection_engine/signals/types';
 import { signalRulesAlertType } from './lib/detection_engine/signals/signal_rule_alert_type';
@@ -205,13 +206,35 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
       config,
     });
 
+    // TODO: Once we are past experimental phase this check can be removed along with legacy registration of rules
+    let ruleDataClient: RuleDataClient | null = null;
+    if (experimentalFeatures.ruleRegistryEnabled) {
+      // Create rule-registry data client scoped to security-solution
+      const start = () => core.getStartServices().then(([coreStart]) => coreStart);
+
+      ruleDataClient = new RuleDataClient({
+        getClusterClient: async () => {
+          const coreStart = await start();
+          return coreStart.elasticsearch.client.asInternalUser;
+        },
+        ready: () => Promise.resolve(),
+        alias: plugins.ruleRegistry.getFullAssetName(),
+      });
+
+      // Register reference rule types via rule-registry
+      this.setupPlugins.alerting.registerType(createQueryAlertType(ruleDataClient));
+      this.setupPlugins.alerting.registerType(createEqlAlertType(ruleDataClient));
+      this.setupPlugins.alerting.registerType(createThresholdAlertType(ruleDataClient));
+    }
+
     // TO DO We need to get the endpoint routes inside of initRoutes
     initRoutes(
       router,
       config,
       plugins.encryptedSavedObjects?.canEncrypt === true,
       plugins.security,
-      plugins.ml
+      plugins.ml,
+      ruleDataClient
     );
     registerEndpointRoutes(router, endpointContext);
     registerLimitedConcurrencyRoutes(core);
@@ -287,23 +310,6 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
       },
     });
 
-    // TODO: Once we are past experimental phase this check can be removed along with legacy registration of rules
-    if (experimentalFeatures.ruleRegistryEnabled) {
-      // Create rule-registry scoped to security-solution (APP_ID uses caps, not supported)
-      this.setupPlugins.ruleRegistry = plugins.ruleRegistry.create({
-        name: 'security-solution',
-        // fieldMap: ecsFieldMap,
-        fieldMap: {
-          ...pickWithPatterns(ecsFieldMap, 'host.name', 'service.name'),
-        },
-      });
-
-      // Register reference rule types via rule-registry
-      this.setupPlugins.ruleRegistry.registerType(queryAlertType);
-      this.setupPlugins.ruleRegistry.registerType(eqlAlertType);
-      this.setupPlugins.ruleRegistry.registerType(thresholdAlertType);
-    }
-
     // Continue to register legacy rules against alerting client exposed through rule-registry
     if (this.setupPlugins.alerting != null) {
       const signalRuleType = signalRulesAlertType({
diff --git a/x-pack/plugins/security_solution/server/routes/index.ts b/x-pack/plugins/security_solution/server/routes/index.ts
index 54090dc886ceb..0ea7809bd1a15 100644
--- a/x-pack/plugins/security_solution/server/routes/index.ts
+++ b/x-pack/plugins/security_solution/server/routes/index.ts
@@ -5,6 +5,8 @@
  * 2.0.
  */
 
+import { RuleDataClient } from '../../../rule_registry/server';
+
 import { SecuritySolutionPluginRouter } from '../types';
 
 import { createRulesRoute } from '../lib/detection_engine/routes/rules/create_rules_route';
@@ -59,16 +61,19 @@ export const initRoutes = (
   config: ConfigType,
   hasEncryptionKey: boolean,
   security: SetupPlugins['security'],
-  ml: SetupPlugins['ml']
+  ml: SetupPlugins['ml'],
+  ruleDataClient: RuleDataClient | null
 ) => {
   // Detection Engine Rule routes that have the REST endpoints of /api/detection_engine/rules
   // All REST rule creation, deletion, updating, etc......
-  createRulesRoute(router, ml);
-  readRulesRoute(router);
-  updateRulesRoute(router, ml);
-  patchRulesRoute(router, ml);
-  deleteRulesRoute(router);
-  findRulesRoute(router);
+  createRulesRoute(router, ml, ruleDataClient);
+  readRulesRoute(router, ruleDataClient);
+  updateRulesRoute(router, ml, ruleDataClient);
+  patchRulesRoute(router, ml, ruleDataClient);
+  deleteRulesRoute(router, ruleDataClient);
+  findRulesRoute(router, ruleDataClient);
+
+  // TODO: pass ruleDataClient to all relevant routes
 
   addPrepackedRulesRoute(router, config, security);
   getPrepackagedRulesStatusRoute(router, config, security);

From c3e4c52ed45fa1b1c1b1f9cd93fd390244c7a2cb Mon Sep 17 00:00:00 2001
From: Madison Caldwell <madison.caldwell@elastic.co>
Date: Mon, 10 May 2021 13:56:57 -0400
Subject: [PATCH 32/54] Fix rule type registration and unit tests

---
 x-pack/plugins/rule_registry/server/index.ts  |   2 +-
 .../create_persistence_rule_type_factory.ts   | 113 -----------------
 .../create_persistence_rule_type_factory.ts   | 116 ++++++++++++++++++
 .../reference_rules/__mocks__/rule_type.ts    |  30 +++--
 .../reference_rules/eql.test.ts               |  12 +-
 .../detection_engine/reference_rules/eql.ts   |  15 +--
 .../reference_rules/query.test.ts             |  12 +-
 .../detection_engine/reference_rules/query.ts |  22 ++--
 .../reference_rules/threshold.test.ts         |  18 ++-
 .../reference_rules/threshold.ts              |  44 +++----
 .../security_solution/server/plugin.ts        |  10 +-
 11 files changed, 210 insertions(+), 184 deletions(-)
 delete mode 100644 x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_persistence_rule_type_factory.ts
 create mode 100644 x-pack/plugins/rule_registry/server/utils/create_persistence_rule_type_factory.ts

diff --git a/x-pack/plugins/rule_registry/server/index.ts b/x-pack/plugins/rule_registry/server/index.ts
index 08b043657bf98..70493fcff6671 100644
--- a/x-pack/plugins/rule_registry/server/index.ts
+++ b/x-pack/plugins/rule_registry/server/index.ts
@@ -14,7 +14,7 @@ export { RuleDataClient } from './rule_data_client';
 export { IRuleDataClient } from './rule_data_client/types';
 export { getRuleExecutorData, RuleExecutorData } from './utils/get_rule_executor_data';
 export { createLifecycleRuleTypeFactory } from './utils/create_lifecycle_rule_type_factory';
-export { createPersistenceRuleTypeFactory } from './rule_registry/rule_type_helpers/create_persistence_rule_type_factory';
+export { createPersistenceRuleTypeFactory } from './utils/create_persistence_rule_type_factory';
 
 export const config = {
   schema: schema.object({
diff --git a/x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_persistence_rule_type_factory.ts b/x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_persistence_rule_type_factory.ts
deleted file mode 100644
index f94005b314aae..0000000000000
--- a/x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_persistence_rule_type_factory.ts
+++ /dev/null
@@ -1,113 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-import { ESSearchRequest } from 'typings/elasticsearch';
-import v4 from 'uuid/v4';
-
-import { AlertInstance } from '../../../../alerting/server';
-import { ActionVariable, AlertInstanceState } from '../../../../alerting/common';
-import { baseRuleFieldMap, BaseRuleFieldMap, OutputOfFieldMap } from '../../../common';
-import { RuleParams, RuleType } from '../../types';
-import { RuleRegistry } from '..';
-
-type PersistenceAlertPersistenceService<
-  TFieldMap extends BaseRuleFieldMap,
-  TActionVariable extends ActionVariable
-> = (
-  alerts: Array<OutputOfFieldMap<TFieldMap>>
-) => Array<AlertInstance<AlertInstanceState, { [key in TActionVariable['name']]: any }, string>>;
-
-type PersistenceAlertQueryService<TFieldMap extends BaseRuleFieldMap> = (
-  query: ESSearchRequest
-) => Promise<Array<OutputOfFieldMap<TFieldMap>>>;
-
-type CreatePersistenceRuleType<TFieldMap extends BaseRuleFieldMap> = <
-  TRuleParams extends RuleParams,
-  TActionVariable extends ActionVariable
->(
-  type: RuleType<
-    TFieldMap,
-    TRuleParams,
-    TActionVariable,
-    {
-      alertWithPersistence: PersistenceAlertPersistenceService<TFieldMap, TActionVariable>;
-      findAlerts: PersistenceAlertQueryService<TFieldMap>;
-    }
-  >
-) => RuleType<TFieldMap, TRuleParams, TActionVariable>;
-
-export function createPersistenceRuleTypeFactory<
-  TRuleRegistry extends RuleRegistry<BaseRuleFieldMap>
->(): TRuleRegistry extends RuleRegistry<infer TFieldMap>
-  ? CreatePersistenceRuleType<TFieldMap>
-  : never;
-
-export function createPersistenceRuleTypeFactory(): CreatePersistenceRuleType<BaseRuleFieldMap> {
-  return (type) => {
-    return {
-      ...type,
-      executor: async (options) => {
-        const {
-          services: { scopedClusterClient, scopedRuleRegistryClient, alertInstanceFactory, logger },
-        } = options;
-
-        const currentAlerts: Array<OutputOfFieldMap<BaseRuleFieldMap>> = [];
-        const timestamp = options.startedAt.toISOString();
-
-        const state = await type.executor({
-          ...options,
-          services: {
-            ...options.services,
-            alertWithPersistence: (alerts) => {
-              alerts.forEach((alert) => currentAlerts.push(alert));
-              return alerts.map((alert) => alertInstanceFactory(alert['kibana.rac.alert.uuid']!));
-            },
-            findAlerts: async (query) => {
-              const { body } = await scopedClusterClient.asCurrentUser.search<
-                OutputOfFieldMap<BaseRuleFieldMap>
-              >({
-                ...query,
-                body: {
-                  ...query.body,
-                  _source: Object.keys(baseRuleFieldMap),
-                },
-                ignore_unavailable: true,
-              });
-              return body.hits.hits
-                .map((event) => event._source!)
-                .map((event) => {
-                  const alertUuid = event['kibana.rac.alert.uuid'];
-                  const isAlert = alertUuid != null;
-                  return {
-                    ...event,
-                    'event.kind': 'signal',
-                    'kibana.rac.alert.id': '???',
-                    'kibana.rac.alert.uuid': v4(),
-                    'kibana.rac.alert.ancestors': isAlert
-                      ? (event['kibana.rac.alert.ancestors'] ?? []).concat([alertUuid!])
-                      : [],
-                    'kibana.rac.alert.depth': isAlert
-                      ? (event['kibana.rac.alert.depth'] ?? 0) + 1
-                      : 0,
-                    '@timestamp': timestamp,
-                  };
-                });
-            },
-          },
-        });
-
-        const numAlerts = currentAlerts.length;
-        logger.debug(`Found ${numAlerts} alerts.`);
-
-        if (scopedRuleRegistryClient && numAlerts) {
-          await scopedRuleRegistryClient.bulkIndex(currentAlerts);
-        }
-
-        return state;
-      },
-    };
-  };
-}
diff --git a/x-pack/plugins/rule_registry/server/utils/create_persistence_rule_type_factory.ts b/x-pack/plugins/rule_registry/server/utils/create_persistence_rule_type_factory.ts
new file mode 100644
index 0000000000000..2d0b4e0ae33c3
--- /dev/null
+++ b/x-pack/plugins/rule_registry/server/utils/create_persistence_rule_type_factory.ts
@@ -0,0 +1,116 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { ESSearchRequest } from 'typings/elasticsearch';
+import v4 from 'uuid/v4';
+import { Logger } from '@kbn/logging';
+
+import { AlertInstance } from '../../../alerting/server';
+import {
+  AlertInstanceContext,
+  AlertInstanceState,
+  AlertTypeParams,
+} from '../../../alerting/common';
+import { RuleDataClient } from '../rule_data_client';
+import { AlertTypeWithExecutor } from '../types';
+
+type PersistenceAlertService<TAlertInstanceContext extends Record<string, unknown>> = (
+  alerts: Array<Record<string, unknown>>
+) => Array<AlertInstance<AlertInstanceState, TAlertInstanceContext, string>>;
+
+type PersistenceAlertQueryService = (
+  query: ESSearchRequest
+) => Promise<Array<Record<string, unknown>>>;
+
+type CreatePersistenceRuleTypeFactory = (options: {
+  ruleDataClient: RuleDataClient;
+  logger: Logger;
+}) => <
+  TParams extends AlertTypeParams,
+  TAlertInstanceContext extends AlertInstanceContext,
+  TServices extends {
+    alertWithPersistence: PersistenceAlertService<TAlertInstanceContext>;
+    findAlerts: PersistenceAlertQueryService;
+  }
+>(
+  type: AlertTypeWithExecutor<TParams, TAlertInstanceContext, TServices>
+) => AlertTypeWithExecutor<TParams, TAlertInstanceContext, any>;
+
+export const createPersistenceRuleTypeFactory: CreatePersistenceRuleTypeFactory = ({
+  logger,
+  ruleDataClient,
+}) => (type) => {
+  return {
+    ...type,
+    executor: async (options) => {
+      const {
+        services: { alertInstanceFactory, scopedClusterClient },
+      } = options;
+
+      const currentAlerts: Array<Record<string, unknown>> = [];
+      const timestamp = options.startedAt.toISOString();
+
+      const state = await type.executor({
+        ...options,
+        services: {
+          ...options.services,
+          alertWithPersistence: (alerts) => {
+            alerts.forEach((alert) => currentAlerts.push(alert));
+            return alerts.map((alert) =>
+              alertInstanceFactory(alert['kibana.rac.alert.uuid']! as string)
+            );
+          },
+          findAlerts: async (query) => {
+            const { body } = await scopedClusterClient.asCurrentUser.search({
+              ...query,
+              body: {
+                ...query.body,
+              },
+              ignore_unavailable: true,
+            });
+            return body.hits.hits
+              .map((event: { _source: any }) => event._source!)
+              .map((event: { [x: string]: any }) => {
+                const alertUuid = event['kibana.rac.alert.uuid'];
+                const isAlert = alertUuid != null;
+                return {
+                  ...event,
+                  'event.kind': 'signal',
+                  'kibana.rac.alert.id': '???',
+                  'kibana.rac.alert.uuid': v4(),
+                  'kibana.rac.alert.ancestors': isAlert
+                    ? ((event['kibana.rac.alert.ancestors'] as string[]) ?? []).concat([
+                        alertUuid!,
+                      ] as string[])
+                    : [],
+                  'kibana.rac.alert.depth': isAlert
+                    ? ((event['kibana.rac.alert.depth'] as number) ?? 0) + 1
+                    : 0,
+                  '@timestamp': timestamp,
+                };
+              });
+          },
+        },
+      });
+
+      const numAlerts = currentAlerts.length;
+      logger.debug(`Found ${numAlerts} alerts.`);
+
+      if (ruleDataClient && numAlerts) {
+        await ruleDataClient.getWriter().bulk({
+          body: currentAlerts.map((alert) => ({
+            create: {
+              _index: {},
+            },
+            alert,
+          })),
+        });
+      }
+
+      return state;
+    },
+  };
+};
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/__mocks__/rule_type.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/__mocks__/rule_type.ts
index a351ae494e9ba..f7e0dd9eb3620 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/__mocks__/rule_type.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/__mocks__/rule_type.ts
@@ -11,12 +11,13 @@ import { v4 } from 'uuid';
 import { Logger } from 'kibana/server';
 import { elasticsearchServiceMock } from 'src/core/server/mocks';
 
-import { SecurityRuleRegistry } from '../../../../plugin';
+import type { RuleDataClient } from '../../../../../../rule_registry/server';
+import { PluginSetupContract as AlertingPluginSetupContract } from '../../../../../../alerting/server';
 import { ConfigType } from '../../../../config';
 
 export const createRuleTypeMocks = () => {
   /* eslint-disable @typescript-eslint/no-explicit-any */
-  let alertExecutor: (...args: any[]) => Promise<Record<string, any>>;
+  let alertExecutor: (...args: any[]) => Promise<any>;
 
   const mockedConfig$ = of({} as ConfigType);
 
@@ -27,19 +28,16 @@ export const createRuleTypeMocks = () => {
     error: jest.fn(),
   } as unknown) as Logger;
 
-  const registry = {
+  const alerting = {
     registerType: ({ executor }) => {
       alertExecutor = executor;
     },
-  } as SecurityRuleRegistry;
+  } as AlertingPluginSetupContract;
 
   const scheduleActions = jest.fn();
 
   const services = {
     scopedClusterClient: elasticsearchServiceMock.createScopedClusterClient(),
-    scopedRuleRegistryClient: {
-      bulkIndex: jest.fn(),
-    },
     alertInstanceFactory: jest.fn(() => ({ scheduleActions })),
     findAlerts: jest.fn(), // TODO: does this stay?
     alertWithPersistence: jest.fn(),
@@ -48,9 +46,21 @@ export const createRuleTypeMocks = () => {
 
   return {
     dependencies: {
-      registry,
+      alerting,
       config$: mockedConfig$,
       logger: loggerMock,
+      ruleDataClient: ({
+        getReader: () => {
+          return {
+            search: jest.fn(),
+          };
+        },
+        getWriter: () => {
+          return {
+            bulk: jest.fn(),
+          };
+        },
+      } as unknown) as RuleDataClient,
     },
     services,
     scheduleActions,
@@ -58,9 +68,7 @@ export const createRuleTypeMocks = () => {
       return alertExecutor({
         services,
         params,
-        rule: {
-          id: v4(),
-        },
+        alertId: v4(),
         startedAt: new Date(),
       });
     },
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.test.ts
index 981a5413bffcf..6529c594dd5a5 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.test.ts
@@ -10,14 +10,15 @@ import { elasticsearchClientMock } from 'src/core/server/elasticsearch/client/mo
 
 import { sequenceResponse } from '../../../search_strategy/timeline/eql/__mocks__';
 
-import { eqlAlertType } from './eql';
+import { createEqlAlertType } from './eql';
 import { createRuleTypeMocks } from './__mocks__/rule_type';
 
 describe('EQL alerts', () => {
   it('does not send an alert when sequence not found', async () => {
     const { services, dependencies, executor } = createRuleTypeMocks();
+    const eqlAlertType = createEqlAlertType(dependencies.ruleDataClient, dependencies.logger);
 
-    dependencies.registry.registerType(eqlAlertType);
+    dependencies.alerting.registerType(eqlAlertType);
 
     const params = {
       eqlQuery: 'sequence by host.name↵[any where true]↵[any where true]↵[any where true]',
@@ -52,8 +53,9 @@ describe('EQL alerts', () => {
 
   it('sends a properly formatted alert when sequence is found', async () => {
     const { services, dependencies, executor } = createRuleTypeMocks();
+    const eqlAlertType = createEqlAlertType(dependencies.ruleDataClient, dependencies.logger);
 
-    dependencies.registry.registerType(eqlAlertType);
+    dependencies.alerting.registerType(eqlAlertType);
 
     const params = {
       eqlQuery: 'sequence by host.name↵[any where true]↵[any where true]↵[any where true]',
@@ -76,7 +78,8 @@ describe('EQL alerts', () => {
 
     await executor({ params });
     expect(services.alertInstanceFactory).toBeCalled();
-    expect(services.scopedRuleRegistryClient.bulkIndex).toBeCalledWith(
+    /*
+    expect(services.alertWithPersistence).toBeCalledWith(
       expect.arrayContaining([
         expect.objectContaining({
           'event.kind': 'signal',
@@ -84,5 +87,6 @@ describe('EQL alerts', () => {
         }),
       ])
     );
+    */
   });
 });
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.ts
index e620d3d4d003e..39d02c808d09e 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/eql.ts
@@ -10,6 +10,7 @@ import v4 from 'uuid/v4';
 
 import { ApiResponse } from '@elastic/elasticsearch';
 import { schema } from '@kbn/config-schema';
+import { Logger } from '@kbn/logging';
 
 import {
   RuleDataClient,
@@ -17,13 +18,14 @@ import {
 } from '../../../../../rule_registry/server';
 import { EQL_ALERT_TYPE_ID } from '../../../../common/constants';
 import { buildEqlSearchRequest } from '../../../../common/detection_engine/get_query_filter';
-import { SecurityRuleRegistry } from '../../../plugin';
 import { BaseSignalHit, EqlSignalSearchResponse } from '../signals/types';
 
-const createSecurityEQLRuleType = createPersistenceRuleTypeFactory<SecurityRuleRegistry>();
-
-export const createEqlAlertType = (ruleDataClient: RuleDataClient) => {
-  return createSecurityEQLRuleType({
+export const createEqlAlertType = (ruleDataClient: RuleDataClient, logger: Logger) => {
+  const createPersistenceRuleType = createPersistenceRuleTypeFactory({
+    ruleDataClient,
+    logger,
+  });
+  return createPersistenceRuleType({
     id: EQL_ALERT_TYPE_ID,
     name: 'EQL Rule',
     validate: {
@@ -45,8 +47,6 @@ export const createEqlAlertType = (ruleDataClient: RuleDataClient) => {
     minimumLicenseRequired: 'basic',
     producer: 'security-solution',
     async executor({
-      // previousStartedAt,
-      rule,
       startedAt,
       services: { alertWithPersistence, findAlerts, scopedClusterClient },
       params: { indexPatterns, eqlQuery },
@@ -78,6 +78,7 @@ export const createEqlAlertType = (ruleDataClient: RuleDataClient) => {
         };
       };
 
+      /* eslint-disable @typescript-eslint/no-explicit-any */
       let alerts: any[] = [];
       if (response.hits.sequences !== undefined) {
         alerts = response.hits.sequences.reduce((allAlerts: any[], sequence) => {
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/query.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/query.test.ts
index 9d285016800db..e8c45e9ab7056 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/query.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/query.test.ts
@@ -12,14 +12,15 @@ import { elasticsearchClientMock } from 'src/core/server/elasticsearch/client/mo
 
 import { sampleDocNoSortId } from '../signals/__mocks__/es_results';
 
-import { queryAlertType } from './query';
+import { createQueryAlertType } from './query';
 import { createRuleTypeMocks } from './__mocks__/rule_type';
 
 describe('Custom query alerts', () => {
   it('does not send an alert when no events found', async () => {
     const { services, dependencies, executor } = createRuleTypeMocks();
+    const queryAlertType = createQueryAlertType(dependencies.ruleDataClient, dependencies.logger);
 
-    dependencies.registry.registerType(queryAlertType);
+    dependencies.alerting.registerType(queryAlertType);
 
     const params = {
       customQuery: 'dne:42',
@@ -54,8 +55,9 @@ describe('Custom query alerts', () => {
 
   it('sends a properly formatted alert when events are found', async () => {
     const { services, dependencies, executor } = createRuleTypeMocks();
+    const queryAlertType = createQueryAlertType(dependencies.ruleDataClient, dependencies.logger);
 
-    dependencies.registry.registerType(queryAlertType);
+    dependencies.alerting.registerType(queryAlertType);
 
     const params = {
       customQuery: '*:*',
@@ -84,12 +86,14 @@ describe('Custom query alerts', () => {
 
     await executor({ params });
     expect(services.alertInstanceFactory).toBeCalled();
-    expect(services.scopedRuleRegistryClient.bulkIndex).toBeCalledWith(
+    /*
+    expect(services.alertWithPersistence).toBeCalledWith(
       expect.arrayContaining([
         expect.objectContaining({
           'event.kind': 'signal',
         }),
       ])
     );
+    */
   });
 });
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/query.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/query.ts
index a96a835e08ebb..dd4d4fb54afba 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/query.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/query.ts
@@ -5,7 +5,10 @@
  * 2.0.
  */
 
+import { QueryContainer } from '@elastic/elasticsearch/api/types';
 import { schema } from '@kbn/config-schema';
+import { Logger } from '@kbn/logging';
+import { ESSearchRequest } from 'typings/elasticsearch';
 
 import { buildEsQuery, IIndexPattern } from '../../../../../../../src/plugins/data/common';
 
@@ -14,12 +17,13 @@ import {
   createPersistenceRuleTypeFactory,
 } from '../../../../../rule_registry/server';
 import { CUSTOM_ALERT_TYPE_ID } from '../../../../common/constants';
-import { SecurityRuleRegistry } from '../../../plugin';
 
-const createSecurityCustomRuleType = createPersistenceRuleTypeFactory<SecurityRuleRegistry>();
-
-export const createQueryAlertType = (ruleDataClient: RuleDataClient) => {
-  return createSecurityCustomRuleType({
+export const createQueryAlertType = (ruleDataClient: RuleDataClient, logger: Logger) => {
+  const createPersistenceRuleType = createPersistenceRuleTypeFactory({
+    ruleDataClient,
+    logger,
+  });
+  return createPersistenceRuleType({
     id: CUSTOM_ALERT_TYPE_ID,
     name: 'Custom Query Rule',
     validate: {
@@ -51,8 +55,12 @@ export const createQueryAlertType = (ruleDataClient: RuleDataClient) => {
 
       // TODO: kql or lucene?
 
-      const esQuery = buildEsQuery(indexPattern, { query: customQuery, language: 'kuery' }, []);
-      const query = {
+      const esQuery = buildEsQuery(
+        indexPattern,
+        { query: customQuery, language: 'kuery' },
+        []
+      ) as QueryContainer;
+      const query: ESSearchRequest = {
         body: {
           query: esQuery,
           fields: ['*'],
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.test.ts
index 83be0d5f96914..36e53b8154e70 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.test.ts
@@ -10,13 +10,17 @@ import { elasticsearchClientMock } from 'src/core/server/elasticsearch/client/mo
 
 import { createRuleTypeMocks } from './__mocks__/rule_type';
 import { mockThresholdResults } from './__mocks__/threshold';
-import { thresholdAlertType } from './threshold';
+import { createThresholdAlertType } from './threshold';
 
 describe('Threshold alerts', () => {
   it('does not send an alert when threshold is not met', async () => {
     const { services, dependencies, executor } = createRuleTypeMocks();
+    const thresholdAlertType = createThresholdAlertType(
+      dependencies.ruleDataClient,
+      dependencies.logger
+    );
 
-    dependencies.registry.registerType(thresholdAlertType);
+    dependencies.alerting.registerType(thresholdAlertType);
 
     const params = {
       indexPatterns: ['*'],
@@ -58,8 +62,12 @@ describe('Threshold alerts', () => {
 
   it('sends a properly formatted alert when threshold is met', async () => {
     const { services, dependencies, executor } = createRuleTypeMocks();
+    const thresholdAlertType = createThresholdAlertType(
+      dependencies.ruleDataClient,
+      dependencies.logger
+    );
 
-    dependencies.registry.registerType(thresholdAlertType);
+    dependencies.alerting.registerType(thresholdAlertType);
 
     const params = {
       indexPatterns: ['*'],
@@ -111,12 +119,14 @@ describe('Threshold alerts', () => {
 
     await executor({ params });
     expect(services.alertInstanceFactory).toBeCalled();
-    expect(services.scopedRuleRegistryClient.bulkIndex).toBeCalledWith(
+    /*
+    expect(services.alertWithPersistence).toBeCalledWith(
       expect.arrayContaining([
         expect.objectContaining({
           'event.kind': 'signal',
         }),
       ])
     );
+    */
   });
 });
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.ts
index 4ba8603ccd019..d4721e8bab11d 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/threshold.ts
@@ -9,8 +9,7 @@ import moment from 'moment';
 import v4 from 'uuid/v4';
 
 import { schema } from '@kbn/config-schema';
-
-import { Logger } from '../../../../../../../src/core/server';
+import { Logger } from '@kbn/logging';
 
 import { AlertServices } from '../../../../../alerting/server';
 import {
@@ -18,7 +17,6 @@ import {
   createPersistenceRuleTypeFactory,
 } from '../../../../../rule_registry/server';
 import { THRESHOLD_ALERT_TYPE_ID } from '../../../../common/constants';
-import { SecurityRuleRegistry } from '../../../plugin';
 import { SignalSearchResponse, ThresholdSignalHistory } from '../signals/types';
 import {
   findThresholdSignals,
@@ -29,15 +27,6 @@ import {
 import { getFilter } from '../signals/get_filter';
 import { BuildRuleMessage } from '../signals/rule_messages';
 
-const createSecurityThresholdRuleType = createPersistenceRuleTypeFactory<SecurityRuleRegistry>();
-
-interface Rule {
-  id: string;
-  uuid: string;
-  name: string;
-  category: string;
-}
-
 interface RuleParams {
   indexPatterns: string[];
   customQuery: string;
@@ -54,13 +43,14 @@ interface BulkCreateThresholdSignalParams {
   ruleParams: RuleParams;
   services: AlertServices & { logger: Logger };
   inputIndexPattern: string[];
-  rule: Rule;
+  ruleId: string;
   startedAt: Date;
   from: Date;
   thresholdSignalHistory: ThresholdSignalHistory;
   buildRuleMessage: BuildRuleMessage;
 }
 
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
 const formatThresholdSignals = (params: BulkCreateThresholdSignalParams): any[] => {
   const thresholdResults = params.results;
   const threshold = {
@@ -75,7 +65,7 @@ const formatThresholdSignals = (params: BulkCreateThresholdSignalParams): any[]
     undefined,
     params.services.logger,
     threshold,
-    params.rule.id,
+    params.ruleId,
     undefined,
     params.thresholdSignalHistory
   );
@@ -90,8 +80,12 @@ const formatThresholdSignals = (params: BulkCreateThresholdSignalParams): any[]
   });
 };
 
-export const createThresholdAlertType = (ruleDataClient: RuleDataClient) => {
-  return createSecurityThresholdRuleType({
+export const createThresholdAlertType = (ruleDataClient: RuleDataClient, logger: Logger) => {
+  const createPersistenceRuleType = createPersistenceRuleTypeFactory({
+    ruleDataClient,
+    logger,
+  });
+  return createPersistenceRuleType({
     id: THRESHOLD_ALERT_TYPE_ID,
     name: 'Threshold Rule',
     validate: {
@@ -120,13 +114,7 @@ export const createThresholdAlertType = (ruleDataClient: RuleDataClient) => {
     },
     minimumLicenseRequired: 'basic',
     producer: 'security-solution',
-    async executor({
-      // previousStartedAt,
-      rule,
-      startedAt,
-      services,
-      params,
-    }) {
+    async executor({ startedAt, services, params, alertId }) {
       const fromDate = moment(startedAt).subtract(moment.duration(5, 'm')); // hardcoded 5-minute rule interval
       const from = fromDate.toISOString();
       const to = startedAt.toISOString();
@@ -144,8 +132,8 @@ export const createThresholdAlertType = (ruleDataClient: RuleDataClient) => {
         from,
         to,
         services: (services as unknown) as AlertServices,
-        logger: services.logger,
-        ruleId: rule.id,
+        logger,
+        ruleId: alertId,
         bucketByFields: params.thresholdFields,
         timestampOverride,
         buildRuleMessage,
@@ -176,7 +164,7 @@ export const createThresholdAlertType = (ruleDataClient: RuleDataClient) => {
         from,
         to,
         services: (services as unknown) as AlertServices,
-        logger: services.logger,
+        logger,
         filter: esFilter,
         threshold: {
           field: params.thresholdFields,
@@ -187,14 +175,14 @@ export const createThresholdAlertType = (ruleDataClient: RuleDataClient) => {
         buildRuleMessage,
       });
 
-      services.logger.info(`Threshold search took ${thresholdSearchDuration}ms`); // TODO: rule status service
+      logger.info(`Threshold search took ${thresholdSearchDuration}ms`); // TODO: rule status service
 
       const alerts = formatThresholdSignals({
         results: thresholdResults,
         ruleParams: params,
         services: (services as unknown) as AlertServices & { logger: Logger },
         inputIndexPattern: ['TODO'],
-        rule,
+        ruleId: alertId,
         startedAt,
         from: fromDate.toDate(),
         thresholdSignalHistory,
diff --git a/x-pack/plugins/security_solution/server/plugin.ts b/x-pack/plugins/security_solution/server/plugin.ts
index 94fb19b6e586e..523b3b83869fc 100644
--- a/x-pack/plugins/security_solution/server/plugin.ts
+++ b/x-pack/plugins/security_solution/server/plugin.ts
@@ -87,8 +87,6 @@ import { securitySolutionTimelineEqlSearchStrategyProvider } from './search_stra
 import { parseExperimentalConfigValue } from '../common/experimental_features';
 import { migrateArtifactsToFleet } from './endpoint/lib/artifacts/migrate_artifacts_to_fleet';
 
-export type SecurityRuleRegistry = SetupPlugins['ruleRegistry'];
-
 export interface SetupPlugins {
   alerting: AlertingSetup;
   data: DataPluginSetup;
@@ -222,9 +220,11 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
       });
 
       // Register reference rule types via rule-registry
-      this.setupPlugins.alerting.registerType(createQueryAlertType(ruleDataClient));
-      this.setupPlugins.alerting.registerType(createEqlAlertType(ruleDataClient));
-      this.setupPlugins.alerting.registerType(createThresholdAlertType(ruleDataClient));
+      this.setupPlugins.alerting.registerType(createQueryAlertType(ruleDataClient, this.logger));
+      this.setupPlugins.alerting.registerType(createEqlAlertType(ruleDataClient, this.logger));
+      this.setupPlugins.alerting.registerType(
+        createThresholdAlertType(ruleDataClient, this.logger)
+      );
     }
 
     // TO DO We need to get the endpoint routes inside of initRoutes

From 5900380e141b86914deae520923397d27a70f6d2 Mon Sep 17 00:00:00 2001
From: Madison Caldwell <madison.caldwell@elastic.co>
Date: Tue, 11 May 2021 14:11:53 -0400
Subject: [PATCH 33/54] Fixup security solution server plugin

---
 x-pack/plugins/security_solution/server/plugin.ts | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/x-pack/plugins/security_solution/server/plugin.ts b/x-pack/plugins/security_solution/server/plugin.ts
index 523b3b83869fc..21d6b88929943 100644
--- a/x-pack/plugins/security_solution/server/plugin.ts
+++ b/x-pack/plugins/security_solution/server/plugin.ts
@@ -27,8 +27,6 @@ import {
   PluginSetupContract as AlertingSetup,
   PluginStartContract as AlertPluginStartContract,
 } from '../../alerting/server';
-import { ecsFieldMap, pickWithPatterns } from '../../rule_registry/common';
-import { RuleRegistryPluginSetupContract } from '../../rule_registry/server';
 import { SecurityPluginSetup as SecuritySetup, SecurityPluginStart } from '../../security/server';
 import { RuleDataClient, RuleRegistryPluginSetupContract } from '../../rule_registry/server';
 import { PluginSetupContract as FeaturesSetup } from '../../features/server';
@@ -143,6 +141,7 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
   private readonly config: ConfigType;
   private context: PluginInitializerContext;
   private appClientFactory: AppClientFactory;
+  private setupPlugins?: SetupPlugins;
   private readonly endpointAppContextService = new EndpointAppContextService();
   private readonly telemetryEventsSender: TelemetryEventsSender;
 

From dece3bbce8e132ded6650c36ce214db7b5bce249 Mon Sep 17 00:00:00 2001
From: Madison Caldwell <madison.caldwell@elastic.co>
Date: Tue, 11 May 2021 14:28:28 -0400
Subject: [PATCH 34/54] Observability fixup

---
 x-pack/plugins/observability/public/pages/alerts/index.tsx | 1 -
 1 file changed, 1 deletion(-)

diff --git a/x-pack/plugins/observability/public/pages/alerts/index.tsx b/x-pack/plugins/observability/public/pages/alerts/index.tsx
index ef7805d3be81c..dac39fa3d3175 100644
--- a/x-pack/plugins/observability/public/pages/alerts/index.tsx
+++ b/x-pack/plugins/observability/public/pages/alerts/index.tsx
@@ -28,7 +28,6 @@ import {
   RULE_ID,
   RULE_NAME,
 } from '../../../../rule_registry/common/technical_rule_data_field_names';
-import type { ObservabilityAPIReturnType } from '../../services/call_observability_api/types';
 import { ExperimentalBadge } from '../../components/shared/experimental_badge';
 import { useFetcher } from '../../hooks/use_fetcher';
 import { usePluginContext } from '../../hooks/use_plugin_context';

From e5f28054245285b523eede2f3b27ca108effc92e Mon Sep 17 00:00:00 2001
From: Madison Caldwell <madison.caldwell@elastic.co>
Date: Tue, 11 May 2021 14:28:34 -0400
Subject: [PATCH 35/54] Build api docs

---
 api_docs/apm.json               |    59 +-
 api_docs/core.json              |   870 +--
 api_docs/data.json              |     6 +-
 api_docs/data_search.json       |     6 +-
 api_docs/data_ui.json           |     2 +-
 api_docs/deprecations.mdx       |  2303 +-----
 api_docs/event_log.json         |    22 +-
 api_docs/fleet.json             |   130 +-
 api_docs/home.json              |     4 +-
 api_docs/kibana_react.json      |   236 +-
 api_docs/licensing.json         |    28 +
 api_docs/lists.json             |  2663 +------
 api_docs/ml.json                |    83 +-
 api_docs/monitoring.json        |     4 +-
 api_docs/observability.json     |   185 +-
 api_docs/observability.mdx      |     3 -
 api_docs/presentation_util.json |   129 +-
 api_docs/reporting.json         |     6 +-
 api_docs/rule_registry.json     |  1207 ++-
 api_docs/rule_registry.mdx      |    26 +-
 api_docs/security.json          |    14 +-
 api_docs/security_solution.json | 11926 +-----------------------------
 api_docs/spaces.json            |     4 +-
 api_docs/spaces_oss.json        |    16 +-
 24 files changed, 1921 insertions(+), 18011 deletions(-)

diff --git a/api_docs/apm.json b/api_docs/apm.json
index 611bf6f455ec5..347f63b2bdad0 100644
--- a/api_docs/apm.json
+++ b/api_docs/apm.json
@@ -74,11 +74,11 @@
       "label": "ApmPluginSetup",
       "description": [],
       "signature": [
-        "{ ruleRegistry: FormatterRuleRegistry<{ readonly 'kibana.rac.producer': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.uuid': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.id': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.start': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.end': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.duration.us': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.severity.level': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.severity.value': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.status': { readonly type: \"keyword\"; }; readonly '@timestamp': { readonly type: \"date\"; readonly array: false; readonly required: true; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'event.kind': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.action': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.uuid': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.category': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; } & { 'kibana.observability.evaluation.value': { type: \"scaled_float\"; scaling_factor: number; }; 'kibana.observability.evaluation.threshold': { type: \"scaled_float\"; scaling_factor: number; }; 'host.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; 'service.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; } & { readonly 'service.environment': { readonly type: \"keyword\"; }; readonly 'transaction.type': { readonly type: \"keyword\"; }; readonly 'processor.event': { readonly type: \"keyword\"; }; }>; }"
+        "{}"
       ],
       "source": {
         "path": "x-pack/plugins/apm/public/plugin.ts",
-        "lineNumber": 48
+        "lineNumber": 45
       },
       "deprecated": false,
       "lifecycle": "setup",
@@ -96,7 +96,7 @@
       ],
       "source": {
         "path": "x-pack/plugins/apm/public/plugin.ts",
-        "lineNumber": 51
+        "lineNumber": 47
       },
       "deprecated": false,
       "lifecycle": "start",
@@ -143,7 +143,7 @@
         ],
         "source": {
           "path": "x-pack/plugins/apm/server/plugin.ts",
-          "lineNumber": 50
+          "lineNumber": 55
         },
         "deprecated": false,
         "children": [
@@ -159,7 +159,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/apm/server/plugin.ts",
-              "lineNumber": 60
+              "lineNumber": 65
             },
             "deprecated": false,
             "children": [
@@ -182,7 +182,7 @@
                 ],
                 "source": {
                   "path": "x-pack/plugins/apm/server/plugin.ts",
-                  "lineNumber": 60
+                  "lineNumber": 65
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -210,14 +210,14 @@
               "APMPluginStartDependencies",
               ", unknown>, plugins: Pick<",
               "APMPluginSetupDependencies",
-              ", \"data\" | \"security\" | \"home\" | \"features\" | \"ml\" | \"actions\" | \"usageCollection\" | \"cloud\" | \"observability\" | \"apmOss\" | \"licensing\" | \"spaces\" | \"taskManager\" | \"alerting\">) => { config$: ",
+              ", \"data\" | \"security\" | \"home\" | \"features\" | \"ml\" | \"actions\" | \"usageCollection\" | \"apmOss\" | \"licensing\" | \"observability\" | \"ruleRegistry\" | \"spaces\" | \"cloud\" | \"taskManager\" | \"alerting\">) => { config$: ",
               "Observable",
               "<{ 'apm_oss.transactionIndices': string; 'apm_oss.spanIndices': string; 'apm_oss.errorIndices': string; 'apm_oss.metricsIndices': string; 'apm_oss.sourcemapIndices': string; 'apm_oss.onboardingIndices': string; 'apm_oss.indexPattern': string; 'xpack.apm.serviceMapEnabled': boolean; 'xpack.apm.serviceMapFingerprintBucketSize': number; 'xpack.apm.serviceMapTraceIdBucketSize': number; 'xpack.apm.serviceMapFingerprintGlobalBucketSize': number; 'xpack.apm.serviceMapTraceIdGlobalBucketSize': number; 'xpack.apm.serviceMapMaxTracesPerRequest': number; 'xpack.apm.ui.enabled': boolean; 'xpack.apm.maxServiceEnvironments': number; 'xpack.apm.maxServiceSelection': number; 'xpack.apm.ui.maxTraceItems': number; 'xpack.apm.ui.transactionGroupBucketSize': number; 'xpack.apm.autocreateApmIndexPattern': boolean; 'xpack.apm.telemetryCollectionEnabled': boolean; 'xpack.apm.searchAggregatedTransactions': ",
               "SearchAggregatedTransactionSetting"
             ],
             "source": {
               "path": "x-pack/plugins/apm/server/plugin.ts",
-              "lineNumber": 64
+              "lineNumber": 69
             },
             "deprecated": false,
             "children": [
@@ -242,7 +242,7 @@
                 ],
                 "source": {
                   "path": "x-pack/plugins/apm/server/plugin.ts",
-                  "lineNumber": 65
+                  "lineNumber": 70
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -257,11 +257,11 @@
                 "signature": [
                   "Pick<",
                   "APMPluginSetupDependencies",
-                  ", \"data\" | \"security\" | \"home\" | \"features\" | \"ml\" | \"actions\" | \"usageCollection\" | \"cloud\" | \"observability\" | \"apmOss\" | \"licensing\" | \"spaces\" | \"taskManager\" | \"alerting\">"
+                  ", \"data\" | \"security\" | \"home\" | \"features\" | \"ml\" | \"actions\" | \"usageCollection\" | \"apmOss\" | \"licensing\" | \"observability\" | \"ruleRegistry\" | \"spaces\" | \"cloud\" | \"taskManager\" | \"alerting\">"
                 ],
                 "source": {
                   "path": "x-pack/plugins/apm/server/plugin.ts",
-                  "lineNumber": 66
+                  "lineNumber": 71
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -289,7 +289,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/apm/server/plugin.ts",
-              "lineNumber": 200
+              "lineNumber": 269
             },
             "deprecated": false,
             "children": [
@@ -311,7 +311,7 @@
                 ],
                 "source": {
                   "path": "x-pack/plugins/apm/server/plugin.ts",
-                  "lineNumber": 200
+                  "lineNumber": 269
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -331,7 +331,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/apm/server/plugin.ts",
-              "lineNumber": 219
+              "lineNumber": 288
             },
             "deprecated": false,
             "children": [],
@@ -578,13 +578,13 @@
                 "section": "def-server.PluginStartContract",
                 "text": "PluginStartContract"
               },
-              ">; }; observability: { setup: { getScopedAnnotationsClient: (requestContext: ",
+              ">; }; apmOss: { setup: ",
               {
-                "pluginId": "core",
+                "pluginId": "apmOss",
                 "scope": "server",
-                "docId": "kibCorePluginApi",
-                "section": "def-server.RequestHandlerContext",
-                "text": "RequestHandlerContext"
+                "docId": "kibApmOssPluginApi",
+                "section": "def-server.APMOSSPluginSetup",
+                "text": "APMOSSPluginSetup"
               }
             ],
             "source": {
@@ -595,14 +595,19 @@
           },
           {
             "parentPluginId": "apm",
-            "id": "def-server.APMRouteHandlerResources.apmRuleRegistry",
+            "id": "def-server.APMRouteHandlerResources.ruleDataClient",
             "type": "Object",
             "tags": [],
-            "label": "apmRuleRegistry",
+            "label": "ruleDataClient",
             "description": [],
             "signature": [
-              "RuleRegistry",
-              "<{ readonly 'kibana.rac.producer': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.uuid': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.id': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.start': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.end': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.duration.us': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.severity.level': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.severity.value': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.status': { readonly type: \"keyword\"; }; readonly '@timestamp': { readonly type: \"date\"; readonly array: false; readonly required: true; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'event.kind': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.action': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.uuid': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.category': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; } & { 'kibana.observability.evaluation.value': { type: \"scaled_float\"; scaling_factor: number; }; 'kibana.observability.evaluation.threshold': { type: \"scaled_float\"; scaling_factor: number; }; 'host.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; 'service.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; } & { readonly 'service.environment': { readonly type: \"keyword\"; }; readonly 'transaction.type': { readonly type: \"keyword\"; }; readonly 'processor.event': { readonly type: \"keyword\"; }; }>"
+              {
+                "pluginId": "ruleRegistry",
+                "scope": "server",
+                "docId": "kibRuleRegistryPluginApi",
+                "section": "def-server.RuleDataClient",
+                "text": "RuleDataClient"
+              }
             ],
             "source": {
               "path": "x-pack/plugins/apm/server/routes/typings.ts",
@@ -719,7 +724,7 @@
       "description": [],
       "source": {
         "path": "x-pack/plugins/apm/server/types.ts",
-        "lineNumber": 47
+        "lineNumber": 51
       },
       "deprecated": false,
       "children": [
@@ -738,7 +743,7 @@
           ],
           "source": {
             "path": "x-pack/plugins/apm/server/types.ts",
-            "lineNumber": 48
+            "lineNumber": 52
           },
           "deprecated": false
         },
@@ -756,7 +761,7 @@
           ],
           "source": {
             "path": "x-pack/plugins/apm/server/types.ts",
-            "lineNumber": 49
+            "lineNumber": 53
           },
           "deprecated": false
         },
@@ -787,7 +792,7 @@
           ],
           "source": {
             "path": "x-pack/plugins/apm/server/types.ts",
-            "lineNumber": 50
+            "lineNumber": 54
           },
           "deprecated": false
         }
diff --git a/api_docs/core.json b/api_docs/core.json
index b32409a29ca52..10c205c445d1a 100644
--- a/api_docs/core.json
+++ b/api_docs/core.json
@@ -1711,7 +1711,7 @@
         "description": [],
         "source": {
           "path": "src/core/public/doc_links/doc_links_service.ts",
-          "lineNumber": 407
+          "lineNumber": 408
         },
         "deprecated": false,
         "children": [
@@ -1724,7 +1724,7 @@
             "description": [],
             "source": {
               "path": "src/core/public/doc_links/doc_links_service.ts",
-              "lineNumber": 408
+              "lineNumber": 409
             },
             "deprecated": false
           },
@@ -1737,7 +1737,7 @@
             "description": [],
             "source": {
               "path": "src/core/public/doc_links/doc_links_service.ts",
-              "lineNumber": 409
+              "lineNumber": 410
             },
             "deprecated": false
           },
@@ -1749,11 +1749,11 @@
             "label": "links",
             "description": [],
             "signature": [
-              "{ readonly canvas: { readonly guide: string; }; readonly dashboard: { readonly guide: string; readonly drilldowns: string; readonly drilldownsTriggerPicker: string; readonly urlDrilldownTemplateSyntax: string; readonly urlDrilldownVariables: string; }; readonly discover: Record<string, string>; readonly filebeat: { readonly base: string; readonly installation: string; readonly configuration: string; readonly elasticsearchOutput: string; readonly elasticsearchModule: string; readonly startup: string; readonly exportedFields: string; }; readonly auditbeat: { readonly base: string; }; readonly metricbeat: { readonly base: string; readonly configure: string; readonly httpEndpoint: string; readonly install: string; readonly start: string; }; readonly enterpriseSearch: { readonly base: string; readonly appSearchBase: string; readonly workplaceSearchBase: string; }; readonly heartbeat: { readonly base: string; }; readonly logstash: { readonly base: string; }; readonly functionbeat: { readonly base: string; }; readonly winlogbeat: { readonly base: string; }; readonly aggs: { readonly composite: string; readonly composite_missing_bucket: string; readonly date_histogram: string; readonly date_range: string; readonly date_format_pattern: string; readonly filter: string; readonly filters: string; readonly geohash_grid: string; readonly histogram: string; readonly ip_range: string; readonly range: string; readonly significant_terms: string; readonly terms: string; readonly avg: string; readonly avg_bucket: string; readonly max_bucket: string; readonly min_bucket: string; readonly sum_bucket: string; readonly cardinality: string; readonly count: string; readonly cumulative_sum: string; readonly derivative: string; readonly geo_bounds: string; readonly geo_centroid: string; readonly max: string; readonly median: string; readonly min: string; readonly moving_avg: string; readonly percentile_ranks: string; readonly serial_diff: string; readonly std_dev: string; readonly sum: string; readonly top_hits: string; }; readonly runtimeFields: { readonly overview: string; readonly mapping: string; }; readonly scriptedFields: { readonly scriptFields: string; readonly scriptAggs: string; readonly painless: string; readonly painlessApi: string; readonly painlessLangSpec: string; readonly painlessSyntax: string; readonly painlessWalkthrough: string; readonly luceneExpressions: string; }; readonly search: { readonly sessions: string; }; readonly indexPatterns: { readonly introduction: string; readonly fieldFormattersNumber: string; readonly fieldFormattersString: string; }; readonly addData: string; readonly kibana: string; readonly upgradeAssistant: string; readonly elasticsearch: Record<string, string>; readonly siem: { readonly guide: string; readonly gettingStarted: string; }; readonly query: { readonly eql: string; readonly kueryQuerySyntax: string; readonly luceneQuerySyntax: string; readonly percolate: string; readonly queryDsl: string; }; readonly date: { readonly dateMath: string; readonly dateMathIndexNames: string; }; readonly management: Record<string, string>; readonly ml: Record<string, string>; readonly transforms: Record<string, string>; readonly visualize: Record<string, string>; readonly apis: Readonly<{ bulkIndexAlias: string; byteSizeUnits: string; createAutoFollowPattern: string; createFollower: string; createIndex: string; createSnapshotLifecyclePolicy: string; createRoleMapping: string; createRoleMappingTemplates: string; createApiKey: string; createPipeline: string; createTransformRequest: string; cronExpressions: string; executeWatchActionModes: string; indexExists: string; openIndex: string; putComponentTemplate: string; painlessExecute: string; painlessExecuteAPIContexts: string; putComponentTemplateMetadata: string; putSnapshotLifecyclePolicy: string; putIndexTemplateV1: string; putWatch: string; simulatePipeline: string; timeUnits: string; updateTransform: string; }>; readonly observability: Record<string, string>; readonly alerting: Record<string, string>; readonly maps: Record<string, string>; readonly monitoring: Record<string, string>; readonly security: Readonly<{ apiKeyServiceSettings: string; clusterPrivileges: string; elasticsearchSettings: string; elasticsearchEnableSecurity: string; indicesPrivileges: string; kibanaTLS: string; kibanaPrivileges: string; mappingRoles: string; mappingRolesFieldRules: string; runAsPrivilege: string; }>; readonly watcher: Record<string, string>; readonly ccs: Record<string, string>; readonly plugins: Record<string, string>; readonly snapshotRestore: Record<string, string>; readonly ingest: Record<string, string>; }"
+              "{ readonly canvas: { readonly guide: string; }; readonly dashboard: { readonly guide: string; readonly drilldowns: string; readonly drilldownsTriggerPicker: string; readonly urlDrilldownTemplateSyntax: string; readonly urlDrilldownVariables: string; }; readonly discover: Record<string, string>; readonly filebeat: { readonly base: string; readonly installation: string; readonly configuration: string; readonly elasticsearchOutput: string; readonly elasticsearchModule: string; readonly startup: string; readonly exportedFields: string; }; readonly auditbeat: { readonly base: string; }; readonly metricbeat: { readonly base: string; readonly configure: string; readonly httpEndpoint: string; readonly install: string; readonly start: string; }; readonly enterpriseSearch: { readonly base: string; readonly appSearchBase: string; readonly workplaceSearchBase: string; }; readonly heartbeat: { readonly base: string; }; readonly logstash: { readonly base: string; }; readonly functionbeat: { readonly base: string; }; readonly winlogbeat: { readonly base: string; }; readonly aggs: { readonly composite: string; readonly composite_missing_bucket: string; readonly date_histogram: string; readonly date_range: string; readonly date_format_pattern: string; readonly filter: string; readonly filters: string; readonly geohash_grid: string; readonly histogram: string; readonly ip_range: string; readonly range: string; readonly significant_terms: string; readonly terms: string; readonly avg: string; readonly avg_bucket: string; readonly max_bucket: string; readonly min_bucket: string; readonly sum_bucket: string; readonly cardinality: string; readonly count: string; readonly cumulative_sum: string; readonly derivative: string; readonly geo_bounds: string; readonly geo_centroid: string; readonly max: string; readonly median: string; readonly min: string; readonly moving_avg: string; readonly percentile_ranks: string; readonly serial_diff: string; readonly std_dev: string; readonly sum: string; readonly top_hits: string; }; readonly runtimeFields: { readonly overview: string; readonly mapping: string; }; readonly scriptedFields: { readonly scriptFields: string; readonly scriptAggs: string; readonly painless: string; readonly painlessApi: string; readonly painlessLangSpec: string; readonly painlessSyntax: string; readonly painlessWalkthrough: string; readonly luceneExpressions: string; }; readonly search: { readonly sessions: string; }; readonly indexPatterns: { readonly introduction: string; readonly fieldFormattersNumber: string; readonly fieldFormattersString: string; }; readonly addData: string; readonly kibana: string; readonly upgradeAssistant: string; readonly elasticsearch: Record<string, string>; readonly siem: { readonly guide: string; readonly gettingStarted: string; }; readonly query: { readonly eql: string; readonly kueryQuerySyntax: string; readonly luceneQuerySyntax: string; readonly percolate: string; readonly queryDsl: string; }; readonly date: { readonly dateMath: string; readonly dateMathIndexNames: string; }; readonly management: Record<string, string>; readonly ml: Record<string, string>; readonly transforms: Record<string, string>; readonly visualize: Record<string, string>; readonly apis: Readonly<{ bulkIndexAlias: string; byteSizeUnits: string; createAutoFollowPattern: string; createFollower: string; createIndex: string; createSnapshotLifecyclePolicy: string; createRoleMapping: string; createRoleMappingTemplates: string; createRollupJobsRequest: string; createApiKey: string; createPipeline: string; createTransformRequest: string; cronExpressions: string; executeWatchActionModes: string; indexExists: string; openIndex: string; putComponentTemplate: string; painlessExecute: string; painlessExecuteAPIContexts: string; putComponentTemplateMetadata: string; putSnapshotLifecyclePolicy: string; putIndexTemplateV1: string; putWatch: string; simulatePipeline: string; timeUnits: string; updateTransform: string; }>; readonly observability: Record<string, string>; readonly alerting: Record<string, string>; readonly maps: Record<string, string>; readonly monitoring: Record<string, string>; readonly security: Readonly<{ apiKeyServiceSettings: string; clusterPrivileges: string; elasticsearchSettings: string; elasticsearchEnableSecurity: string; indicesPrivileges: string; kibanaTLS: string; kibanaPrivileges: string; mappingRoles: string; mappingRolesFieldRules: string; runAsPrivilege: string; }>; readonly watcher: Record<string, string>; readonly ccs: Record<string, string>; readonly plugins: Record<string, string>; readonly snapshotRestore: Record<string, string>; readonly ingest: Record<string, string>; }"
             ],
             "source": {
               "path": "src/core/public/doc_links/doc_links_service.ts",
-              "lineNumber": 410
+              "lineNumber": 411
             },
             "deprecated": false
           }
@@ -7250,9 +7250,10 @@
         ],
         "source": {
           "path": "src/core/server/elasticsearch/legacy/cluster_client.ts",
-          "lineNumber": 104
+          "lineNumber": 107
         },
         "deprecated": true,
+        "removeBy": "7.16",
         "references": [],
         "children": [
           {
@@ -7267,7 +7268,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/cluster_client.ts",
-              "lineNumber": 121
+              "lineNumber": 124
             },
             "deprecated": false,
             "children": [
@@ -7289,7 +7290,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/elasticsearch/legacy/cluster_client.ts",
-                  "lineNumber": 122
+                  "lineNumber": 125
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -7306,7 +7307,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/elasticsearch/legacy/cluster_client.ts",
-                  "lineNumber": 123
+                  "lineNumber": 126
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -7323,7 +7324,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/elasticsearch/legacy/cluster_client.ts",
-                  "lineNumber": 124
+                  "lineNumber": 127
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -7346,7 +7347,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/elasticsearch/legacy/cluster_client.ts",
-                  "lineNumber": 125
+                  "lineNumber": 128
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -7378,7 +7379,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/cluster_client.ts",
-              "lineNumber": 140
+              "lineNumber": 143
             },
             "deprecated": true,
             "references": [
@@ -7620,7 +7621,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/elasticsearch/legacy/cluster_client.ts",
-                  "lineNumber": 141
+                  "lineNumber": 144
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -7637,7 +7638,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/elasticsearch/legacy/cluster_client.ts",
-                  "lineNumber": 142
+                  "lineNumber": 145
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -7661,7 +7662,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/elasticsearch/legacy/cluster_client.ts",
-                  "lineNumber": 143
+                  "lineNumber": 146
                 },
                 "deprecated": false,
                 "isRequired": false
@@ -7683,7 +7684,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/cluster_client.ts",
-              "lineNumber": 158
+              "lineNumber": 161
             },
             "deprecated": false,
             "children": [],
@@ -7735,7 +7736,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/cluster_client.ts",
-              "lineNumber": 181
+              "lineNumber": 184
             },
             "deprecated": false,
             "children": [
@@ -7776,7 +7777,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/elasticsearch/legacy/cluster_client.ts",
-                  "lineNumber": 181
+                  "lineNumber": 184
                 },
                 "deprecated": false,
                 "isRequired": false
@@ -7798,7 +7799,7 @@
         ],
         "source": {
           "path": "src/core/server/elasticsearch/legacy/errors.ts",
-          "lineNumber": 69
+          "lineNumber": 70
         },
         "deprecated": false,
         "children": [
@@ -7822,7 +7823,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/errors.ts",
-              "lineNumber": 70
+              "lineNumber": 71
             },
             "deprecated": false,
             "children": [
@@ -7838,7 +7839,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/elasticsearch/legacy/errors.ts",
-                  "lineNumber": 70
+                  "lineNumber": 71
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -7866,7 +7867,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/errors.ts",
-              "lineNumber": 74
+              "lineNumber": 75
             },
             "deprecated": false,
             "children": [
@@ -7882,7 +7883,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/elasticsearch/legacy/errors.ts",
-                  "lineNumber": 74
+                  "lineNumber": 75
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -7899,7 +7900,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/elasticsearch/legacy/errors.ts",
-                  "lineNumber": 74
+                  "lineNumber": 75
                 },
                 "deprecated": false,
                 "isRequired": false
@@ -7941,9 +7942,10 @@
         ],
         "source": {
           "path": "src/core/server/elasticsearch/legacy/scoped_cluster_client.ts",
-          "lineNumber": 34
+          "lineNumber": 36
         },
         "deprecated": true,
+        "removeBy": "7.16",
         "references": [
           {
             "plugin": "indexManagement",
@@ -7987,7 +7989,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/scoped_cluster_client.ts",
-              "lineNumber": 35
+              "lineNumber": 37
             },
             "deprecated": false,
             "children": [
@@ -8009,7 +8011,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/elasticsearch/legacy/scoped_cluster_client.ts",
-                  "lineNumber": 36
+                  "lineNumber": 38
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -8032,7 +8034,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/elasticsearch/legacy/scoped_cluster_client.ts",
-                  "lineNumber": 37
+                  "lineNumber": 39
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -8056,7 +8058,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/elasticsearch/legacy/scoped_cluster_client.ts",
-                  "lineNumber": 38
+                  "lineNumber": 40
                 },
                 "deprecated": false,
                 "isRequired": false
@@ -8088,9 +8090,10 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/scoped_cluster_client.ts",
-              "lineNumber": 54
+              "lineNumber": 57
             },
             "deprecated": true,
+            "removeBy": "7.16",
             "references": [
               {
                 "plugin": "licensing",
@@ -8129,7 +8132,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/elasticsearch/legacy/scoped_cluster_client.ts",
-                  "lineNumber": 55
+                  "lineNumber": 58
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -8148,7 +8151,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/elasticsearch/legacy/scoped_cluster_client.ts",
-                  "lineNumber": 56
+                  "lineNumber": 59
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -8174,7 +8177,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/elasticsearch/legacy/scoped_cluster_client.ts",
-                  "lineNumber": 57
+                  "lineNumber": 60
                 },
                 "deprecated": false,
                 "isRequired": false
@@ -8206,9 +8209,10 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/scoped_cluster_client.ts",
-              "lineNumber": 72
+              "lineNumber": 76
             },
             "deprecated": true,
+            "removeBy": "7.16",
             "references": [
               {
                 "plugin": "licensing",
@@ -8273,27 +8277,6 @@
                   "lineNumber": 39
                 }
               },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/handlers.ts",
-                  "lineNumber": 114
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/handlers.ts",
-                  "lineNumber": 181
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/policy/service.ts",
-                  "lineNumber": 55
-                }
-              },
               {
                 "plugin": "lists",
                 "link": {
@@ -8763,314 +8746,6 @@
                   "lineNumber": 48
                 }
               },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata.test.ts",
-                  "lineNumber": 122
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata.test.ts",
-                  "lineNumber": 134
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata.test.ts",
-                  "lineNumber": 160
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata.test.ts",
-                  "lineNumber": 172
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata.test.ts",
-                  "lineNumber": 217
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata.test.ts",
-                  "lineNumber": 229
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata.test.ts",
-                  "lineNumber": 261
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata.test.ts",
-                  "lineNumber": 274
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata.test.ts",
-                  "lineNumber": 276
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata.test.ts",
-                  "lineNumber": 318
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata.test.ts",
-                  "lineNumber": 331
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata.test.ts",
-                  "lineNumber": 334
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata.test.ts",
-                  "lineNumber": 352
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata.test.ts",
-                  "lineNumber": 396
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata.test.ts",
-                  "lineNumber": 414
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata.test.ts",
-                  "lineNumber": 434
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata.test.ts",
-                  "lineNumber": 446
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata.test.ts",
-                  "lineNumber": 473
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata.test.ts",
-                  "lineNumber": 485
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata.test.ts",
-                  "lineNumber": 506
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata.test.ts",
-                  "lineNumber": 518
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata.test.ts",
-                  "lineNumber": 534
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata.test.ts",
-                  "lineNumber": 549
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata_v1.test.ts",
-                  "lineNumber": 113
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata_v1.test.ts",
-                  "lineNumber": 125
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata_v1.test.ts",
-                  "lineNumber": 154
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata_v1.test.ts",
-                  "lineNumber": 167
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata_v1.test.ts",
-                  "lineNumber": 169
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata_v1.test.ts",
-                  "lineNumber": 208
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata_v1.test.ts",
-                  "lineNumber": 221
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata_v1.test.ts",
-                  "lineNumber": 224
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata_v1.test.ts",
-                  "lineNumber": 243
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata_v1.test.ts",
-                  "lineNumber": 284
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata_v1.test.ts",
-                  "lineNumber": 302
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata_v1.test.ts",
-                  "lineNumber": 322
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata_v1.test.ts",
-                  "lineNumber": 334
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata_v1.test.ts",
-                  "lineNumber": 360
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata_v1.test.ts",
-                  "lineNumber": 372
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata_v1.test.ts",
-                  "lineNumber": 393
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata_v1.test.ts",
-                  "lineNumber": 405
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata_v1.test.ts",
-                  "lineNumber": 421
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata_v1.test.ts",
-                  "lineNumber": 436
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/policy/handlers.test.ts",
-                  "lineNumber": 55
-                }
-              },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/policy/handlers.test.ts",
-                  "lineNumber": 74
-                }
-              },
               {
                 "plugin": "securitySolution",
                 "link": {
@@ -9192,7 +8867,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/elasticsearch/legacy/scoped_cluster_client.ts",
-                  "lineNumber": 73
+                  "lineNumber": 77
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -9211,7 +8886,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/elasticsearch/legacy/scoped_cluster_client.ts",
-                  "lineNumber": 74
+                  "lineNumber": 78
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -9237,7 +8912,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/elasticsearch/legacy/scoped_cluster_client.ts",
-                  "lineNumber": 75
+                  "lineNumber": 79
                 },
                 "deprecated": false,
                 "isRequired": false
@@ -9364,9 +9039,10 @@
         "description": [],
         "source": {
           "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-          "lineNumber": 337
+          "lineNumber": 343
         },
         "deprecated": true,
+        "removeBy": "7.16",
         "references": [],
         "children": [
           {
@@ -9389,7 +9065,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 338
+              "lineNumber": 344
             },
             "deprecated": false
           }
@@ -9418,9 +9094,10 @@
         ],
         "source": {
           "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-          "lineNumber": 317
+          "lineNumber": 320
         },
         "deprecated": true,
+        "removeBy": "7.16",
         "references": [],
         "children": [
           {
@@ -9435,7 +9112,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 318
+              "lineNumber": 321
             },
             "deprecated": false
           },
@@ -9451,7 +9128,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 319
+              "lineNumber": 322
             },
             "deprecated": false
           }
@@ -10002,7 +9679,7 @@
         ],
         "source": {
           "path": "node_modules/@kbn/config/target/deprecation/types.d.ts",
-          "lineNumber": 67
+          "lineNumber": 87
         },
         "deprecated": false,
         "children": [
@@ -10023,7 +9700,7 @@
             ],
             "source": {
               "path": "node_modules/@kbn/config/target/deprecation/types.d.ts",
-              "lineNumber": 80
+              "lineNumber": 100
             },
             "deprecated": false,
             "children": [
@@ -10039,7 +9716,7 @@
                 ],
                 "source": {
                   "path": "node_modules/@kbn/config/target/deprecation/types.d.ts",
-                  "lineNumber": 80
+                  "lineNumber": 100
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -10056,7 +9733,7 @@
                 ],
                 "source": {
                   "path": "node_modules/@kbn/config/target/deprecation/types.d.ts",
-                  "lineNumber": 80
+                  "lineNumber": 100
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -10075,7 +9752,7 @@
                 ],
                 "source": {
                   "path": "node_modules/@kbn/config/target/deprecation/types.d.ts",
-                  "lineNumber": 80
+                  "lineNumber": 100
                 },
                 "deprecated": false,
                 "isRequired": false
@@ -10100,7 +9777,7 @@
             ],
             "source": {
               "path": "node_modules/@kbn/config/target/deprecation/types.d.ts",
-              "lineNumber": 96
+              "lineNumber": 116
             },
             "deprecated": false,
             "children": [
@@ -10116,7 +9793,7 @@
                 ],
                 "source": {
                   "path": "node_modules/@kbn/config/target/deprecation/types.d.ts",
-                  "lineNumber": 96
+                  "lineNumber": 116
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -10133,7 +9810,7 @@
                 ],
                 "source": {
                   "path": "node_modules/@kbn/config/target/deprecation/types.d.ts",
-                  "lineNumber": 96
+                  "lineNumber": 116
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -10152,7 +9829,7 @@
                 ],
                 "source": {
                   "path": "node_modules/@kbn/config/target/deprecation/types.d.ts",
-                  "lineNumber": 96
+                  "lineNumber": 116
                 },
                 "deprecated": false,
                 "isRequired": false
@@ -10177,7 +9854,7 @@
             ],
             "source": {
               "path": "node_modules/@kbn/config/target/deprecation/types.d.ts",
-              "lineNumber": 109
+              "lineNumber": 129
             },
             "deprecated": false,
             "children": [
@@ -10193,7 +9870,7 @@
                 ],
                 "source": {
                   "path": "node_modules/@kbn/config/target/deprecation/types.d.ts",
-                  "lineNumber": 109
+                  "lineNumber": 129
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -10212,7 +9889,7 @@
                 ],
                 "source": {
                   "path": "node_modules/@kbn/config/target/deprecation/types.d.ts",
-                  "lineNumber": 109
+                  "lineNumber": 129
                 },
                 "deprecated": false,
                 "isRequired": false
@@ -10237,7 +9914,7 @@
             ],
             "source": {
               "path": "node_modules/@kbn/config/target/deprecation/types.d.ts",
-              "lineNumber": 125
+              "lineNumber": 145
             },
             "deprecated": false,
             "children": [
@@ -10253,7 +9930,7 @@
                 ],
                 "source": {
                   "path": "node_modules/@kbn/config/target/deprecation/types.d.ts",
-                  "lineNumber": 125
+                  "lineNumber": 145
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -10272,7 +9949,7 @@
                 ],
                 "source": {
                   "path": "node_modules/@kbn/config/target/deprecation/types.d.ts",
-                  "lineNumber": 125
+                  "lineNumber": 145
                 },
                 "deprecated": false,
                 "isRequired": false
@@ -11085,9 +10762,10 @@
         ],
         "source": {
           "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-          "lineNumber": 349
+          "lineNumber": 356
         },
         "deprecated": true,
+        "removeBy": "7.16",
         "references": [],
         "children": [
           {
@@ -11102,7 +10780,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 350
+              "lineNumber": 357
             },
             "deprecated": false
           },
@@ -11118,7 +10796,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 351
+              "lineNumber": 358
             },
             "deprecated": false
           }
@@ -11136,9 +10814,10 @@
         "description": [],
         "source": {
           "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-          "lineNumber": 377
+          "lineNumber": 387
         },
         "deprecated": true,
+        "removeBy": "7.16",
         "references": [],
         "children": [
           {
@@ -11160,7 +10839,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 378
+              "lineNumber": 388
             },
             "deprecated": false
           },
@@ -11183,7 +10862,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 379
+              "lineNumber": 389
             },
             "deprecated": false
           },
@@ -11206,7 +10885,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 380
+              "lineNumber": 390
             },
             "deprecated": false
           },
@@ -11228,7 +10907,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 381
+              "lineNumber": 391
             },
             "deprecated": false
           }
@@ -11246,9 +10925,10 @@
         "description": [],
         "source": {
           "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-          "lineNumber": 358
+          "lineNumber": 366
         },
         "deprecated": true,
+        "removeBy": "7.16",
         "references": [],
         "children": [
           {
@@ -11269,7 +10949,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 359
+              "lineNumber": 367
             },
             "deprecated": false
           },
@@ -11282,7 +10962,7 @@
             "description": [],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 360
+              "lineNumber": 368
             },
             "deprecated": false
           },
@@ -11295,7 +10975,7 @@
             "description": [],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 361
+              "lineNumber": 369
             },
             "deprecated": false
           },
@@ -11311,7 +10991,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 362
+              "lineNumber": 370
             },
             "deprecated": false
           }
@@ -11700,7 +11380,7 @@
         "description": [],
         "source": {
           "path": "src/core/server/elasticsearch/types.ts",
-          "lineNumber": 87
+          "lineNumber": 89
         },
         "deprecated": false,
         "children": [
@@ -11724,7 +11404,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/types.ts",
-              "lineNumber": 96
+              "lineNumber": 98
             },
             "deprecated": false
           },
@@ -11757,7 +11437,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/types.ts",
-              "lineNumber": 114
+              "lineNumber": 116
             },
             "deprecated": false
           },
@@ -11808,7 +11488,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/types.ts",
-              "lineNumber": 124
+              "lineNumber": 126
             },
             "deprecated": true,
             "references": [
@@ -11917,7 +11597,7 @@
         "description": [],
         "source": {
           "path": "src/core/server/elasticsearch/types.ts",
-          "lineNumber": 171
+          "lineNumber": 179
         },
         "deprecated": false,
         "children": [
@@ -11933,7 +11613,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/types.ts",
-              "lineNumber": 172
+              "lineNumber": 180
             },
             "deprecated": false
           },
@@ -11949,7 +11629,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/types.ts",
-              "lineNumber": 173
+              "lineNumber": 181
             },
             "deprecated": false
           }
@@ -12028,7 +11708,7 @@
         ],
         "source": {
           "path": "src/core/server/elasticsearch/types.ts",
-          "lineNumber": 180
+          "lineNumber": 188
         },
         "deprecated": false,
         "children": [
@@ -12052,7 +11732,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/types.ts",
-              "lineNumber": 182
+              "lineNumber": 190
             },
             "deprecated": false
           }
@@ -13199,9 +12879,10 @@
         "description": [],
         "source": {
           "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-          "lineNumber": 369
+          "lineNumber": 378
         },
         "deprecated": true,
+        "removeBy": "7.16",
         "references": [],
         "children": [
           {
@@ -13216,7 +12897,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 370
+              "lineNumber": 379
             },
             "deprecated": false
           }
@@ -13334,7 +13015,7 @@
         ],
         "source": {
           "path": "src/core/server/ui_settings/types.ts",
-          "lineNumber": 31
+          "lineNumber": 30
         },
         "deprecated": false,
         "children": [
@@ -13354,7 +13035,7 @@
             ],
             "source": {
               "path": "src/core/server/ui_settings/types.ts",
-              "lineNumber": 35
+              "lineNumber": 34
             },
             "deprecated": false
           },
@@ -13372,7 +13053,7 @@
             ],
             "source": {
               "path": "src/core/server/ui_settings/types.ts",
-              "lineNumber": 39
+              "lineNumber": 38
             },
             "deprecated": false
           },
@@ -13390,7 +13071,7 @@
             ],
             "source": {
               "path": "src/core/server/ui_settings/types.ts",
-              "lineNumber": 43
+              "lineNumber": 42
             },
             "deprecated": false
           },
@@ -13410,7 +13091,7 @@
             ],
             "source": {
               "path": "src/core/server/ui_settings/types.ts",
-              "lineNumber": 47
+              "lineNumber": 46
             },
             "deprecated": false
           },
@@ -13428,7 +13109,7 @@
             ],
             "source": {
               "path": "src/core/server/ui_settings/types.ts",
-              "lineNumber": 51
+              "lineNumber": 50
             },
             "deprecated": false
           },
@@ -13446,7 +13127,7 @@
             ],
             "source": {
               "path": "src/core/server/ui_settings/types.ts",
-              "lineNumber": 55
+              "lineNumber": 54
             },
             "deprecated": false
           },
@@ -13464,7 +13145,7 @@
             ],
             "source": {
               "path": "src/core/server/ui_settings/types.ts",
-              "lineNumber": 59
+              "lineNumber": 58
             },
             "deprecated": false
           },
@@ -13482,7 +13163,7 @@
             ],
             "source": {
               "path": "src/core/server/ui_settings/types.ts",
-              "lineNumber": 63
+              "lineNumber": 62
             },
             "deprecated": false
           },
@@ -13500,7 +13181,7 @@
             ],
             "source": {
               "path": "src/core/server/ui_settings/types.ts",
-              "lineNumber": 67
+              "lineNumber": 66
             },
             "deprecated": false
           },
@@ -13518,7 +13199,7 @@
             ],
             "source": {
               "path": "src/core/server/ui_settings/types.ts",
-              "lineNumber": 71
+              "lineNumber": 70
             },
             "deprecated": false
           }
@@ -13536,50 +13217,51 @@
         "description": [],
         "source": {
           "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-          "lineNumber": 162
+          "lineNumber": 164
         },
         "deprecated": true,
+        "removeBy": "7.16",
         "references": [
           {
-            "plugin": "lists",
+            "plugin": "securitySolution",
             "link": {
-              "path": "x-pack/plugins/lists/common/get_call_cluster.mock.ts",
-              "lineNumber": 9
+              "path": "x-pack/plugins/security_solution/server/lib/telemetry/sender.ts",
+              "lineNumber": 10
             }
           },
           {
-            "plugin": "lists",
+            "plugin": "securitySolution",
             "link": {
-              "path": "x-pack/plugins/lists/common/get_call_cluster.mock.ts",
-              "lineNumber": 26
+              "path": "x-pack/plugins/security_solution/server/lib/telemetry/sender.ts",
+              "lineNumber": 447
             }
           },
           {
-            "plugin": "lists",
+            "plugin": "securitySolution",
             "link": {
-              "path": "x-pack/plugins/lists/common/get_call_cluster.mock.ts",
-              "lineNumber": 30
+              "path": "x-pack/plugins/security_solution/server/lib/telemetry/sender.ts",
+              "lineNumber": 466
             }
           },
           {
-            "plugin": "securitySolution",
+            "plugin": "lists",
             "link": {
-              "path": "x-pack/plugins/security_solution/server/lib/telemetry/sender.ts",
-              "lineNumber": 10
+              "path": "x-pack/plugins/lists/server/schemas/common/get_call_cluster.mock.ts",
+              "lineNumber": 9
             }
           },
           {
-            "plugin": "securitySolution",
+            "plugin": "lists",
             "link": {
-              "path": "x-pack/plugins/security_solution/server/lib/telemetry/sender.ts",
-              "lineNumber": 447
+              "path": "x-pack/plugins/lists/server/schemas/common/get_call_cluster.mock.ts",
+              "lineNumber": 27
             }
           },
           {
-            "plugin": "securitySolution",
+            "plugin": "lists",
             "link": {
-              "path": "x-pack/plugins/security_solution/server/lib/telemetry/sender.ts",
-              "lineNumber": 466
+              "path": "x-pack/plugins/lists/server/schemas/common/get_call_cluster.mock.ts",
+              "lineNumber": 31
             }
           },
           {
@@ -14130,38 +13812,6 @@
           }
         ],
         "children": [
-          {
-            "parentPluginId": "core",
-            "id": "def-server.LegacyAPICaller.Unnamed",
-            "type": "Any",
-            "tags": [],
-            "label": "Unnamed",
-            "description": [],
-            "signature": [
-              "any"
-            ],
-            "source": {
-              "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 164
-            },
-            "deprecated": false
-          },
-          {
-            "parentPluginId": "core",
-            "id": "def-server.LegacyAPICaller.Unnamed",
-            "type": "Any",
-            "tags": [],
-            "label": "Unnamed",
-            "description": [],
-            "signature": [
-              "any"
-            ],
-            "source": {
-              "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 165
-            },
-            "deprecated": false
-          },
           {
             "parentPluginId": "core",
             "id": "def-server.LegacyAPICaller.Unnamed",
@@ -14318,7 +13968,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 176
+              "lineNumber": 175
             },
             "deprecated": false
           },
@@ -14334,7 +13984,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 177
+              "lineNumber": 176
             },
             "deprecated": false
           },
@@ -14382,7 +14032,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 181
+              "lineNumber": 180
             },
             "deprecated": false
           },
@@ -14398,7 +14048,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 182
+              "lineNumber": 181
             },
             "deprecated": false
           },
@@ -14414,7 +14064,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 184
+              "lineNumber": 183
             },
             "deprecated": false
           },
@@ -14430,7 +14080,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 185
+              "lineNumber": 184
             },
             "deprecated": false
           },
@@ -14574,7 +14224,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 195
+              "lineNumber": 194
             },
             "deprecated": false
           },
@@ -14590,7 +14240,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 196
+              "lineNumber": 195
             },
             "deprecated": false
           },
@@ -14702,7 +14352,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 205
+              "lineNumber": 203
             },
             "deprecated": false
           },
@@ -14718,7 +14368,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 206
+              "lineNumber": 204
             },
             "deprecated": false
           },
@@ -15006,7 +14656,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 226
+              "lineNumber": 224
             },
             "deprecated": false
           },
@@ -15022,7 +14672,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 227
+              "lineNumber": 225
             },
             "deprecated": false
           },
@@ -15134,7 +14784,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 236
+              "lineNumber": 234
             },
             "deprecated": false
           },
@@ -15150,7 +14800,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 237
+              "lineNumber": 235
             },
             "deprecated": false
           },
@@ -15710,7 +15360,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 274
+              "lineNumber": 272
             },
             "deprecated": false
           },
@@ -15726,7 +15376,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 275
+              "lineNumber": 273
             },
             "deprecated": false
           },
@@ -15774,7 +15424,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 280
+              "lineNumber": 278
             },
             "deprecated": false
           },
@@ -15790,7 +15440,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 281
+              "lineNumber": 279
             },
             "deprecated": false
           },
@@ -15822,7 +15472,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 285
+              "lineNumber": 283
             },
             "deprecated": false
           },
@@ -15838,7 +15488,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 286
+              "lineNumber": 284
             },
             "deprecated": false
           },
@@ -15966,7 +15616,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 296
+              "lineNumber": 294
             },
             "deprecated": false
           },
@@ -15982,7 +15632,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 297
+              "lineNumber": 295
             },
             "deprecated": false
           },
@@ -16014,7 +15664,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 301
+              "lineNumber": 299
             },
             "deprecated": false
           },
@@ -16030,7 +15680,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 304
+              "lineNumber": 300
             },
             "deprecated": false
           },
@@ -16046,7 +15696,39 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 309
+              "lineNumber": 303
+            },
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "core",
+            "id": "def-server.LegacyAPICaller.Unnamed",
+            "type": "Any",
+            "tags": [],
+            "label": "Unnamed",
+            "description": [],
+            "signature": [
+              "any"
+            ],
+            "source": {
+              "path": "src/core/server/elasticsearch/legacy/api_types.ts",
+              "lineNumber": 306
+            },
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "core",
+            "id": "def-server.LegacyAPICaller.Unnamed",
+            "type": "Any",
+            "tags": [],
+            "label": "Unnamed",
+            "description": [],
+            "signature": [
+              "any"
+            ],
+            "source": {
+              "path": "src/core/server/elasticsearch/legacy/api_types.ts",
+              "lineNumber": 311
             },
             "deprecated": false
           }
@@ -16066,9 +15748,10 @@
         ],
         "source": {
           "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-          "lineNumber": 144
+          "lineNumber": 145
         },
         "deprecated": true,
+        "removeBy": "7.16",
         "references": [
           {
             "plugin": "securitySolution",
@@ -16100,7 +15783,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 151
+              "lineNumber": 152
             },
             "deprecated": false
           },
@@ -16118,7 +15801,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-              "lineNumber": 155
+              "lineNumber": 156
             },
             "deprecated": false
           }
@@ -16148,9 +15831,10 @@
         ],
         "source": {
           "path": "src/core/server/elasticsearch/legacy/errors.ts",
-          "lineNumber": 22
+          "lineNumber": 23
         },
         "deprecated": true,
+        "removeBy": "7.16",
         "references": [],
         "children": [
           {
@@ -16165,7 +15849,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/legacy/errors.ts",
-              "lineNumber": 23
+              "lineNumber": 24
             },
             "deprecated": false
           }
@@ -19616,7 +19300,7 @@
         "description": [],
         "source": {
           "path": "src/core/server/ui_settings/types.ts",
-          "lineNumber": 84
+          "lineNumber": 83
         },
         "deprecated": false,
         "children": [
@@ -19636,7 +19320,7 @@
             ],
             "source": {
               "path": "src/core/server/ui_settings/types.ts",
-              "lineNumber": 102
+              "lineNumber": 101
             },
             "deprecated": false,
             "children": [
@@ -19654,7 +19338,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/ui_settings/types.ts",
-                  "lineNumber": 102
+                  "lineNumber": 101
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -19674,7 +19358,7 @@
         "description": [],
         "source": {
           "path": "src/core/server/ui_settings/types.ts",
-          "lineNumber": 106
+          "lineNumber": 105
         },
         "deprecated": false,
         "children": [
@@ -19707,7 +19391,7 @@
             ],
             "source": {
               "path": "src/core/server/ui_settings/types.ts",
-              "lineNumber": 121
+              "lineNumber": 120
             },
             "deprecated": false,
             "children": [
@@ -19731,7 +19415,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/ui_settings/types.ts",
-                  "lineNumber": 121
+                  "lineNumber": 120
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -19815,7 +19499,7 @@
         ],
         "source": {
           "path": "node_modules/@kbn/config/target/deprecation/types.d.ts",
-          "lineNumber": 6
+          "lineNumber": 7
         },
         "deprecated": false,
         "initialIsOpen": false
@@ -19918,27 +19602,6 @@
         "deprecated": false,
         "initialIsOpen": false
       },
-      {
-        "parentPluginId": "core",
-        "id": "def-server.ConfigDeprecation",
-        "type": "Type",
-        "tags": [],
-        "label": "ConfigDeprecation",
-        "description": [
-          "\nConfiguration deprecation returned from {@link ConfigDeprecationProvider} that handles a single deprecation from the configuration.\n"
-        ],
-        "signature": [
-          "(config: Record<string, any>, fromPath: string, addDeprecation: ",
-          "AddConfigDeprecation",
-          ") => Record<string, any>"
-        ],
-        "source": {
-          "path": "node_modules/@kbn/config/target/deprecation/types.d.ts",
-          "lineNumber": 33
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
       {
         "parentPluginId": "core",
         "id": "def-server.ConfigDeprecationProvider",
@@ -19957,7 +19620,7 @@
         ],
         "source": {
           "path": "node_modules/@kbn/config/target/deprecation/types.d.ts",
-          "lineNumber": 50
+          "lineNumber": 70
         },
         "deprecated": false,
         "initialIsOpen": false
@@ -20006,7 +19669,7 @@
         "label": "EcsEventCategory",
         "description": [],
         "signature": [
-          "\"host\" | \"authentication\" | \"database\" | \"package\" | \"session\" | \"network\" | \"file\" | \"process\" | \"registry\" | \"web\" | \"configuration\" | \"driver\" | \"iam\" | \"intrusion_detection\" | \"malware\""
+          "\"host\" | \"authentication\" | \"database\" | \"package\" | \"session\" | \"registry\" | \"network\" | \"web\" | \"file\" | \"process\" | \"configuration\" | \"driver\" | \"iam\" | \"intrusion_detection\" | \"malware\""
         ],
         "source": {
           "path": "node_modules/@kbn/logging/target/ecs/event.d.ts",
@@ -20314,9 +19977,10 @@
         ],
         "source": {
           "path": "src/core/server/elasticsearch/legacy/cluster_client.ts",
-          "lineNumber": 83
+          "lineNumber": 84
         },
         "deprecated": true,
+        "removeBy": "7.16",
         "references": [
           {
             "plugin": "licensing",
@@ -20367,48 +20031,6 @@
               "lineNumber": 180
             }
           },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata.test.ts",
-              "lineNumber": 9
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata.test.ts",
-              "lineNumber": 57
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata.test.ts",
-              "lineNumber": 80
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata_v1.test.ts",
-              "lineNumber": 9
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata_v1.test.ts",
-              "lineNumber": 52
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata_v1.test.ts",
-              "lineNumber": 74
-            }
-          },
           {
             "plugin": "beatsManagement",
             "link": {
@@ -20613,9 +20235,10 @@
         ],
         "source": {
           "path": "src/core/server/elasticsearch/legacy/cluster_client.ts",
-          "lineNumber": 94
+          "lineNumber": 96
         },
         "deprecated": true,
+        "removeBy": "7.16",
         "references": [
           {
             "plugin": "indexManagement",
@@ -20729,20 +20352,6 @@
               "lineNumber": 279
             }
           },
-          {
-            "plugin": "rollup",
-            "link": {
-              "path": "x-pack/plugins/rollup/server/plugin.ts",
-              "lineNumber": 12
-            }
-          },
-          {
-            "plugin": "rollup",
-            "link": {
-              "path": "x-pack/plugins/rollup/server/plugin.ts",
-              "lineNumber": 36
-            }
-          },
           {
             "plugin": "monitoring",
             "link": {
@@ -20839,9 +20448,10 @@
         ],
         "source": {
           "path": "src/core/server/elasticsearch/legacy/scoped_cluster_client.ts",
-          "lineNumber": 24
+          "lineNumber": 25
         },
         "deprecated": true,
+        "removeBy": "7.16",
         "references": [
           {
             "plugin": "licensing",
@@ -20885,76 +20495,6 @@
               "lineNumber": 115
             }
           },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/endpoint/routes/policy/service.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/endpoint/routes/policy/service.ts",
-              "lineNumber": 52
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/endpoint/mocks.ts",
-              "lineNumber": 8
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/endpoint/mocks.ts",
-              "lineNumber": 135
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata.test.ts",
-              "lineNumber": 10
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata.test.ts",
-              "lineNumber": 58
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata_v1.test.ts",
-              "lineNumber": 10
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata_v1.test.ts",
-              "lineNumber": 53
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/endpoint/routes/policy/handlers.test.ts",
-              "lineNumber": 16
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/endpoint/routes/policy/handlers.test.ts",
-              "lineNumber": 36
-            }
-          },
           {
             "plugin": "indexManagement",
             "link": {
@@ -21202,9 +20742,10 @@
         ],
         "source": {
           "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-          "lineNumber": 326
+          "lineNumber": 330
         },
         "deprecated": true,
+        "removeBy": "7.16",
         "references": [],
         "initialIsOpen": false
       },
@@ -21222,9 +20763,10 @@
         ],
         "source": {
           "path": "src/core/server/elasticsearch/legacy/api_types.ts",
-          "lineNumber": 331
+          "lineNumber": 336
         },
         "deprecated": true,
+        "removeBy": "7.16",
         "references": [],
         "initialIsOpen": false
       },
@@ -21424,7 +20966,7 @@
         ],
         "source": {
           "path": "src/core/server/elasticsearch/types.ts",
-          "lineNumber": 192
+          "lineNumber": 200
         },
         "deprecated": false,
         "initialIsOpen": false
diff --git a/api_docs/data.json b/api_docs/data.json
index 838f956520ff8..4a794bce5581a 100644
--- a/api_docs/data.json
+++ b/api_docs/data.json
@@ -7616,7 +7616,7 @@
             ],
             "source": {
               "path": "src/plugins/data/common/search/search_source/search_source.ts",
-              "lineNumber": 826
+              "lineNumber": 831
             },
             "deprecated": false,
             "children": [
@@ -7632,7 +7632,7 @@
                 ],
                 "source": {
                   "path": "src/plugins/data/common/search/search_source/search_source.ts",
-                  "lineNumber": 826
+                  "lineNumber": 831
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -7656,7 +7656,7 @@
             ],
             "source": {
               "path": "src/plugins/data/common/search/search_source/search_source.ts",
-              "lineNumber": 855
+              "lineNumber": 860
             },
             "deprecated": false,
             "children": [],
diff --git a/api_docs/data_search.json b/api_docs/data_search.json
index 04f1aa5265a54..da5701b50ed0f 100644
--- a/api_docs/data_search.json
+++ b/api_docs/data_search.json
@@ -8271,7 +8271,7 @@
             ],
             "source": {
               "path": "src/plugins/data/common/search/search_source/search_source.ts",
-              "lineNumber": 826
+              "lineNumber": 831
             },
             "deprecated": false,
             "children": [
@@ -8287,7 +8287,7 @@
                 ],
                 "source": {
                   "path": "src/plugins/data/common/search/search_source/search_source.ts",
-                  "lineNumber": 826
+                  "lineNumber": 831
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -8311,7 +8311,7 @@
             ],
             "source": {
               "path": "src/plugins/data/common/search/search_source/search_source.ts",
-              "lineNumber": 855
+              "lineNumber": 860
             },
             "deprecated": false,
             "children": [],
diff --git a/api_docs/data_ui.json b/api_docs/data_ui.json
index 63b9a1e1a1001..628bdd866c4ff 100644
--- a/api_docs/data_ui.json
+++ b/api_docs/data_ui.json
@@ -568,7 +568,7 @@
         ],
         "source": {
           "path": "src/plugins/data/public/ui/search_bar/search_bar.tsx",
-          "lineNumber": 80
+          "lineNumber": 79
         },
         "deprecated": false,
         "initialIsOpen": false
diff --git a/api_docs/deprecations.mdx b/api_docs/deprecations.mdx
index 7c1c48d61be23..76cbb0728b2a3 100644
--- a/api_docs/deprecations.mdx
+++ b/api_docs/deprecations.mdx
@@ -35,8 +35,8 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 
 | Deprecated API | Reference location | Remove By |
 | ---------------|-----------|-----------|
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [kibana_database_adapter.ts#L8](https://github.com/elastic/kibana/tree/master/x-pack/plugins/beats_management/server/lib/adapters/database/kibana_database_adapter.ts#L8) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [kibana_database_adapter.ts#L28](https://github.com/elastic/kibana/tree/master/x-pack/plugins/beats_management/server/lib/adapters/database/kibana_database_adapter.ts#L28) | - |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [kibana_database_adapter.ts#L8](https://github.com/elastic/kibana/tree/master/x-pack/plugins/beats_management/server/lib/adapters/database/kibana_database_adapter.ts#L8) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [kibana_database_adapter.ts#L28](https://github.com/elastic/kibana/tree/master/x-pack/plugins/beats_management/server/lib/adapters/database/kibana_database_adapter.ts#L28) | 7.16 |
 
 
 
@@ -69,10 +69,10 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 | <DocLink id="kibExpressionsPluginApi" section="def-common.Render" text="Render"/> | [table.ts#L25](https://github.com/elastic/kibana/tree/master/x-pack/plugins/canvas/canvas_plugin_src/functions/common/table.ts#L25) | - |
 | <DocLink id="kibExpressionsPluginApi" section="def-common.Render" text="Render"/> | [markdown.d.ts#L1](https://github.com/elastic/kibana/tree/master/x-pack/plugins/canvas/target/types/canvas_plugin_src/functions/browser/markdown.d.ts#L1) | - |
 | <DocLink id="kibExpressionsPluginApi" section="def-common.Render" text="Render"/> | [markdown.d.ts#L13](https://github.com/elastic/kibana/tree/master/x-pack/plugins/canvas/target/types/canvas_plugin_src/functions/browser/markdown.d.ts#L13) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [query_es_sql.ts#L12](https://github.com/elastic/kibana/tree/master/x-pack/plugins/canvas/server/lib/query_es_sql.ts#L12) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [query_es_sql.ts#L37](https://github.com/elastic/kibana/tree/master/x-pack/plugins/canvas/server/lib/query_es_sql.ts#L37) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [functions.ts#L8](https://github.com/elastic/kibana/tree/master/x-pack/plugins/canvas/server/routes/functions/functions.ts#L8) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [functions.ts#L40](https://github.com/elastic/kibana/tree/master/x-pack/plugins/canvas/server/routes/functions/functions.ts#L40) | - |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [query_es_sql.ts#L12](https://github.com/elastic/kibana/tree/master/x-pack/plugins/canvas/server/lib/query_es_sql.ts#L12) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [query_es_sql.ts#L37](https://github.com/elastic/kibana/tree/master/x-pack/plugins/canvas/server/lib/query_es_sql.ts#L37) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [functions.ts#L8](https://github.com/elastic/kibana/tree/master/x-pack/plugins/canvas/server/routes/functions/functions.ts#L8) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [functions.ts#L40](https://github.com/elastic/kibana/tree/master/x-pack/plugins/canvas/server/routes/functions/functions.ts#L40) | 7.16 |
 
 
 
@@ -80,14 +80,14 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 
 | Deprecated API | Reference location | Remove By |
 | ---------------|-----------|-----------|
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [plugin.ts#L13](https://github.com/elastic/kibana/tree/master/x-pack/plugins/cross_cluster_replication/server/plugin.ts#L13) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [plugin.ts#L69](https://github.com/elastic/kibana/tree/master/x-pack/plugins/cross_cluster_replication/server/plugin.ts#L69) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [types.ts#L8](https://github.com/elastic/kibana/tree/master/x-pack/plugins/cross_cluster_replication/server/types.ts#L8) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [types.ts#L41](https://github.com/elastic/kibana/tree/master/x-pack/plugins/cross_cluster_replication/server/types.ts#L41) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [types.d.ts#L1](https://github.com/elastic/kibana/tree/master/x-pack/plugins/cross_cluster_replication/target/types/server/types.d.ts#L1) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [types.d.ts#L30](https://github.com/elastic/kibana/tree/master/x-pack/plugins/cross_cluster_replication/target/types/server/types.d.ts#L30) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [plugin.ts#L17](https://github.com/elastic/kibana/tree/master/x-pack/plugins/cross_cluster_replication/server/plugin.ts#L17) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [plugin.ts#L36](https://github.com/elastic/kibana/tree/master/x-pack/plugins/cross_cluster_replication/server/plugin.ts#L36) | - |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [plugin.ts#L13](https://github.com/elastic/kibana/tree/master/x-pack/plugins/cross_cluster_replication/server/plugin.ts#L13) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [plugin.ts#L69](https://github.com/elastic/kibana/tree/master/x-pack/plugins/cross_cluster_replication/server/plugin.ts#L69) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [types.ts#L8](https://github.com/elastic/kibana/tree/master/x-pack/plugins/cross_cluster_replication/server/types.ts#L8) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [types.ts#L41](https://github.com/elastic/kibana/tree/master/x-pack/plugins/cross_cluster_replication/server/types.ts#L41) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [types.d.ts#L1](https://github.com/elastic/kibana/tree/master/x-pack/plugins/cross_cluster_replication/target/types/server/types.d.ts#L1) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [types.d.ts#L30](https://github.com/elastic/kibana/tree/master/x-pack/plugins/cross_cluster_replication/target/types/server/types.d.ts#L30) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [plugin.ts#L17](https://github.com/elastic/kibana/tree/master/x-pack/plugins/cross_cluster_replication/server/plugin.ts#L17) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [plugin.ts#L36](https://github.com/elastic/kibana/tree/master/x-pack/plugins/cross_cluster_replication/server/plugin.ts#L36) | 7.16 |
 
 
 
@@ -166,10 +166,10 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 
 | Deprecated API | Reference location | Remove By |
 | ---------------|-----------|-----------|
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [types.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/global_search/server/types.ts#L11) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [types.ts#L73](https://github.com/elastic/kibana/tree/master/x-pack/plugins/global_search/server/types.ts#L73) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [types.d.ts#L2](https://github.com/elastic/kibana/tree/master/x-pack/plugins/global_search/target/types/server/types.d.ts#L2) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [types.d.ts#L45](https://github.com/elastic/kibana/tree/master/x-pack/plugins/global_search/target/types/server/types.d.ts#L45) | - |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [types.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/global_search/server/types.ts#L11) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [types.ts#L73](https://github.com/elastic/kibana/tree/master/x-pack/plugins/global_search/server/types.ts#L73) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [types.d.ts#L2](https://github.com/elastic/kibana/tree/master/x-pack/plugins/global_search/target/types/server/types.d.ts#L2) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [types.d.ts#L45](https://github.com/elastic/kibana/tree/master/x-pack/plugins/global_search/target/types/server/types.d.ts#L45) | 7.16 |
 
 
 
@@ -186,8 +186,8 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 
 | Deprecated API | Reference location | Remove By |
 | ---------------|-----------|-----------|
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [plugin.ts#L14](https://github.com/elastic/kibana/tree/master/x-pack/plugins/index_lifecycle_management/server/plugin.ts#L14) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [plugin.ts#L29](https://github.com/elastic/kibana/tree/master/x-pack/plugins/index_lifecycle_management/server/plugin.ts#L29) | - |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [plugin.ts#L14](https://github.com/elastic/kibana/tree/master/x-pack/plugins/index_lifecycle_management/server/plugin.ts#L14) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [plugin.ts#L29](https://github.com/elastic/kibana/tree/master/x-pack/plugins/index_lifecycle_management/server/plugin.ts#L29) | 7.16 |
 
 
 
@@ -195,18 +195,18 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 
 | Deprecated API | Reference location | Remove By |
 | ---------------|-----------|-----------|
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [plugin.ts#L14](https://github.com/elastic/kibana/tree/master/x-pack/plugins/index_management/server/plugin.ts#L14) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [plugin.ts#L42](https://github.com/elastic/kibana/tree/master/x-pack/plugins/index_management/server/plugin.ts#L42) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyScopedClusterClient" text="LegacyScopedClusterClient"/> | [types.ts#L9](https://github.com/elastic/kibana/tree/master/x-pack/plugins/index_management/server/types.ts#L9) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyScopedClusterClient" text="LegacyScopedClusterClient"/> | [types.ts#L40](https://github.com/elastic/kibana/tree/master/x-pack/plugins/index_management/server/types.ts#L40) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyScopedClusterClient" text="LegacyScopedClusterClient"/> | [types.d.ts#L1](https://github.com/elastic/kibana/tree/master/x-pack/plugins/index_management/target/types/server/types.d.ts#L1) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyScopedClusterClient" text="LegacyScopedClusterClient"/> | [types.d.ts#L25](https://github.com/elastic/kibana/tree/master/x-pack/plugins/index_management/target/types/server/types.d.ts#L25) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [types.ts#L10](https://github.com/elastic/kibana/tree/master/x-pack/plugins/index_management/server/types.ts#L10) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [types.ts#L43](https://github.com/elastic/kibana/tree/master/x-pack/plugins/index_management/server/types.ts#L43) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [types.ts#L50](https://github.com/elastic/kibana/tree/master/x-pack/plugins/index_management/server/types.ts#L50) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [types.d.ts#L1](https://github.com/elastic/kibana/tree/master/x-pack/plugins/index_management/target/types/server/types.d.ts#L1) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [types.d.ts#L27](https://github.com/elastic/kibana/tree/master/x-pack/plugins/index_management/target/types/server/types.d.ts#L27) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [types.d.ts#L33](https://github.com/elastic/kibana/tree/master/x-pack/plugins/index_management/target/types/server/types.d.ts#L33) | - |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [plugin.ts#L14](https://github.com/elastic/kibana/tree/master/x-pack/plugins/index_management/server/plugin.ts#L14) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [plugin.ts#L42](https://github.com/elastic/kibana/tree/master/x-pack/plugins/index_management/server/plugin.ts#L42) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyScopedClusterClient" text="LegacyScopedClusterClient"/> | [types.ts#L9](https://github.com/elastic/kibana/tree/master/x-pack/plugins/index_management/server/types.ts#L9) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyScopedClusterClient" text="LegacyScopedClusterClient"/> | [types.ts#L40](https://github.com/elastic/kibana/tree/master/x-pack/plugins/index_management/server/types.ts#L40) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyScopedClusterClient" text="LegacyScopedClusterClient"/> | [types.d.ts#L1](https://github.com/elastic/kibana/tree/master/x-pack/plugins/index_management/target/types/server/types.d.ts#L1) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyScopedClusterClient" text="LegacyScopedClusterClient"/> | [types.d.ts#L25](https://github.com/elastic/kibana/tree/master/x-pack/plugins/index_management/target/types/server/types.d.ts#L25) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [types.ts#L10](https://github.com/elastic/kibana/tree/master/x-pack/plugins/index_management/server/types.ts#L10) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [types.ts#L43](https://github.com/elastic/kibana/tree/master/x-pack/plugins/index_management/server/types.ts#L43) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [types.ts#L50](https://github.com/elastic/kibana/tree/master/x-pack/plugins/index_management/server/types.ts#L50) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [types.d.ts#L1](https://github.com/elastic/kibana/tree/master/x-pack/plugins/index_management/target/types/server/types.d.ts#L1) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [types.d.ts#L27](https://github.com/elastic/kibana/tree/master/x-pack/plugins/index_management/target/types/server/types.d.ts#L27) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [types.d.ts#L33](https://github.com/elastic/kibana/tree/master/x-pack/plugins/index_management/target/types/server/types.d.ts#L33) | 7.16 |
 
 
 
@@ -214,11 +214,11 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 
 | Deprecated API | Reference location | Remove By |
 | ---------------|-----------|-----------|
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [log_entry_categories_analysis.ts#L9](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/server/lib/log_analysis/log_entry_categories_analysis.ts#L9) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [log_entry_categories_analysis.ts#L139](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/server/lib/log_analysis/log_entry_categories_analysis.ts#L139) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [log_entry_categories_analysis.ts#L405](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/server/lib/log_analysis/log_entry_categories_analysis.ts#L405) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [log_entry_categories_analysis.d.ts#L1](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/target/types/server/lib/log_analysis/log_entry_categories_analysis.d.ts#L1) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [log_entry_categories_analysis.d.ts#L58](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/target/types/server/lib/log_analysis/log_entry_categories_analysis.d.ts#L58) | - |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [log_entry_categories_analysis.ts#L9](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/server/lib/log_analysis/log_entry_categories_analysis.ts#L9) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [log_entry_categories_analysis.ts#L139](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/server/lib/log_analysis/log_entry_categories_analysis.ts#L139) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [log_entry_categories_analysis.ts#L405](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/server/lib/log_analysis/log_entry_categories_analysis.ts#L405) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [log_entry_categories_analysis.d.ts#L1](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/target/types/server/lib/log_analysis/log_entry_categories_analysis.d.ts#L1) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [log_entry_categories_analysis.d.ts#L58](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/target/types/server/lib/log_analysis/log_entry_categories_analysis.d.ts#L58) | 7.16 |
 
 
 
@@ -226,24 +226,24 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 
 | Deprecated API | Reference location | Remove By |
 | ---------------|-----------|-----------|
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [types.ts#L9](https://github.com/elastic/kibana/tree/master/x-pack/plugins/licensing/server/types.ts#L9) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [types.ts#L85](https://github.com/elastic/kibana/tree/master/x-pack/plugins/licensing/server/types.ts#L85) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [types.ts#L110](https://github.com/elastic/kibana/tree/master/x-pack/plugins/licensing/server/types.ts#L110) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [plugin.ts#L18](https://github.com/elastic/kibana/tree/master/x-pack/plugins/licensing/server/plugin.ts#L18) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [plugin.ts#L109](https://github.com/elastic/kibana/tree/master/x-pack/plugins/licensing/server/plugin.ts#L109) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [plugin.ts#L151](https://github.com/elastic/kibana/tree/master/x-pack/plugins/licensing/server/plugin.ts#L151) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [plugin.ts#L180](https://github.com/elastic/kibana/tree/master/x-pack/plugins/licensing/server/plugin.ts#L180) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [plugin.test.ts#L18](https://github.com/elastic/kibana/tree/master/x-pack/plugins/licensing/server/plugin.test.ts#L18) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [plugin.test.ts#L33](https://github.com/elastic/kibana/tree/master/x-pack/plugins/licensing/server/plugin.test.ts#L33) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [types.d.ts#L2](https://github.com/elastic/kibana/tree/master/x-pack/plugins/licensing/target/types/server/types.d.ts#L2) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [types.d.ts#L70](https://github.com/elastic/kibana/tree/master/x-pack/plugins/licensing/target/types/server/types.d.ts#L70) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [types.d.ts#L94](https://github.com/elastic/kibana/tree/master/x-pack/plugins/licensing/target/types/server/types.d.ts#L94) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [plugin.ts#L19](https://github.com/elastic/kibana/tree/master/x-pack/plugins/licensing/server/plugin.ts#L19) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [plugin.ts#L102](https://github.com/elastic/kibana/tree/master/x-pack/plugins/licensing/server/plugin.ts#L102) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [plugin.ts#L103](https://github.com/elastic/kibana/tree/master/x-pack/plugins/licensing/server/plugin.ts#L103) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [plugin.ts#L111](https://github.com/elastic/kibana/tree/master/x-pack/plugins/licensing/server/plugin.ts#L111) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [plugin.ts#L114](https://github.com/elastic/kibana/tree/master/x-pack/plugins/licensing/server/plugin.ts#L114) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [plugin.ts#L115](https://github.com/elastic/kibana/tree/master/x-pack/plugins/licensing/server/plugin.ts#L115) | - |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [types.ts#L9](https://github.com/elastic/kibana/tree/master/x-pack/plugins/licensing/server/types.ts#L9) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [types.ts#L85](https://github.com/elastic/kibana/tree/master/x-pack/plugins/licensing/server/types.ts#L85) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [types.ts#L110](https://github.com/elastic/kibana/tree/master/x-pack/plugins/licensing/server/types.ts#L110) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [plugin.ts#L18](https://github.com/elastic/kibana/tree/master/x-pack/plugins/licensing/server/plugin.ts#L18) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [plugin.ts#L109](https://github.com/elastic/kibana/tree/master/x-pack/plugins/licensing/server/plugin.ts#L109) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [plugin.ts#L151](https://github.com/elastic/kibana/tree/master/x-pack/plugins/licensing/server/plugin.ts#L151) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [plugin.ts#L180](https://github.com/elastic/kibana/tree/master/x-pack/plugins/licensing/server/plugin.ts#L180) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [plugin.test.ts#L18](https://github.com/elastic/kibana/tree/master/x-pack/plugins/licensing/server/plugin.test.ts#L18) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [plugin.test.ts#L33](https://github.com/elastic/kibana/tree/master/x-pack/plugins/licensing/server/plugin.test.ts#L33) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [types.d.ts#L2](https://github.com/elastic/kibana/tree/master/x-pack/plugins/licensing/target/types/server/types.d.ts#L2) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [types.d.ts#L70](https://github.com/elastic/kibana/tree/master/x-pack/plugins/licensing/target/types/server/types.d.ts#L70) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [types.d.ts#L94](https://github.com/elastic/kibana/tree/master/x-pack/plugins/licensing/target/types/server/types.d.ts#L94) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [plugin.ts#L19](https://github.com/elastic/kibana/tree/master/x-pack/plugins/licensing/server/plugin.ts#L19) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [plugin.ts#L102](https://github.com/elastic/kibana/tree/master/x-pack/plugins/licensing/server/plugin.ts#L102) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [plugin.ts#L103](https://github.com/elastic/kibana/tree/master/x-pack/plugins/licensing/server/plugin.ts#L103) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [plugin.ts#L111](https://github.com/elastic/kibana/tree/master/x-pack/plugins/licensing/server/plugin.ts#L111) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [plugin.ts#L114](https://github.com/elastic/kibana/tree/master/x-pack/plugins/licensing/server/plugin.ts#L114) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [plugin.ts#L115](https://github.com/elastic/kibana/tree/master/x-pack/plugins/licensing/server/plugin.ts#L115) | 7.16 |
 
 
 
@@ -251,1652 +251,10 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 
 | Deprecated API | Reference location | Remove By |
 | ---------------|-----------|-----------|
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.NonEmptyString" text="NonEmptyString"/> | [shared_imports.ts#L9](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/shared_imports.ts#L9) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.NonEmptyString" text="NonEmptyString"/> | [schemas.ts#L13](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.ts#L13) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.NonEmptyString" text="NonEmptyString"/> | [schemas.ts#L55](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.ts#L55) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.NonEmptyString" text="NonEmptyString"/> | [schemas.ts#L87](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.ts#L87) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.NonEmptyString" text="NonEmptyString"/> | [schemas.ts#L366](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.ts#L366) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.NonEmptyString" text="NonEmptyString"/> | [comment.ts#L10](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/comment.ts#L10) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.NonEmptyString" text="NonEmptyString"/> | [comment.ts#L19](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/comment.ts#L19) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.NonEmptyString" text="NonEmptyString"/> | [create_comment.ts#L10](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/create_comment.ts#L10) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.NonEmptyString" text="NonEmptyString"/> | [create_comment.ts#L17](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/create_comment.ts#L17) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.NonEmptyString" text="NonEmptyString"/> | [update_comment.ts#L10](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/update_comment.ts#L10) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.NonEmptyString" text="NonEmptyString"/> | [update_comment.ts#L19](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/update_comment.ts#L19) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.NonEmptyString" text="NonEmptyString"/> | [entry_match_any.ts#L10](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match_any.ts#L10) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.NonEmptyString" text="NonEmptyString"/> | [entry_match_any.ts#L20](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match_any.ts#L20) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.NonEmptyString" text="NonEmptyString"/> | [entry_match.ts#L10](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match.ts#L10) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.NonEmptyString" text="NonEmptyString"/> | [entry_match.ts#L18](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match.ts#L18) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.NonEmptyString" text="NonEmptyString"/> | [entry_match.ts#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match.ts#L21) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.NonEmptyString" text="NonEmptyString"/> | [entry_exists.ts#L10](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_exists.ts#L10) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.NonEmptyString" text="NonEmptyString"/> | [entry_exists.ts#L18](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_exists.ts#L18) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.NonEmptyString" text="NonEmptyString"/> | [entry_list.ts#L10](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_list.ts#L10) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.NonEmptyString" text="NonEmptyString"/> | [entry_list.ts#L18](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_list.ts#L18) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.NonEmptyString" text="NonEmptyString"/> | [entry_list.ts#L19](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_list.ts#L19) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.NonEmptyString" text="NonEmptyString"/> | [entry_nested.ts#L10](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_nested.ts#L10) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.NonEmptyString" text="NonEmptyString"/> | [entry_nested.ts#L20](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_nested.ts#L20) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.NonEmptyString" text="NonEmptyString"/> | [entry_match_wildcard.ts#L10](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.ts#L10) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.NonEmptyString" text="NonEmptyString"/> | [entry_match_wildcard.ts#L18](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.ts#L18) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.NonEmptyString" text="NonEmptyString"/> | [entry_match_wildcard.ts#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.ts#L21) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.NonEmptyString" text="NonEmptyString"/> | [entry_match_any.ts#L10](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_any.ts#L10) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.NonEmptyString" text="NonEmptyString"/> | [entry_match_any.ts#L19](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_any.ts#L19) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.NonEmptyString" text="NonEmptyString"/> | [entry_match.ts#L10](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_match.ts#L10) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.NonEmptyString" text="NonEmptyString"/> | [entry_match.ts#L18](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_match.ts#L18) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.NonEmptyString" text="NonEmptyString"/> | [entry_match.ts#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_match.ts#L21) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.NonEmptyString" text="NonEmptyString"/> | [entry_nested.ts#L10](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_nested.ts#L10) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.NonEmptyString" text="NonEmptyString"/> | [entry_nested.ts#L20](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_nested.ts#L20) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.NonEmptyString" text="NonEmptyString"/> | [entry_match_wildcard.ts#L10](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_wildcard.ts#L10) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.NonEmptyString" text="NonEmptyString"/> | [entry_match_wildcard.ts#L18](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_wildcard.ts#L18) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.NonEmptyString" text="NonEmptyString"/> | [entry_match_wildcard.ts#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_wildcard.ts#L21) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.DefaultArray" text="DefaultArray"/> | [shared_imports.ts#L10](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/shared_imports.ts#L10) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.DefaultArray" text="DefaultArray"/> | [schemas.ts#L13](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.ts#L13) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.DefaultArray" text="DefaultArray"/> | [schemas.ts#L487](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.ts#L487) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.DefaultUuid" text="DefaultUuid"/> | [shared_imports.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/shared_imports.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.DefaultUuid" text="DefaultUuid"/> | [create_endpoint_list_item_schema.ts#L25](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.ts#L25) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.DefaultUuid" text="DefaultUuid"/> | [create_endpoint_list_item_schema.ts#L39](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.ts#L39) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.DefaultUuid" text="DefaultUuid"/> | [create_exception_list_item_schema.ts#L31](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.ts#L31) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.DefaultUuid" text="DefaultUuid"/> | [create_exception_list_item_schema.ts#L46](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.ts#L46) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.DefaultUuid" text="DefaultUuid"/> | [create_exception_list_schema.ts#L24](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.ts#L24) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.DefaultUuid" text="DefaultUuid"/> | [create_exception_list_schema.ts#L40](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.ts#L40) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.DefaultStringArray" text="DefaultStringArray"/> | [shared_imports.ts#L12](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/shared_imports.ts#L12) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.DefaultStringArray" text="DefaultStringArray"/> | [schemas.ts#L13](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.ts#L13) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.DefaultStringArray" text="DefaultStringArray"/> | [schemas.ts#L293](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.ts#L293) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.DefaultVersionNumber" text="DefaultVersionNumber"/> | [shared_imports.ts#L13](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/shared_imports.ts#L13) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.DefaultVersionNumber" text="DefaultVersionNumber"/> | [create_exception_list_schema.ts#L25](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.ts#L25) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.DefaultVersionNumber" text="DefaultVersionNumber"/> | [create_exception_list_schema.ts#L45](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.ts#L45) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.DefaultVersionNumber" text="DefaultVersionNumber"/> | [create_list_schema.ts#L12](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_list_schema.ts#L12) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.DefaultVersionNumber" text="DefaultVersionNumber"/> | [create_list_schema.ts#L28](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_list_schema.ts#L28) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [shared_imports.ts#L17](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/shared_imports.ts#L17) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [schemas.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [schemas.test.ts#L105](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L105) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [schemas.test.ts#L114](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L114) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [schemas.test.ts#L127](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L127) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [schemas.test.ts#L140](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L140) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [schemas.test.ts#L151](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L151) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [schemas.test.ts#L163](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L163) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [schemas.test.ts#L172](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L172) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [schemas.test.ts#L184](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L184) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [schemas.test.ts#L193](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L193) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [schemas.test.ts#L205](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L205) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [schemas.test.ts#L214](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L214) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [schemas.test.ts#L226](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L226) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [schemas.test.ts#L235](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L235) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [schemas.test.ts#L244](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L244) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [schemas.test.ts#L256](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L256) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [schemas.test.ts#L265](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L265) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [schemas.test.ts#L277](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L277) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [schemas.test.ts#L288](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L288) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [schemas.test.ts#L301](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L301) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [schemas.test.ts#L312](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L312) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [schemas.test.ts#L321](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L321) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [schemas.test.ts#L333](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L333) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [schemas.test.ts#L344](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L344) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [schemas.test.ts#L356](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L356) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [schemas.test.ts#L367](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L367) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [schemas.test.ts#L379](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L379) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [schemas.test.ts#L390](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L390) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [schemas.test.ts#L399](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L399) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [schemas.test.ts#L410](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L410) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [search_es_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [search_es_list_item_schema.test.ts#L20](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_item_schema.test.ts#L20) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [search_es_list_item_schema.test.ts#L32](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_item_schema.test.ts#L32) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [search_es_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [search_es_list_schema.test.ts#L20](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_schema.test.ts#L20) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [search_es_list_schema.test.ts#L32](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_schema.test.ts#L32) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_endpoint_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_endpoint_list_item_schema.test.ts#L26](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L26) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_endpoint_list_item_schema.test.ts#L38](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L38) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_endpoint_list_item_schema.test.ts#L51](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L51) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_endpoint_list_item_schema.test.ts#L64](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L64) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_endpoint_list_item_schema.test.ts#L78](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L78) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_endpoint_list_item_schema.test.ts#L90](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L90) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_endpoint_list_item_schema.test.ts#L102](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L102) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_endpoint_list_item_schema.test.ts#L115](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L115) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_endpoint_list_item_schema.test.ts#L128](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L128) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_endpoint_list_item_schema.test.ts#L143](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L143) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_endpoint_list_item_schema.test.ts#L156](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L156) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_endpoint_list_item_schema.test.ts#L171](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L171) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_endpoint_list_item_schema.test.ts#L182](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L182) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_endpoint_list_item_schema.test.ts#L194](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L194) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_endpoint_list_item_schema.test.ts#L205](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L205) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_exception_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_exception_list_item_schema.test.ts#L26](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L26) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_exception_list_item_schema.test.ts#L38](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L38) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_exception_list_item_schema.test.ts#L51](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L51) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_exception_list_item_schema.test.ts#L64](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L64) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_exception_list_item_schema.test.ts#L77](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L77) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_exception_list_item_schema.test.ts#L91](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L91) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_exception_list_item_schema.test.ts#L104](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L104) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_exception_list_item_schema.test.ts#L117](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L117) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_exception_list_item_schema.test.ts#L132](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L132) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_exception_list_item_schema.test.ts#L145](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L145) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_exception_list_item_schema.test.ts#L160](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L160) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_exception_list_item_schema.test.ts#L173](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L173) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_exception_list_item_schema.test.ts#L184](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L184) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_exception_list_item_schema.test.ts#L196](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L196) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_exception_list_item_schema.test.ts#L208](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L208) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_exception_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_exception_list_schema.test.ts#L23](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.test.ts#L23) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_exception_list_schema.test.ts#L34](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.test.ts#L34) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_exception_list_schema.test.ts#L47](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.test.ts#L47) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_exception_list_schema.test.ts#L58](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.test.ts#L58) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_exception_list_schema.test.ts#L70](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.test.ts#L70) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_exception_list_schema.test.ts#L82](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.test.ts#L82) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_list_item_schema.test.ts#L20](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_list_item_schema.test.ts#L20) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_list_item_schema.test.ts#L31](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_list_item_schema.test.ts#L31) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_list_item_schema.test.ts#L42](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_list_item_schema.test.ts#L42) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_list_item_schema.test.ts#L53](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_list_item_schema.test.ts#L53) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_list_schema.test.ts#L20](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts#L20) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_list_schema.test.ts#L31](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts#L31) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_list_schema.test.ts#L41](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts#L41) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_list_schema.test.ts#L51](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts#L51) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_list_schema.test.ts#L61](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts#L61) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_list_schema.test.ts#L71](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts#L71) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [delete_endpoint_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_endpoint_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [delete_endpoint_list_item_schema.test.ts#L23](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_endpoint_list_item_schema.test.ts#L23) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [delete_endpoint_list_item_schema.test.ts#L37](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_endpoint_list_item_schema.test.ts#L37) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [delete_endpoint_list_item_schema.test.ts#L48](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_endpoint_list_item_schema.test.ts#L48) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [delete_exception_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_exception_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [delete_exception_list_item_schema.test.ts#L23](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_exception_list_item_schema.test.ts#L23) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [delete_exception_list_item_schema.test.ts#L34](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_exception_list_item_schema.test.ts#L34) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [delete_exception_list_item_schema.test.ts#L46](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_exception_list_item_schema.test.ts#L46) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [delete_exception_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_exception_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [delete_exception_list_schema.test.ts#L23](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_exception_list_schema.test.ts#L23) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [delete_exception_list_schema.test.ts#L34](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_exception_list_schema.test.ts#L34) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [delete_exception_list_schema.test.ts#L46](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_exception_list_schema.test.ts#L46) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [delete_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [delete_list_item_schema.test.ts#L20](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_list_item_schema.test.ts#L20) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [delete_list_item_schema.test.ts#L32](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_list_item_schema.test.ts#L32) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [delete_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [delete_list_schema.test.ts#L20](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_list_schema.test.ts#L20) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [delete_list_schema.test.ts#L32](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_list_schema.test.ts#L32) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [delete_list_schema.test.ts#L42](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_list_schema.test.ts#L42) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [export_exception_list_query_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/export_exception_list_query_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [export_exception_list_query_schema.test.ts#L23](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/export_exception_list_query_schema.test.ts#L23) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [export_exception_list_query_schema.test.ts#L35](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/export_exception_list_query_schema.test.ts#L35) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [export_exception_list_query_schema.test.ts#L46](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/export_exception_list_query_schema.test.ts#L46) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [export_exception_list_query_schema.test.ts#L61](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/export_exception_list_query_schema.test.ts#L61) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [export_exception_list_query_schema.test.ts#L76](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/export_exception_list_query_schema.test.ts#L76) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [export_list_item_query_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/export_list_item_query_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [export_list_item_query_schema.test.ts#L23](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/export_list_item_query_schema.test.ts#L23) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [export_list_item_query_schema.test.ts#L35](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/export_list_item_query_schema.test.ts#L35) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [export_list_item_query_schema.test.ts#L49](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/export_list_item_query_schema.test.ts#L49) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_endpoint_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_endpoint_list_item_schema.test.ts#L26](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts#L26) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_endpoint_list_item_schema.test.ts#L35](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts#L35) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_endpoint_list_item_schema.test.ts#L45](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts#L45) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_endpoint_list_item_schema.test.ts#L57](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts#L57) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_endpoint_list_item_schema.test.ts#L69](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts#L69) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_endpoint_list_item_schema.test.ts#L81](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts#L81) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_endpoint_list_item_schema.test.ts#L93](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts#L93) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_endpoint_list_item_schema.test.ts#L106](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts#L106) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_exception_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_exception_list_item_schema.test.ts#L30](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts#L30) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_exception_list_item_schema.test.ts#L39](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts#L39) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_exception_list_item_schema.test.ts#L48](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts#L48) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_exception_list_item_schema.test.ts#L67](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts#L67) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_exception_list_item_schema.test.ts#L79](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts#L79) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_exception_list_item_schema.test.ts#L91](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts#L91) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_exception_list_item_schema.test.ts#L105](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts#L105) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_exception_list_item_schema.test.ts#L117](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts#L117) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_exception_list_item_schema.test.ts#L130](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts#L130) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_exception_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_exception_list_schema.test.ts#L27](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts#L27) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_exception_list_schema.test.ts#L36](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts#L36) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_exception_list_schema.test.ts#L54](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts#L54) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_exception_list_schema.test.ts#L66](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts#L66) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_exception_list_schema.test.ts#L78](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts#L78) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_exception_list_schema.test.ts#L90](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts#L90) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_exception_list_schema.test.ts#L102](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts#L102) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_exception_list_schema.test.ts#L115](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts#L115) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_list_item_schema.test.ts#L28](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts#L28) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_list_item_schema.test.ts#L37](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts#L37) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_list_item_schema.test.ts#L56](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts#L56) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_list_item_schema.test.ts#L68](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts#L68) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_list_item_schema.test.ts#L80](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts#L80) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_list_item_schema.test.ts#L92](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts#L92) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_list_item_schema.test.ts#L105](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts#L105) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_list_schema.test.ts#L20](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts#L20) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_list_schema.test.ts#L29](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts#L29) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_list_schema.test.ts#L39](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts#L39) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_list_schema.test.ts#L51](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts#L51) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_list_schema.test.ts#L63](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts#L63) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_list_schema.test.ts#L75](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts#L75) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_list_schema.test.ts#L87](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts#L87) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [find_list_schema.test.ts#L100](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts#L100) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [import_list_item_query_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [import_list_item_query_schema.test.ts#L23](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts#L23) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [import_list_item_query_schema.test.ts#L34](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts#L34) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [import_list_item_query_schema.test.ts#L44](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts#L44) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [import_list_item_query_schema.test.ts#L55](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts#L55) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [import_list_item_query_schema.test.ts#L65](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts#L65) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [import_list_item_query_schema.test.ts#L75](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts#L75) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [import_list_item_query_schema.test.ts#L87](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts#L87) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [import_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/import_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [import_list_item_schema.test.ts#L20](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/import_list_item_schema.test.ts#L20) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [import_list_item_schema.test.ts#L32](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/import_list_item_schema.test.ts#L32) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [import_list_item_schema.test.ts#L46](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/import_list_item_schema.test.ts#L46) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [patch_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [patch_list_item_schema.test.ts#L20](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts#L20) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [patch_list_item_schema.test.ts#L32](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts#L32) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [patch_list_item_schema.test.ts#L43](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts#L43) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [patch_list_item_schema.test.ts#L54](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts#L54) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [patch_list_item_schema.test.ts#L66](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts#L66) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [patch_list_item_schema.test.ts#L77](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts#L77) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [patch_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [patch_list_schema.test.ts#L20](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts#L20) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [patch_list_schema.test.ts#L32](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts#L32) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [patch_list_schema.test.ts#L43](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts#L43) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [patch_list_schema.test.ts#L54](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts#L54) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [patch_list_schema.test.ts#L65](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts#L65) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [patch_list_schema.test.ts#L78](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts#L78) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [patch_list_schema.test.ts#L90](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts#L90) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [patch_list_schema.test.ts#L102](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts#L102) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [patch_list_schema.test.ts#L114](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts#L114) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [patch_list_schema.test.ts#L125](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts#L125) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [read_endpoint_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [read_endpoint_list_item_schema.test.ts#L23](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts#L23) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [read_endpoint_list_item_schema.test.ts#L34](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts#L34) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [read_endpoint_list_item_schema.test.ts#L45](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts#L45) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [read_endpoint_list_item_schema.test.ts#L59](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts#L59) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [read_endpoint_list_item_schema.test.ts#L71](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts#L71) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [read_endpoint_list_item_schema.test.ts#L84](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts#L84) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [read_exception_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [read_exception_list_item_schema.test.ts#L23](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts#L23) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [read_exception_list_item_schema.test.ts#L34](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts#L34) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [read_exception_list_item_schema.test.ts#L45](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts#L45) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [read_exception_list_item_schema.test.ts#L56](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts#L56) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [read_exception_list_item_schema.test.ts#L72](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts#L72) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [read_exception_list_item_schema.test.ts#L84](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts#L84) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [read_exception_list_item_schema.test.ts#L98](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts#L98) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [read_exception_list_item_schema.test.ts#L112](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts#L112) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [read_exception_list_item_schema.test.ts#L125](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts#L125) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [read_exception_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [read_exception_list_schema.test.ts#L20](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts#L20) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [read_exception_list_schema.test.ts#L31](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts#L31) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [read_exception_list_schema.test.ts#L42](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts#L42) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [read_exception_list_schema.test.ts#L53](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts#L53) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [read_exception_list_schema.test.ts#L69](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts#L69) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [read_exception_list_schema.test.ts#L81](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts#L81) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [read_exception_list_schema.test.ts#L95](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts#L95) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [read_exception_list_schema.test.ts#L109](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts#L109) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [read_exception_list_schema.test.ts#L122](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts#L122) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [read_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [read_list_item_schema.test.ts#L20](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts#L20) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [read_list_item_schema.test.ts#L31](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts#L31) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [read_list_item_schema.test.ts#L42](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts#L42) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [read_list_item_schema.test.ts#L53](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts#L53) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [read_list_item_schema.test.ts#L66](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts#L66) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [read_list_item_schema.test.ts#L78](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts#L78) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [read_list_item_schema.test.ts#L90](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts#L90) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [read_list_item_schema.test.ts#L102](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts#L102) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [read_list_item_schema.test.ts#L113](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts#L113) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [read_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [read_list_schema.test.ts#L20](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_schema.test.ts#L20) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [read_list_schema.test.ts#L32](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_schema.test.ts#L32) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [read_list_schema.test.ts#L43](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_schema.test.ts#L43) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_endpoint_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_endpoint_list_item_schema.test.ts#L23](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts#L23) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_endpoint_list_item_schema.test.ts#L34](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts#L34) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_endpoint_list_item_schema.test.ts#L47](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts#L47) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_endpoint_list_item_schema.test.ts#L60](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts#L60) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_endpoint_list_item_schema.test.ts#L74](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts#L74) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_endpoint_list_item_schema.test.ts#L85](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts#L85) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_endpoint_list_item_schema.test.ts#L98](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts#L98) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_endpoint_list_item_schema.test.ts#L111](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts#L111) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_endpoint_list_item_schema.test.ts#L125](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts#L125) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_endpoint_list_item_schema.test.ts#L137](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts#L137) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_exception_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_exception_list_item_schema.test.ts#L23](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts#L23) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_exception_list_item_schema.test.ts#L34](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts#L34) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_exception_list_item_schema.test.ts#L47](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts#L47) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_exception_list_item_schema.test.ts#L60](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts#L60) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_exception_list_item_schema.test.ts#L74](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts#L74) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_exception_list_item_schema.test.ts#L85](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts#L85) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_exception_list_item_schema.test.ts#L98](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts#L98) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_exception_list_item_schema.test.ts#L111](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts#L111) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_exception_list_item_schema.test.ts#L125](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts#L125) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_exception_list_item_schema.test.ts#L137](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts#L137) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_exception_list_item_schema.test.ts#L147](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts#L147) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_exception_list_item_schema.test.ts#L159](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts#L159) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_exception_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_exception_list_schema.test.ts#L23](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts#L23) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_exception_list_schema.test.ts#L34](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts#L34) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_exception_list_schema.test.ts#L47](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts#L47) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_exception_list_schema.test.ts#L60](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts#L60) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_exception_list_schema.test.ts#L73](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts#L73) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_exception_list_schema.test.ts#L86](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts#L86) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_exception_list_schema.test.ts#L98](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts#L98) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_exception_list_schema.test.ts#L108](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts#L108) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_exception_list_schema.test.ts#L120](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts#L120) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_list_item_schema.test.ts#L20](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_list_item_schema.test.ts#L20) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_list_item_schema.test.ts#L31](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_list_item_schema.test.ts#L31) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_list_item_schema.test.ts#L44](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_list_item_schema.test.ts#L44) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_list_schema.test.ts#L20](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_list_schema.test.ts#L20) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_list_schema.test.ts#L31](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_list_schema.test.ts#L31) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [update_list_schema.test.ts#L44](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_list_schema.test.ts#L44) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [acknowledge_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/acknowledge_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [acknowledge_schema.test.ts#L20](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/acknowledge_schema.test.ts#L20) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [acknowledge_schema.test.ts#L31](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/acknowledge_schema.test.ts#L31) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [acknowledge_schema.test.ts#L44](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/acknowledge_schema.test.ts#L44) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_endpoint_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_endpoint_list_schema.test.ts#L20](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts#L20) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_endpoint_list_schema.test.ts#L30](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts#L30) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_endpoint_list_schema.test.ts#L42](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts#L42) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_endpoint_list_schema.test.ts#L56](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts#L56) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [create_endpoint_list_schema.test.ts#L69](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts#L69) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [exception_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [exception_list_item_schema.test.ts#L20](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L20) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [exception_list_item_schema.test.ts#L32](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L32) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [exception_list_item_schema.test.ts#L44](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L44) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [exception_list_item_schema.test.ts#L58](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L58) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [exception_list_item_schema.test.ts#L72](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L72) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [exception_list_item_schema.test.ts#L86](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L86) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [exception_list_item_schema.test.ts#L100](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L100) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [exception_list_item_schema.test.ts#L114](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L114) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [exception_list_item_schema.test.ts#L126](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L126) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [exception_list_item_schema.test.ts#L139](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L139) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [exception_list_item_schema.test.ts#L151](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L151) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [exception_list_item_schema.test.ts#L165](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L165) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [exception_list_item_schema.test.ts#L179](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L179) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [exception_list_item_schema.test.ts#L193](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L193) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [exception_list_item_schema.test.ts#L207](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L207) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [exception_list_item_schema.test.ts#L221](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L221) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [exception_list_item_schema.test.ts#L236](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L236) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [exception_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [exception_list_schema.test.ts#L20](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L20) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [exception_list_schema.test.ts#L32](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L32) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [exception_list_schema.test.ts#L44](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L44) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [exception_list_schema.test.ts#L58](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L58) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [exception_list_schema.test.ts#L72](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L72) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [exception_list_schema.test.ts#L84](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L84) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [exception_list_schema.test.ts#L97](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L97) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [exception_list_schema.test.ts#L109](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L109) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [exception_list_schema.test.ts#L123](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L123) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [exception_list_schema.test.ts#L137](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L137) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [exception_list_schema.test.ts#L151](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L151) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [exception_list_schema.test.ts#L165](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L165) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [exception_list_schema.test.ts#L179](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L179) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [exception_list_schema.test.ts#L194](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L194) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [found_exception_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [found_exception_list_item_schema.test.ts#L25](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts#L25) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [found_exception_list_item_schema.test.ts#L44](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts#L44) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [found_exception_list_item_schema.test.ts#L58](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts#L58) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [found_exception_list_item_schema.test.ts#L70](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts#L70) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [found_exception_list_item_schema.test.ts#L82](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts#L82) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [found_exception_list_item_schema.test.ts#L94](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts#L94) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [found_exception_list_item_schema.test.ts#L108](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts#L108) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [found_exception_list_item_schema.test.ts#L122](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts#L122) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [found_exception_list_item_schema.test.ts#L136](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts#L136) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [found_exception_list_item_schema.test.ts#L151](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts#L151) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [found_exception_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [found_exception_list_schema.test.ts#L22](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts#L22) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [found_exception_list_schema.test.ts#L41](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts#L41) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [found_exception_list_schema.test.ts#L55](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts#L55) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [found_exception_list_schema.test.ts#L67](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts#L67) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [found_exception_list_schema.test.ts#L79](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts#L79) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [found_exception_list_schema.test.ts#L91](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts#L91) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [found_exception_list_schema.test.ts#L105](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts#L105) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [found_exception_list_schema.test.ts#L119](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts#L119) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [found_exception_list_schema.test.ts#L133](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts#L133) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [found_exception_list_schema.test.ts#L148](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts#L148) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [list_item_index_exist_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_index_exist_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [list_item_index_exist_schema.test.ts#L20](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_index_exist_schema.test.ts#L20) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [list_item_index_exist_schema.test.ts#L32](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_index_exist_schema.test.ts#L32) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [list_item_index_exist_schema.test.ts#L46](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_index_exist_schema.test.ts#L46) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [list_item_index_exist_schema.test.ts#L61](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_index_exist_schema.test.ts#L61) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [list_item_schema.test.ts#L20](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L20) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [list_item_schema.test.ts#L32](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L32) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [list_item_schema.test.ts#L44](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L44) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [list_item_schema.test.ts#L57](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L57) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [list_item_schema.test.ts#L68](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L68) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [list_item_schema.test.ts#L79](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L79) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [list_item_schema.test.ts#L91](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L91) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [list_item_schema.test.ts#L105](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L105) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [list_item_schema.test.ts#L119](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L119) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [list_item_schema.test.ts#L133](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L133) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [list_item_schema.test.ts#L147](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L147) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [list_item_schema.test.ts#L161](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L161) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [list_item_schema.test.ts#L175](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L175) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [list_item_schema.test.ts#L188](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L188) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [list_schema.test.ts#L20](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L20) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [list_schema.test.ts#L32](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L32) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [list_schema.test.ts#L43](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L43) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [list_schema.test.ts#L54](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L54) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [list_schema.test.ts#L65](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L65) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [list_schema.test.ts#L77](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L77) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [list_schema.test.ts#L91](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L91) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [list_schema.test.ts#L105](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L105) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [list_schema.test.ts#L119](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L119) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [list_schema.test.ts#L133](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L133) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [list_schema.test.ts#L147](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L147) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [list_schema.test.ts#L161](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L161) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [list_schema.test.ts#L175](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L175) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [list_schema.test.ts#L188](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L188) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [search_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/search_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [search_list_item_schema.test.ts#L20](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/search_list_item_schema.test.ts#L20) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [search_list_item_schema.test.ts#L31](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/search_list_item_schema.test.ts#L31) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [search_list_item_schema.test.ts#L44](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/search_list_item_schema.test.ts#L44) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [encode_decode_cursor.ts#L13](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/server/services/utils/encode_decode_cursor.ts#L13) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [encode_decode_cursor.ts#L77](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/server/services/utils/encode_decode_cursor.ts#L77) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [validate.ts#L17](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/server/routes/validate.ts#L17) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.exactCheck" text="exactCheck"/> | [validate.ts#L70](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/server/routes/validate.ts#L70) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [shared_imports.ts#L18](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/shared_imports.ts#L18) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [schemas.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [schemas.test.ts#L43](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L43) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [schemas.test.ts#L52](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L52) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [schemas.test.ts#L75](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L75) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [schemas.test.ts#L84](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L84) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [schemas.test.ts#L107](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L107) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [schemas.test.ts#L116](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L116) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [schemas.test.ts#L129](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L129) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [schemas.test.ts#L142](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L142) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [schemas.test.ts#L153](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L153) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [schemas.test.ts#L165](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L165) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [schemas.test.ts#L174](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L174) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [schemas.test.ts#L186](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L186) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [schemas.test.ts#L195](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L195) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [schemas.test.ts#L207](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L207) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [schemas.test.ts#L216](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L216) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [schemas.test.ts#L228](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L228) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [schemas.test.ts#L237](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L237) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [schemas.test.ts#L246](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L246) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [schemas.test.ts#L258](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L258) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [schemas.test.ts#L267](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L267) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [schemas.test.ts#L279](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L279) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [schemas.test.ts#L290](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L290) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [schemas.test.ts#L303](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L303) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [schemas.test.ts#L314](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L314) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [schemas.test.ts#L323](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L323) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [schemas.test.ts#L335](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L335) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [schemas.test.ts#L346](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L346) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [schemas.test.ts#L358](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L358) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [schemas.test.ts#L369](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L369) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [schemas.test.ts#L381](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L381) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [schemas.test.ts#L392](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L392) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [schemas.test.ts#L401](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L401) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [schemas.test.ts#L412](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L412) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [search_es_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [search_es_list_item_schema.test.ts#L22](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_item_schema.test.ts#L22) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [search_es_list_item_schema.test.ts#L34](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_item_schema.test.ts#L34) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [search_es_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [search_es_list_schema.test.ts#L22](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_schema.test.ts#L22) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [search_es_list_schema.test.ts#L34](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_schema.test.ts#L34) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_endpoint_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_endpoint_list_item_schema.test.ts#L29](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L29) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_endpoint_list_item_schema.test.ts#L40](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L40) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_endpoint_list_item_schema.test.ts#L53](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L53) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_endpoint_list_item_schema.test.ts#L66](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L66) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_endpoint_list_item_schema.test.ts#L80](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L80) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_endpoint_list_item_schema.test.ts#L92](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L92) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_endpoint_list_item_schema.test.ts#L105](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L105) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_endpoint_list_item_schema.test.ts#L118](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L118) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_endpoint_list_item_schema.test.ts#L131](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L131) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_endpoint_list_item_schema.test.ts#L145](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L145) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_endpoint_list_item_schema.test.ts#L159](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L159) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_endpoint_list_item_schema.test.ts#L174](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L174) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_endpoint_list_item_schema.test.ts#L184](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L184) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_endpoint_list_item_schema.test.ts#L207](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L207) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_exception_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_exception_list_item_schema.test.ts#L29](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L29) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_exception_list_item_schema.test.ts#L40](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L40) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_exception_list_item_schema.test.ts#L53](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L53) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_exception_list_item_schema.test.ts#L66](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L66) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_exception_list_item_schema.test.ts#L79](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L79) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_exception_list_item_schema.test.ts#L94](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L94) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_exception_list_item_schema.test.ts#L107](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L107) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_exception_list_item_schema.test.ts#L120](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L120) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_exception_list_item_schema.test.ts#L134](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L134) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_exception_list_item_schema.test.ts#L148](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L148) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_exception_list_item_schema.test.ts#L163](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L163) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_exception_list_item_schema.test.ts#L176](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L176) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_exception_list_item_schema.test.ts#L186](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L186) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_exception_list_item_schema.test.ts#L210](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L210) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_exception_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_exception_list_schema.test.ts#L26](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.test.ts#L26) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_exception_list_schema.test.ts#L37](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.test.ts#L37) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_exception_list_schema.test.ts#L50](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.test.ts#L50) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_exception_list_schema.test.ts#L60](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.test.ts#L60) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_exception_list_schema.test.ts#L84](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.test.ts#L84) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_list_item_schema.test.ts#L23](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_list_item_schema.test.ts#L23) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_list_item_schema.test.ts#L34](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_list_item_schema.test.ts#L34) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_list_item_schema.test.ts#L45](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_list_item_schema.test.ts#L45) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_list_item_schema.test.ts#L55](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_list_item_schema.test.ts#L55) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_list_schema.test.ts#L23](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts#L23) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_list_schema.test.ts#L33](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts#L33) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_list_schema.test.ts#L43](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts#L43) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_list_schema.test.ts#L53](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts#L53) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_list_schema.test.ts#L63](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts#L63) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_list_schema.test.ts#L73](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts#L73) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [delete_endpoint_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_endpoint_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [delete_endpoint_list_item_schema.test.ts#L26](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_endpoint_list_item_schema.test.ts#L26) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [delete_endpoint_list_item_schema.test.ts#L39](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_endpoint_list_item_schema.test.ts#L39) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [delete_endpoint_list_item_schema.test.ts#L50](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_endpoint_list_item_schema.test.ts#L50) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [delete_exception_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_exception_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [delete_exception_list_item_schema.test.ts#L26](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_exception_list_item_schema.test.ts#L26) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [delete_exception_list_item_schema.test.ts#L36](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_exception_list_item_schema.test.ts#L36) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [delete_exception_list_item_schema.test.ts#L48](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_exception_list_item_schema.test.ts#L48) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [delete_exception_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_exception_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [delete_exception_list_schema.test.ts#L26](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_exception_list_schema.test.ts#L26) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [delete_exception_list_schema.test.ts#L36](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_exception_list_schema.test.ts#L36) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [delete_exception_list_schema.test.ts#L48](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_exception_list_schema.test.ts#L48) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [delete_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [delete_list_item_schema.test.ts#L23](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_list_item_schema.test.ts#L23) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [delete_list_item_schema.test.ts#L34](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_list_item_schema.test.ts#L34) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [delete_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [delete_list_schema.test.ts#L23](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_list_schema.test.ts#L23) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [delete_list_schema.test.ts#L34](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_list_schema.test.ts#L34) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [delete_list_schema.test.ts#L44](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_list_schema.test.ts#L44) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [export_exception_list_query_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/export_exception_list_query_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [export_exception_list_query_schema.test.ts#L26](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/export_exception_list_query_schema.test.ts#L26) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [export_exception_list_query_schema.test.ts#L38](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/export_exception_list_query_schema.test.ts#L38) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [export_exception_list_query_schema.test.ts#L64](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/export_exception_list_query_schema.test.ts#L64) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [export_exception_list_query_schema.test.ts#L78](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/export_exception_list_query_schema.test.ts#L78) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [export_list_item_query_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/export_list_item_query_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [export_list_item_query_schema.test.ts#L26](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/export_list_item_query_schema.test.ts#L26) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [export_list_item_query_schema.test.ts#L37](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/export_list_item_query_schema.test.ts#L37) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [export_list_item_query_schema.test.ts#L51](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/export_list_item_query_schema.test.ts#L51) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_endpoint_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_endpoint_list_item_schema.test.ts#L28](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts#L28) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_endpoint_list_item_schema.test.ts#L37](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts#L37) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_endpoint_list_item_schema.test.ts#L47](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts#L47) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_endpoint_list_item_schema.test.ts#L59](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts#L59) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_endpoint_list_item_schema.test.ts#L71](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts#L71) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_endpoint_list_item_schema.test.ts#L83](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts#L83) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_endpoint_list_item_schema.test.ts#L95](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts#L95) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_endpoint_list_item_schema.test.ts#L108](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts#L108) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_exception_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_exception_list_item_schema.test.ts#L32](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts#L32) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_exception_list_item_schema.test.ts#L41](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts#L41) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_exception_list_item_schema.test.ts#L50](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts#L50) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_exception_list_item_schema.test.ts#L69](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts#L69) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_exception_list_item_schema.test.ts#L81](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts#L81) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_exception_list_item_schema.test.ts#L93](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts#L93) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_exception_list_item_schema.test.ts#L107](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts#L107) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_exception_list_item_schema.test.ts#L119](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts#L119) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_exception_list_item_schema.test.ts#L132](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts#L132) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_exception_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_exception_list_schema.test.ts#L29](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts#L29) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_exception_list_schema.test.ts#L38](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts#L38) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_exception_list_schema.test.ts#L56](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts#L56) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_exception_list_schema.test.ts#L68](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts#L68) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_exception_list_schema.test.ts#L80](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts#L80) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_exception_list_schema.test.ts#L92](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts#L92) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_exception_list_schema.test.ts#L104](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts#L104) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_exception_list_schema.test.ts#L117](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts#L117) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_list_item_schema.test.ts#L30](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts#L30) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_list_item_schema.test.ts#L39](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts#L39) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_list_item_schema.test.ts#L58](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts#L58) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_list_item_schema.test.ts#L70](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts#L70) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_list_item_schema.test.ts#L82](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts#L82) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_list_item_schema.test.ts#L94](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts#L94) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_list_item_schema.test.ts#L107](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts#L107) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_list_schema.test.ts#L22](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts#L22) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_list_schema.test.ts#L31](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts#L31) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_list_schema.test.ts#L41](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts#L41) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_list_schema.test.ts#L53](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts#L53) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_list_schema.test.ts#L65](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts#L65) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_list_schema.test.ts#L77](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts#L77) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_list_schema.test.ts#L89](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts#L89) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [find_list_schema.test.ts#L102](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts#L102) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [import_list_item_query_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [import_list_item_query_schema.test.ts#L26](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts#L26) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [import_list_item_query_schema.test.ts#L36](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts#L36) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [import_list_item_query_schema.test.ts#L46](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts#L46) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [import_list_item_query_schema.test.ts#L57](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts#L57) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [import_list_item_query_schema.test.ts#L67](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts#L67) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [import_list_item_query_schema.test.ts#L77](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts#L77) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [import_list_item_query_schema.test.ts#L89](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts#L89) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [import_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/import_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [import_list_item_schema.test.ts#L23](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/import_list_item_schema.test.ts#L23) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [import_list_item_schema.test.ts#L34](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/import_list_item_schema.test.ts#L34) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [import_list_item_schema.test.ts#L48](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/import_list_item_schema.test.ts#L48) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [patch_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [patch_list_item_schema.test.ts#L23](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts#L23) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [patch_list_item_schema.test.ts#L35](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts#L35) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [patch_list_item_schema.test.ts#L46](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts#L46) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [patch_list_item_schema.test.ts#L57](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts#L57) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [patch_list_item_schema.test.ts#L69](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts#L69) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [patch_list_item_schema.test.ts#L79](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts#L79) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [patch_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [patch_list_schema.test.ts#L23](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts#L23) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [patch_list_schema.test.ts#L35](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts#L35) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [patch_list_schema.test.ts#L46](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts#L46) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [patch_list_schema.test.ts#L57](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts#L57) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [patch_list_schema.test.ts#L68](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts#L68) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [patch_list_schema.test.ts#L81](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts#L81) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [patch_list_schema.test.ts#L93](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts#L93) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [patch_list_schema.test.ts#L105](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts#L105) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [patch_list_schema.test.ts#L117](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts#L117) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [patch_list_schema.test.ts#L127](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts#L127) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [read_endpoint_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [read_endpoint_list_item_schema.test.ts#L26](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts#L26) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [read_endpoint_list_item_schema.test.ts#L37](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts#L37) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [read_endpoint_list_item_schema.test.ts#L48](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts#L48) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [read_endpoint_list_item_schema.test.ts#L62](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts#L62) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [read_endpoint_list_item_schema.test.ts#L74](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts#L74) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [read_endpoint_list_item_schema.test.ts#L86](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts#L86) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [read_exception_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [read_exception_list_item_schema.test.ts#L26](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts#L26) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [read_exception_list_item_schema.test.ts#L37](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts#L37) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [read_exception_list_item_schema.test.ts#L48](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts#L48) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [read_exception_list_item_schema.test.ts#L59](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts#L59) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [read_exception_list_item_schema.test.ts#L75](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts#L75) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [read_exception_list_item_schema.test.ts#L87](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts#L87) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [read_exception_list_item_schema.test.ts#L101](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts#L101) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [read_exception_list_item_schema.test.ts#L115](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts#L115) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [read_exception_list_item_schema.test.ts#L127](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts#L127) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [read_exception_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [read_exception_list_schema.test.ts#L23](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts#L23) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [read_exception_list_schema.test.ts#L34](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts#L34) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [read_exception_list_schema.test.ts#L45](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts#L45) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [read_exception_list_schema.test.ts#L56](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts#L56) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [read_exception_list_schema.test.ts#L72](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts#L72) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [read_exception_list_schema.test.ts#L84](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts#L84) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [read_exception_list_schema.test.ts#L98](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts#L98) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [read_exception_list_schema.test.ts#L112](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts#L112) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [read_exception_list_schema.test.ts#L124](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts#L124) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [read_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [read_list_item_schema.test.ts#L23](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts#L23) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [read_list_item_schema.test.ts#L34](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts#L34) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [read_list_item_schema.test.ts#L45](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts#L45) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [read_list_item_schema.test.ts#L56](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts#L56) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [read_list_item_schema.test.ts#L69](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts#L69) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [read_list_item_schema.test.ts#L81](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts#L81) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [read_list_item_schema.test.ts#L93](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts#L93) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [read_list_item_schema.test.ts#L105](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts#L105) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [read_list_item_schema.test.ts#L115](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts#L115) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [read_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [read_list_schema.test.ts#L23](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_schema.test.ts#L23) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [read_list_schema.test.ts#L35](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_schema.test.ts#L35) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [read_list_schema.test.ts#L45](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_schema.test.ts#L45) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_endpoint_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_endpoint_list_item_schema.test.ts#L25](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts#L25) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_endpoint_list_item_schema.test.ts#L36](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts#L36) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_endpoint_list_item_schema.test.ts#L49](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts#L49) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_endpoint_list_item_schema.test.ts#L62](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts#L62) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_endpoint_list_item_schema.test.ts#L76](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts#L76) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_endpoint_list_item_schema.test.ts#L88](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts#L88) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_endpoint_list_item_schema.test.ts#L100](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts#L100) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_endpoint_list_item_schema.test.ts#L113](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts#L113) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_endpoint_list_item_schema.test.ts#L127](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts#L127) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_endpoint_list_item_schema.test.ts#L139](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts#L139) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_exception_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_exception_list_item_schema.test.ts#L25](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts#L25) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_exception_list_item_schema.test.ts#L36](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts#L36) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_exception_list_item_schema.test.ts#L49](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts#L49) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_exception_list_item_schema.test.ts#L62](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts#L62) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_exception_list_item_schema.test.ts#L76](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts#L76) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_exception_list_item_schema.test.ts#L88](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts#L88) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_exception_list_item_schema.test.ts#L100](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts#L100) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_exception_list_item_schema.test.ts#L113](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts#L113) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_exception_list_item_schema.test.ts#L127](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts#L127) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_exception_list_item_schema.test.ts#L139](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts#L139) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_exception_list_item_schema.test.ts#L161](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts#L161) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_exception_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_exception_list_schema.test.ts#L25](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts#L25) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_exception_list_schema.test.ts#L36](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts#L36) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_exception_list_schema.test.ts#L49](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts#L49) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_exception_list_schema.test.ts#L62](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts#L62) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_exception_list_schema.test.ts#L76](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts#L76) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_exception_list_schema.test.ts#L88](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts#L88) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_exception_list_schema.test.ts#L100](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts#L100) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_exception_list_schema.test.ts#L122](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts#L122) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_list_item_schema.test.ts#L22](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_list_item_schema.test.ts#L22) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_list_item_schema.test.ts#L34](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_list_item_schema.test.ts#L34) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_list_item_schema.test.ts#L46](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_list_item_schema.test.ts#L46) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_list_schema.test.ts#L22](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_list_schema.test.ts#L22) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_list_schema.test.ts#L34](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_list_schema.test.ts#L34) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_list_schema.test.ts#L46](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_list_schema.test.ts#L46) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [acknowledge_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/acknowledge_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [acknowledge_schema.test.ts#L23](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/acknowledge_schema.test.ts#L23) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [acknowledge_schema.test.ts#L34](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/acknowledge_schema.test.ts#L34) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [acknowledge_schema.test.ts#L46](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/acknowledge_schema.test.ts#L46) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_endpoint_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_endpoint_list_schema.test.ts#L23](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts#L23) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_endpoint_list_schema.test.ts#L33](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts#L33) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_endpoint_list_schema.test.ts#L45](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts#L45) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_endpoint_list_schema.test.ts#L59](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts#L59) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_endpoint_list_schema.test.ts#L71](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts#L71) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [exception_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [exception_list_item_schema.test.ts#L23](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L23) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [exception_list_item_schema.test.ts#L35](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L35) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [exception_list_item_schema.test.ts#L47](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L47) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [exception_list_item_schema.test.ts#L61](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L61) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [exception_list_item_schema.test.ts#L75](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L75) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [exception_list_item_schema.test.ts#L89](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L89) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [exception_list_item_schema.test.ts#L103](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L103) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [exception_list_item_schema.test.ts#L117](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L117) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [exception_list_item_schema.test.ts#L129](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L129) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [exception_list_item_schema.test.ts#L142](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L142) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [exception_list_item_schema.test.ts#L154](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L154) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [exception_list_item_schema.test.ts#L168](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L168) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [exception_list_item_schema.test.ts#L182](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L182) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [exception_list_item_schema.test.ts#L196](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L196) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [exception_list_item_schema.test.ts#L210](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L210) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [exception_list_item_schema.test.ts#L224](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L224) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [exception_list_item_schema.test.ts#L238](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L238) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [exception_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [exception_list_schema.test.ts#L23](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L23) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [exception_list_schema.test.ts#L35](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L35) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [exception_list_schema.test.ts#L47](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L47) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [exception_list_schema.test.ts#L61](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L61) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [exception_list_schema.test.ts#L75](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L75) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [exception_list_schema.test.ts#L87](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L87) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [exception_list_schema.test.ts#L100](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L100) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [exception_list_schema.test.ts#L112](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L112) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [exception_list_schema.test.ts#L126](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L126) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [exception_list_schema.test.ts#L140](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L140) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [exception_list_schema.test.ts#L154](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L154) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [exception_list_schema.test.ts#L168](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L168) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [exception_list_schema.test.ts#L182](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L182) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [exception_list_schema.test.ts#L196](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L196) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [found_exception_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [found_exception_list_item_schema.test.ts#L28](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts#L28) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [found_exception_list_item_schema.test.ts#L47](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts#L47) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [found_exception_list_item_schema.test.ts#L61](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts#L61) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [found_exception_list_item_schema.test.ts#L73](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts#L73) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [found_exception_list_item_schema.test.ts#L85](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts#L85) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [found_exception_list_item_schema.test.ts#L97](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts#L97) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [found_exception_list_item_schema.test.ts#L111](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts#L111) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [found_exception_list_item_schema.test.ts#L125](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts#L125) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [found_exception_list_item_schema.test.ts#L139](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts#L139) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [found_exception_list_item_schema.test.ts#L153](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts#L153) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [found_exception_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [found_exception_list_schema.test.ts#L25](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts#L25) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [found_exception_list_schema.test.ts#L44](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts#L44) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [found_exception_list_schema.test.ts#L58](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts#L58) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [found_exception_list_schema.test.ts#L70](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts#L70) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [found_exception_list_schema.test.ts#L82](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts#L82) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [found_exception_list_schema.test.ts#L94](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts#L94) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [found_exception_list_schema.test.ts#L108](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts#L108) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [found_exception_list_schema.test.ts#L122](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts#L122) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [found_exception_list_schema.test.ts#L136](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts#L136) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [found_exception_list_schema.test.ts#L150](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts#L150) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [list_item_index_exist_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_index_exist_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [list_item_index_exist_schema.test.ts#L23](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_index_exist_schema.test.ts#L23) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [list_item_index_exist_schema.test.ts#L35](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_index_exist_schema.test.ts#L35) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [list_item_index_exist_schema.test.ts#L49](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_index_exist_schema.test.ts#L49) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [list_item_index_exist_schema.test.ts#L63](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_index_exist_schema.test.ts#L63) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [list_item_schema.test.ts#L23](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L23) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [list_item_schema.test.ts#L35](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L35) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [list_item_schema.test.ts#L47](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L47) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [list_item_schema.test.ts#L60](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L60) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [list_item_schema.test.ts#L71](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L71) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [list_item_schema.test.ts#L82](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L82) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [list_item_schema.test.ts#L94](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L94) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [list_item_schema.test.ts#L108](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L108) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [list_item_schema.test.ts#L122](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L122) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [list_item_schema.test.ts#L136](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L136) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [list_item_schema.test.ts#L150](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L150) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [list_item_schema.test.ts#L164](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L164) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [list_item_schema.test.ts#L178](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L178) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [list_item_schema.test.ts#L190](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L190) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [list_schema.test.ts#L23](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L23) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [list_schema.test.ts#L35](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L35) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [list_schema.test.ts#L46](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L46) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [list_schema.test.ts#L57](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L57) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [list_schema.test.ts#L68](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L68) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [list_schema.test.ts#L80](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L80) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [list_schema.test.ts#L94](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L94) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [list_schema.test.ts#L108](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L108) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [list_schema.test.ts#L122](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L122) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [list_schema.test.ts#L136](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L136) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [list_schema.test.ts#L150](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L150) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [list_schema.test.ts#L164](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L164) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [list_schema.test.ts#L178](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L178) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [list_schema.test.ts#L190](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L190) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [search_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/search_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [search_list_item_schema.test.ts#L23](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/search_list_item_schema.test.ts#L23) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [search_list_item_schema.test.ts#L34](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/search_list_item_schema.test.ts#L34) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [search_list_item_schema.test.ts#L46](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/search_list_item_schema.test.ts#L46) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [comment.test.ts#L12](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/comment.test.ts#L12) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [comment.test.ts#L31](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/comment.test.ts#L31) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [comment.test.ts#L42](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/comment.test.ts#L42) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [comment.test.ts#L53](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/comment.test.ts#L53) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [comment.test.ts#L62](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/comment.test.ts#L62) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [comment.test.ts#L76](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/comment.test.ts#L76) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [comment.test.ts#L88](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/comment.test.ts#L88) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [comment.test.ts#L102](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/comment.test.ts#L102) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [comment.test.ts#L116](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/comment.test.ts#L116) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [comment.test.ts#L130](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/comment.test.ts#L130) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [comment.test.ts#L144](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/comment.test.ts#L144) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [comment.test.ts#L158](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/comment.test.ts#L158) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [comment.test.ts#L169](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/comment.test.ts#L169) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [comment.test.ts#L181](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/comment.test.ts#L181) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [comment.test.ts#L190](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/comment.test.ts#L190) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [comment.test.ts#L201](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/comment.test.ts#L201) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [comment.test.ts#L214](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/comment.test.ts#L214) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [comment.test.ts#L223](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/comment.test.ts#L223) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [comment.test.ts#L232](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/comment.test.ts#L232) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_comment.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/create_comment.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_comment.test.ts#L30](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/create_comment.test.ts#L30) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_comment.test.ts#L39](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/create_comment.test.ts#L39) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_comment.test.ts#L53](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/create_comment.test.ts#L53) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_comment.test.ts#L67](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/create_comment.test.ts#L67) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_comment.test.ts#L78](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/create_comment.test.ts#L78) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_comment.test.ts#L87](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/create_comment.test.ts#L87) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_comment.test.ts#L98](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/create_comment.test.ts#L98) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_comment.test.ts#L111](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/create_comment.test.ts#L111) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_comment.test.ts#L120](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/create_comment.test.ts#L120) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [create_comment.test.ts#L129](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/create_comment.test.ts#L129) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [default_comments_array.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_comments_array.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [default_comments_array.test.ts#L23](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_comments_array.test.ts#L23) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [default_comments_array.test.ts#L32](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_comments_array.test.ts#L32) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [default_comments_array.test.ts#L41](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_comments_array.test.ts#L41) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [default_comments_array.test.ts#L52](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_comments_array.test.ts#L52) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [default_comments_array.test.ts#L63](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_comments_array.test.ts#L63) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [default_create_comments_array.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_create_comments_array.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [default_create_comments_array.test.ts#L24](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_create_comments_array.test.ts#L24) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [default_create_comments_array.test.ts#L33](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_create_comments_array.test.ts#L33) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [default_create_comments_array.test.ts#L43](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_create_comments_array.test.ts#L43) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [default_create_comments_array.test.ts#L56](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_create_comments_array.test.ts#L56) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [default_create_comments_array.test.ts#L67](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_create_comments_array.test.ts#L67) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [default_create_comments_array.test.ts#L78](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_create_comments_array.test.ts#L78) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [default_namespace.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_namespace.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [default_namespace.test.ts#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_namespace.test.ts#L21) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [default_namespace.test.ts#L30](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_namespace.test.ts#L30) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [default_namespace.test.ts#L39](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_namespace.test.ts#L39) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [default_namespace.test.ts#L48](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_namespace.test.ts#L48) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [default_namespace.test.ts#L57](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_namespace.test.ts#L57) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [default_namespace_array.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_namespace_array.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [default_namespace_array.test.ts#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_namespace_array.test.ts#L21) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [default_namespace_array.test.ts#L30](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_namespace_array.test.ts#L30) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [default_namespace_array.test.ts#L41](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_namespace_array.test.ts#L41) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [default_namespace_array.test.ts#L50](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_namespace_array.test.ts#L50) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [default_namespace_array.test.ts#L59](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_namespace_array.test.ts#L59) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [default_namespace_array.test.ts#L68](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_namespace_array.test.ts#L68) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [default_namespace_array.test.ts#L77](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_namespace_array.test.ts#L77) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [default_namespace_array.test.ts#L86](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_namespace_array.test.ts#L86) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [default_namespace_array.test.ts#L95](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_namespace_array.test.ts#L95) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [default_update_comments_array.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_update_comments_array.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [default_update_comments_array.test.ts#L23](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_update_comments_array.test.ts#L23) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [default_update_comments_array.test.ts#L32](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_update_comments_array.test.ts#L32) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [default_update_comments_array.test.ts#L41](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_update_comments_array.test.ts#L41) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [default_update_comments_array.test.ts#L52](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_update_comments_array.test.ts#L52) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [default_update_comments_array.test.ts#L63](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_update_comments_array.test.ts#L63) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [empty_string_array.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/empty_string_array.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [empty_string_array.test.ts#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/empty_string_array.test.ts#L21) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [empty_string_array.test.ts#L30](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/empty_string_array.test.ts#L30) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [empty_string_array.test.ts#L39](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/empty_string_array.test.ts#L39) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [empty_string_array.test.ts#L48](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/empty_string_array.test.ts#L48) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [empty_string_array.test.ts#L57](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/empty_string_array.test.ts#L57) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [empty_string_array.test.ts#L66](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/empty_string_array.test.ts#L66) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [empty_string_array.test.ts#L77](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/empty_string_array.test.ts#L77) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entries.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entries.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entries.test.ts#L28](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entries.test.ts#L28) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entries.test.ts#L37](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entries.test.ts#L37) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entries.test.ts#L46](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entries.test.ts#L46) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entries.test.ts#L55](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entries.test.ts#L55) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entries.test.ts#L64](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entries.test.ts#L64) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entries.test.ts#L80](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entries.test.ts#L80) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entries.test.ts#L89](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entries.test.ts#L89) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entries.test.ts#L98](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entries.test.ts#L98) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entries.test.ts#L107](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entries.test.ts#L107) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entries.test.ts#L116](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entries.test.ts#L116) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entries.test.ts#L125](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entries.test.ts#L125) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entries.test.ts#L136](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entries.test.ts#L136) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entries.test.ts#L145](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entries.test.ts#L145) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_exists.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_exists.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_exists.test.ts#L22](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_exists.test.ts#L22) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_exists.test.ts#L31](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_exists.test.ts#L31) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_exists.test.ts#L41](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_exists.test.ts#L41) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_exists.test.ts#L53](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_exists.test.ts#L53) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_exists.test.ts#L65](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_exists.test.ts#L65) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_exists.test.ts#L77](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_exists.test.ts#L77) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_list.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_list.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_list.test.ts#L22](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_list.test.ts#L22) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_list.test.ts#L31](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_list.test.ts#L31) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_list.test.ts#L41](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_list.test.ts#L41) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_list.test.ts#L53](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_list.test.ts#L53) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_list.test.ts#L67](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_list.test.ts#L67) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_list.test.ts#L79](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_list.test.ts#L79) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_list.test.ts#L93](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_list.test.ts#L93) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match.test.ts#L22](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match.test.ts#L22) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match.test.ts#L31](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match.test.ts#L31) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match.test.ts#L41](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match.test.ts#L41) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match.test.ts#L53](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match.test.ts#L53) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match.test.ts#L65](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match.test.ts#L65) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match.test.ts#L79](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match.test.ts#L79) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match.test.ts#L91](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match.test.ts#L91) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match.test.ts#L105](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match.test.ts#L105) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match_any.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match_any.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match_any.test.ts#L22](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match_any.test.ts#L22) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match_any.test.ts#L31](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match_any.test.ts#L31) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match_any.test.ts#L41](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match_any.test.ts#L41) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match_any.test.ts#L53](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match_any.test.ts#L53) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match_any.test.ts#L65](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match_any.test.ts#L65) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match_any.test.ts#L77](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match_any.test.ts#L77) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match_any.test.ts#L91](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match_any.test.ts#L91) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match_any.test.ts#L103](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match_any.test.ts#L103) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match_wildcard.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match_wildcard.test.ts#L22](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.test.ts#L22) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match_wildcard.test.ts#L31](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.test.ts#L31) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match_wildcard.test.ts#L41](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.test.ts#L41) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match_wildcard.test.ts#L53](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.test.ts#L53) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match_wildcard.test.ts#L65](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.test.ts#L65) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match_wildcard.test.ts#L79](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.test.ts#L79) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match_wildcard.test.ts#L91](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.test.ts#L91) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match_wildcard.test.ts#L103](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.test.ts#L103) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_nested.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_nested.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_nested.test.ts#L24](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_nested.test.ts#L24) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_nested.test.ts#L36](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_nested.test.ts#L36) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_nested.test.ts#L47](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_nested.test.ts#L47) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_nested.test.ts#L58](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_nested.test.ts#L58) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_nested.test.ts#L69](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_nested.test.ts#L69) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_nested.test.ts#L80](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_nested.test.ts#L80) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_nested.test.ts#L100](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_nested.test.ts#L100) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_nested.test.ts#L122](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_nested.test.ts#L122) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [non_empty_entries_array.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [non_empty_entries_array.test.ts#L31](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts#L31) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [non_empty_entries_array.test.ts#L42](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts#L42) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [non_empty_entries_array.test.ts#L53](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts#L53) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [non_empty_entries_array.test.ts#L64](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts#L64) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [non_empty_entries_array.test.ts#L73](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts#L73) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [non_empty_entries_array.test.ts#L82](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts#L82) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [non_empty_entries_array.test.ts#L91](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts#L91) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [non_empty_entries_array.test.ts#L100](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts#L100) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [non_empty_entries_array.test.ts#L109](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts#L109) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [non_empty_entries_array.test.ts#L118](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts#L118) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [non_empty_entries_array.test.ts#L127](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts#L127) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [non_empty_nested_entries_array.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [non_empty_nested_entries_array.test.ts#L26](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts#L26) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [non_empty_nested_entries_array.test.ts#L37](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts#L37) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [non_empty_nested_entries_array.test.ts#L48](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts#L48) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [non_empty_nested_entries_array.test.ts#L59](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts#L59) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [non_empty_nested_entries_array.test.ts#L68](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts#L68) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [non_empty_nested_entries_array.test.ts#L77](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts#L77) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [non_empty_nested_entries_array.test.ts#L86](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts#L86) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [non_empty_nested_entries_array.test.ts#L103](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts#L103) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [non_empty_nested_entries_array.test.ts#L112](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts#L112) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [non_empty_or_nullable_string_array.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_or_nullable_string_array.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [non_empty_or_nullable_string_array.test.ts#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_or_nullable_string_array.test.ts#L21) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [non_empty_or_nullable_string_array.test.ts#L32](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_or_nullable_string_array.test.ts#L32) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [non_empty_or_nullable_string_array.test.ts#L43](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_or_nullable_string_array.test.ts#L43) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [non_empty_or_nullable_string_array.test.ts#L54](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_or_nullable_string_array.test.ts#L54) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [non_empty_or_nullable_string_array.test.ts#L65](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_or_nullable_string_array.test.ts#L65) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [non_empty_string_array.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_string_array.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [non_empty_string_array.test.ts#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_string_array.test.ts#L21) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [non_empty_string_array.test.ts#L32](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_string_array.test.ts#L32) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [non_empty_string_array.test.ts#L43](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_string_array.test.ts#L43) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [non_empty_string_array.test.ts#L54](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_string_array.test.ts#L54) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [non_empty_string_array.test.ts#L63](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_string_array.test.ts#L63) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [non_empty_string_array.test.ts#L72](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_string_array.test.ts#L72) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [non_empty_string_array.test.ts#L81](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_string_array.test.ts#L81) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [non_empty_string_array.test.ts#L92](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_string_array.test.ts#L92) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_comment.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/update_comment.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_comment.test.ts#L30](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/update_comment.test.ts#L30) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_comment.test.ts#L41](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/update_comment.test.ts#L41) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_comment.test.ts#L52](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/update_comment.test.ts#L52) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_comment.test.ts#L62](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/update_comment.test.ts#L62) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_comment.test.ts#L71](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/update_comment.test.ts#L71) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_comment.test.ts#L82](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/update_comment.test.ts#L82) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_comment.test.ts#L93](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/update_comment.test.ts#L93) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_comment.test.ts#L102](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/update_comment.test.ts#L102) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_comment.test.ts#L113](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/update_comment.test.ts#L113) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_comment.test.ts#L126](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/update_comment.test.ts#L126) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_comment.test.ts#L135](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/update_comment.test.ts#L135) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [update_comment.test.ts#L144](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/update_comment.test.ts#L144) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entries.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entries.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entries.test.ts#L32](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entries.test.ts#L32) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entries.test.ts#L41](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entries.test.ts#L41) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entries.test.ts#L50](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entries.test.ts#L50) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entries.test.ts#L73](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entries.test.ts#L73) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entries.test.ts#L86](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entries.test.ts#L86) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entries.test.ts#L99](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entries.test.ts#L99) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entries.test.ts#L108](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entries.test.ts#L108) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_match.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match.test.ts#L23](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_match.test.ts#L23) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match.test.ts#L34](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_match.test.ts#L34) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match.test.ts#L48](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_match.test.ts#L48) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match.test.ts#L60](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_match.test.ts#L60) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match.test.ts#L74](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_match.test.ts#L74) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match.test.ts#L86](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_match.test.ts#L86) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match.test.ts#L100](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_match.test.ts#L100) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match_any.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_any.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match_any.test.ts#L23](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_any.test.ts#L23) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match_any.test.ts#L34](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_any.test.ts#L34) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match_any.test.ts#L48](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_any.test.ts#L48) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match_any.test.ts#L60](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_any.test.ts#L60) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match_any.test.ts#L72](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_any.test.ts#L72) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match_any.test.ts#L86](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_any.test.ts#L86) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_match_any.test.ts#L98](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_any.test.ts#L98) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_nested.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_nested.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_nested.test.ts#L29](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_nested.test.ts#L29) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_nested.test.ts#L41](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_nested.test.ts#L41) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_nested.test.ts#L52](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_nested.test.ts#L52) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_nested.test.ts#L63](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_nested.test.ts#L63) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_nested.test.ts#L74](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_nested.test.ts#L74) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_nested.test.ts#L85](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_nested.test.ts#L85) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_nested.test.ts#L105](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_nested.test.ts#L105) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.getPaths" text="getPaths"/> | [entry_nested.test.ts#L120](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_nested.test.ts#L120) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [shared_imports.ts#L19](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/shared_imports.ts#L19) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [schemas.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [schemas.test.ts#L41](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L41) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [schemas.test.ts#L50](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L50) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [schemas.test.ts#L73](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L73) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [schemas.test.ts#L82](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L82) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [schemas.test.ts#L106](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L106) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [schemas.test.ts#L115](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L115) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [schemas.test.ts#L128](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L128) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [schemas.test.ts#L141](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L141) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [schemas.test.ts#L152](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L152) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [schemas.test.ts#L164](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L164) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [schemas.test.ts#L173](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L173) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [schemas.test.ts#L185](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L185) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [schemas.test.ts#L194](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L194) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [schemas.test.ts#L206](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L206) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [schemas.test.ts#L215](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L215) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [schemas.test.ts#L227](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L227) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [schemas.test.ts#L236](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L236) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [schemas.test.ts#L245](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L245) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [schemas.test.ts#L257](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L257) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [schemas.test.ts#L266](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L266) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [schemas.test.ts#L278](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L278) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [schemas.test.ts#L289](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L289) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [schemas.test.ts#L302](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L302) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [schemas.test.ts#L313](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L313) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [schemas.test.ts#L322](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L322) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [schemas.test.ts#L334](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L334) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [schemas.test.ts#L345](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L345) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [schemas.test.ts#L357](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L357) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [schemas.test.ts#L368](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L368) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [schemas.test.ts#L380](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L380) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [schemas.test.ts#L391](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L391) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [schemas.test.ts#L400](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L400) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [schemas.test.ts#L411](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/common/schemas.test.ts#L411) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [search_es_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [search_es_list_item_schema.test.ts#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_item_schema.test.ts#L21) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [search_es_list_item_schema.test.ts#L33](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_item_schema.test.ts#L33) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [search_es_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [search_es_list_schema.test.ts#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_schema.test.ts#L21) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [search_es_list_schema.test.ts#L33](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_schema.test.ts#L33) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_endpoint_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_endpoint_list_item_schema.test.ts#L27](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L27) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_endpoint_list_item_schema.test.ts#L39](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L39) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_endpoint_list_item_schema.test.ts#L52](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L52) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_endpoint_list_item_schema.test.ts#L65](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L65) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_endpoint_list_item_schema.test.ts#L79](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L79) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_endpoint_list_item_schema.test.ts#L91](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L91) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_endpoint_list_item_schema.test.ts#L103](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L103) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_endpoint_list_item_schema.test.ts#L116](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L116) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_endpoint_list_item_schema.test.ts#L129](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L129) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_endpoint_list_item_schema.test.ts#L144](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L144) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_endpoint_list_item_schema.test.ts#L157](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L157) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_endpoint_list_item_schema.test.ts#L172](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L172) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_endpoint_list_item_schema.test.ts#L183](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L183) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_endpoint_list_item_schema.test.ts#L195](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L195) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_endpoint_list_item_schema.test.ts#L206](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts#L206) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_exception_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_exception_list_item_schema.test.ts#L27](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L27) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_exception_list_item_schema.test.ts#L39](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L39) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_exception_list_item_schema.test.ts#L52](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L52) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_exception_list_item_schema.test.ts#L65](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L65) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_exception_list_item_schema.test.ts#L78](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L78) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_exception_list_item_schema.test.ts#L92](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L92) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_exception_list_item_schema.test.ts#L105](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L105) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_exception_list_item_schema.test.ts#L118](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L118) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_exception_list_item_schema.test.ts#L133](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L133) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_exception_list_item_schema.test.ts#L146](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L146) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_exception_list_item_schema.test.ts#L161](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L161) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_exception_list_item_schema.test.ts#L174](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L174) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_exception_list_item_schema.test.ts#L185](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L185) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_exception_list_item_schema.test.ts#L197](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L197) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_exception_list_item_schema.test.ts#L209](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts#L209) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_exception_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_exception_list_schema.test.ts#L24](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.test.ts#L24) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_exception_list_schema.test.ts#L35](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.test.ts#L35) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_exception_list_schema.test.ts#L48](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.test.ts#L48) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_exception_list_schema.test.ts#L59](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.test.ts#L59) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_exception_list_schema.test.ts#L71](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.test.ts#L71) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_exception_list_schema.test.ts#L83](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.test.ts#L83) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_list_item_schema.test.ts#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_list_item_schema.test.ts#L21) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_list_item_schema.test.ts#L32](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_list_item_schema.test.ts#L32) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_list_item_schema.test.ts#L43](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_list_item_schema.test.ts#L43) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_list_item_schema.test.ts#L54](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_list_item_schema.test.ts#L54) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_list_schema.test.ts#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts#L21) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_list_schema.test.ts#L32](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts#L32) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_list_schema.test.ts#L42](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts#L42) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_list_schema.test.ts#L52](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts#L52) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_list_schema.test.ts#L62](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts#L62) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_list_schema.test.ts#L72](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts#L72) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [delete_endpoint_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_endpoint_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [delete_endpoint_list_item_schema.test.ts#L24](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_endpoint_list_item_schema.test.ts#L24) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [delete_endpoint_list_item_schema.test.ts#L38](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_endpoint_list_item_schema.test.ts#L38) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [delete_endpoint_list_item_schema.test.ts#L49](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_endpoint_list_item_schema.test.ts#L49) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [delete_exception_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_exception_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [delete_exception_list_item_schema.test.ts#L24](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_exception_list_item_schema.test.ts#L24) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [delete_exception_list_item_schema.test.ts#L35](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_exception_list_item_schema.test.ts#L35) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [delete_exception_list_item_schema.test.ts#L47](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_exception_list_item_schema.test.ts#L47) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [delete_exception_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_exception_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [delete_exception_list_schema.test.ts#L24](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_exception_list_schema.test.ts#L24) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [delete_exception_list_schema.test.ts#L35](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_exception_list_schema.test.ts#L35) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [delete_exception_list_schema.test.ts#L47](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_exception_list_schema.test.ts#L47) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [delete_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [delete_list_item_schema.test.ts#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_list_item_schema.test.ts#L21) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [delete_list_item_schema.test.ts#L33](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_list_item_schema.test.ts#L33) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [delete_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [delete_list_schema.test.ts#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_list_schema.test.ts#L21) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [delete_list_schema.test.ts#L33](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_list_schema.test.ts#L33) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [delete_list_schema.test.ts#L43](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/delete_list_schema.test.ts#L43) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [export_exception_list_query_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/export_exception_list_query_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [export_exception_list_query_schema.test.ts#L24](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/export_exception_list_query_schema.test.ts#L24) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [export_exception_list_query_schema.test.ts#L36](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/export_exception_list_query_schema.test.ts#L36) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [export_exception_list_query_schema.test.ts#L47](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/export_exception_list_query_schema.test.ts#L47) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [export_exception_list_query_schema.test.ts#L62](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/export_exception_list_query_schema.test.ts#L62) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [export_exception_list_query_schema.test.ts#L77](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/export_exception_list_query_schema.test.ts#L77) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [export_list_item_query_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/export_list_item_query_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [export_list_item_query_schema.test.ts#L24](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/export_list_item_query_schema.test.ts#L24) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [export_list_item_query_schema.test.ts#L36](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/export_list_item_query_schema.test.ts#L36) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [export_list_item_query_schema.test.ts#L50](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/export_list_item_query_schema.test.ts#L50) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_endpoint_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_endpoint_list_item_schema.test.ts#L27](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts#L27) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_endpoint_list_item_schema.test.ts#L36](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts#L36) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_endpoint_list_item_schema.test.ts#L46](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts#L46) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_endpoint_list_item_schema.test.ts#L58](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts#L58) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_endpoint_list_item_schema.test.ts#L70](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts#L70) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_endpoint_list_item_schema.test.ts#L82](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts#L82) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_endpoint_list_item_schema.test.ts#L94](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts#L94) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_endpoint_list_item_schema.test.ts#L107](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts#L107) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_exception_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_exception_list_item_schema.test.ts#L31](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts#L31) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_exception_list_item_schema.test.ts#L40](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts#L40) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_exception_list_item_schema.test.ts#L49](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts#L49) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_exception_list_item_schema.test.ts#L68](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts#L68) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_exception_list_item_schema.test.ts#L80](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts#L80) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_exception_list_item_schema.test.ts#L92](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts#L92) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_exception_list_item_schema.test.ts#L106](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts#L106) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_exception_list_item_schema.test.ts#L118](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts#L118) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_exception_list_item_schema.test.ts#L131](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts#L131) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_exception_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_exception_list_schema.test.ts#L28](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts#L28) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_exception_list_schema.test.ts#L37](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts#L37) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_exception_list_schema.test.ts#L55](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts#L55) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_exception_list_schema.test.ts#L67](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts#L67) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_exception_list_schema.test.ts#L79](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts#L79) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_exception_list_schema.test.ts#L91](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts#L91) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_exception_list_schema.test.ts#L103](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts#L103) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_exception_list_schema.test.ts#L116](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts#L116) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_list_item_schema.test.ts#L29](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts#L29) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_list_item_schema.test.ts#L38](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts#L38) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_list_item_schema.test.ts#L57](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts#L57) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_list_item_schema.test.ts#L69](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts#L69) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_list_item_schema.test.ts#L81](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts#L81) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_list_item_schema.test.ts#L93](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts#L93) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_list_item_schema.test.ts#L106](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts#L106) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_list_schema.test.ts#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts#L21) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_list_schema.test.ts#L30](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts#L30) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_list_schema.test.ts#L40](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts#L40) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_list_schema.test.ts#L52](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts#L52) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_list_schema.test.ts#L64](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts#L64) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_list_schema.test.ts#L76](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts#L76) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_list_schema.test.ts#L88](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts#L88) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [find_list_schema.test.ts#L101](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts#L101) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [import_list_item_query_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [import_list_item_query_schema.test.ts#L24](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts#L24) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [import_list_item_query_schema.test.ts#L35](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts#L35) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [import_list_item_query_schema.test.ts#L45](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts#L45) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [import_list_item_query_schema.test.ts#L56](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts#L56) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [import_list_item_query_schema.test.ts#L66](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts#L66) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [import_list_item_query_schema.test.ts#L76](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts#L76) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [import_list_item_query_schema.test.ts#L88](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts#L88) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [import_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/import_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [import_list_item_schema.test.ts#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/import_list_item_schema.test.ts#L21) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [import_list_item_schema.test.ts#L33](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/import_list_item_schema.test.ts#L33) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [import_list_item_schema.test.ts#L47](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/import_list_item_schema.test.ts#L47) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [patch_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [patch_list_item_schema.test.ts#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts#L21) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [patch_list_item_schema.test.ts#L33](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts#L33) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [patch_list_item_schema.test.ts#L44](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts#L44) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [patch_list_item_schema.test.ts#L55](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts#L55) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [patch_list_item_schema.test.ts#L67](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts#L67) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [patch_list_item_schema.test.ts#L78](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts#L78) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [patch_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [patch_list_schema.test.ts#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts#L21) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [patch_list_schema.test.ts#L33](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts#L33) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [patch_list_schema.test.ts#L44](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts#L44) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [patch_list_schema.test.ts#L55](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts#L55) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [patch_list_schema.test.ts#L66](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts#L66) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [patch_list_schema.test.ts#L79](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts#L79) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [patch_list_schema.test.ts#L91](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts#L91) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [patch_list_schema.test.ts#L103](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts#L103) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [patch_list_schema.test.ts#L115](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts#L115) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [patch_list_schema.test.ts#L126](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts#L126) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [read_endpoint_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [read_endpoint_list_item_schema.test.ts#L24](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts#L24) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [read_endpoint_list_item_schema.test.ts#L35](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts#L35) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [read_endpoint_list_item_schema.test.ts#L46](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts#L46) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [read_endpoint_list_item_schema.test.ts#L60](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts#L60) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [read_endpoint_list_item_schema.test.ts#L72](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts#L72) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [read_endpoint_list_item_schema.test.ts#L85](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts#L85) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [read_exception_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [read_exception_list_item_schema.test.ts#L24](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts#L24) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [read_exception_list_item_schema.test.ts#L35](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts#L35) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [read_exception_list_item_schema.test.ts#L46](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts#L46) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [read_exception_list_item_schema.test.ts#L57](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts#L57) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [read_exception_list_item_schema.test.ts#L73](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts#L73) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [read_exception_list_item_schema.test.ts#L85](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts#L85) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [read_exception_list_item_schema.test.ts#L99](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts#L99) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [read_exception_list_item_schema.test.ts#L113](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts#L113) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [read_exception_list_item_schema.test.ts#L126](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts#L126) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [read_exception_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [read_exception_list_schema.test.ts#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts#L21) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [read_exception_list_schema.test.ts#L32](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts#L32) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [read_exception_list_schema.test.ts#L43](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts#L43) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [read_exception_list_schema.test.ts#L54](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts#L54) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [read_exception_list_schema.test.ts#L70](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts#L70) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [read_exception_list_schema.test.ts#L82](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts#L82) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [read_exception_list_schema.test.ts#L96](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts#L96) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [read_exception_list_schema.test.ts#L110](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts#L110) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [read_exception_list_schema.test.ts#L123](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts#L123) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [read_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [read_list_item_schema.test.ts#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts#L21) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [read_list_item_schema.test.ts#L32](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts#L32) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [read_list_item_schema.test.ts#L43](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts#L43) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [read_list_item_schema.test.ts#L54](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts#L54) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [read_list_item_schema.test.ts#L67](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts#L67) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [read_list_item_schema.test.ts#L79](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts#L79) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [read_list_item_schema.test.ts#L91](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts#L91) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [read_list_item_schema.test.ts#L103](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts#L103) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [read_list_item_schema.test.ts#L114](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts#L114) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [read_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [read_list_schema.test.ts#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_schema.test.ts#L21) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [read_list_schema.test.ts#L33](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_schema.test.ts#L33) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [read_list_schema.test.ts#L44](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/read_list_schema.test.ts#L44) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_endpoint_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_endpoint_list_item_schema.test.ts#L24](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts#L24) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_endpoint_list_item_schema.test.ts#L35](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts#L35) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_endpoint_list_item_schema.test.ts#L48](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts#L48) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_endpoint_list_item_schema.test.ts#L61](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts#L61) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_endpoint_list_item_schema.test.ts#L75](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts#L75) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_endpoint_list_item_schema.test.ts#L86](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts#L86) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_endpoint_list_item_schema.test.ts#L99](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts#L99) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_endpoint_list_item_schema.test.ts#L112](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts#L112) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_endpoint_list_item_schema.test.ts#L126](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts#L126) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_endpoint_list_item_schema.test.ts#L138](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts#L138) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_exception_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_exception_list_item_schema.test.ts#L24](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts#L24) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_exception_list_item_schema.test.ts#L35](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts#L35) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_exception_list_item_schema.test.ts#L48](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts#L48) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_exception_list_item_schema.test.ts#L61](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts#L61) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_exception_list_item_schema.test.ts#L75](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts#L75) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_exception_list_item_schema.test.ts#L86](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts#L86) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_exception_list_item_schema.test.ts#L99](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts#L99) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_exception_list_item_schema.test.ts#L112](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts#L112) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_exception_list_item_schema.test.ts#L126](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts#L126) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_exception_list_item_schema.test.ts#L138](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts#L138) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_exception_list_item_schema.test.ts#L148](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts#L148) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_exception_list_item_schema.test.ts#L160](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts#L160) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_exception_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_exception_list_schema.test.ts#L24](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts#L24) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_exception_list_schema.test.ts#L35](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts#L35) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_exception_list_schema.test.ts#L48](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts#L48) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_exception_list_schema.test.ts#L61](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts#L61) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_exception_list_schema.test.ts#L74](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts#L74) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_exception_list_schema.test.ts#L87](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts#L87) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_exception_list_schema.test.ts#L99](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts#L99) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_exception_list_schema.test.ts#L109](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts#L109) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_exception_list_schema.test.ts#L121](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts#L121) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_list_item_schema.test.ts#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_list_item_schema.test.ts#L21) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_list_item_schema.test.ts#L32](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_list_item_schema.test.ts#L32) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_list_item_schema.test.ts#L45](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_list_item_schema.test.ts#L45) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_list_schema.test.ts#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_list_schema.test.ts#L21) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_list_schema.test.ts#L32](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_list_schema.test.ts#L32) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_list_schema.test.ts#L45](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/request/update_list_schema.test.ts#L45) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [acknowledge_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/acknowledge_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [acknowledge_schema.test.ts#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/acknowledge_schema.test.ts#L21) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [acknowledge_schema.test.ts#L32](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/acknowledge_schema.test.ts#L32) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [acknowledge_schema.test.ts#L45](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/acknowledge_schema.test.ts#L45) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_endpoint_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_endpoint_list_schema.test.ts#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts#L21) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_endpoint_list_schema.test.ts#L31](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts#L31) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_endpoint_list_schema.test.ts#L43](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts#L43) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_endpoint_list_schema.test.ts#L57](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts#L57) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_endpoint_list_schema.test.ts#L70](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts#L70) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [exception_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [exception_list_item_schema.test.ts#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L21) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [exception_list_item_schema.test.ts#L33](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L33) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [exception_list_item_schema.test.ts#L45](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L45) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [exception_list_item_schema.test.ts#L59](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L59) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [exception_list_item_schema.test.ts#L73](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L73) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [exception_list_item_schema.test.ts#L87](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L87) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [exception_list_item_schema.test.ts#L101](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L101) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [exception_list_item_schema.test.ts#L115](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L115) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [exception_list_item_schema.test.ts#L127](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L127) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [exception_list_item_schema.test.ts#L140](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L140) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [exception_list_item_schema.test.ts#L152](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L152) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [exception_list_item_schema.test.ts#L166](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L166) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [exception_list_item_schema.test.ts#L180](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L180) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [exception_list_item_schema.test.ts#L194](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L194) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [exception_list_item_schema.test.ts#L208](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L208) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [exception_list_item_schema.test.ts#L222](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L222) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [exception_list_item_schema.test.ts#L237](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts#L237) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [exception_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [exception_list_schema.test.ts#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L21) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [exception_list_schema.test.ts#L33](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L33) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [exception_list_schema.test.ts#L45](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L45) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [exception_list_schema.test.ts#L59](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L59) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [exception_list_schema.test.ts#L73](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L73) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [exception_list_schema.test.ts#L85](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L85) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [exception_list_schema.test.ts#L98](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L98) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [exception_list_schema.test.ts#L110](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L110) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [exception_list_schema.test.ts#L124](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L124) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [exception_list_schema.test.ts#L138](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L138) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [exception_list_schema.test.ts#L152](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L152) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [exception_list_schema.test.ts#L166](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L166) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [exception_list_schema.test.ts#L180](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L180) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [exception_list_schema.test.ts#L195](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts#L195) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [found_exception_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [found_exception_list_item_schema.test.ts#L26](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts#L26) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [found_exception_list_item_schema.test.ts#L45](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts#L45) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [found_exception_list_item_schema.test.ts#L59](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts#L59) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [found_exception_list_item_schema.test.ts#L71](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts#L71) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [found_exception_list_item_schema.test.ts#L83](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts#L83) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [found_exception_list_item_schema.test.ts#L95](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts#L95) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [found_exception_list_item_schema.test.ts#L109](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts#L109) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [found_exception_list_item_schema.test.ts#L123](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts#L123) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [found_exception_list_item_schema.test.ts#L137](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts#L137) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [found_exception_list_item_schema.test.ts#L152](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts#L152) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [found_exception_list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [found_exception_list_schema.test.ts#L23](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts#L23) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [found_exception_list_schema.test.ts#L42](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts#L42) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [found_exception_list_schema.test.ts#L56](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts#L56) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [found_exception_list_schema.test.ts#L68](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts#L68) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [found_exception_list_schema.test.ts#L80](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts#L80) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [found_exception_list_schema.test.ts#L92](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts#L92) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [found_exception_list_schema.test.ts#L106](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts#L106) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [found_exception_list_schema.test.ts#L120](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts#L120) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [found_exception_list_schema.test.ts#L134](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts#L134) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [found_exception_list_schema.test.ts#L149](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts#L149) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [list_item_index_exist_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_index_exist_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [list_item_index_exist_schema.test.ts#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_index_exist_schema.test.ts#L21) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [list_item_index_exist_schema.test.ts#L33](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_index_exist_schema.test.ts#L33) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [list_item_index_exist_schema.test.ts#L47](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_index_exist_schema.test.ts#L47) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [list_item_index_exist_schema.test.ts#L62](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_index_exist_schema.test.ts#L62) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [list_item_schema.test.ts#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L21) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [list_item_schema.test.ts#L33](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L33) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [list_item_schema.test.ts#L45](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L45) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [list_item_schema.test.ts#L58](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L58) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [list_item_schema.test.ts#L69](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L69) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [list_item_schema.test.ts#L80](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L80) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [list_item_schema.test.ts#L92](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L92) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [list_item_schema.test.ts#L106](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L106) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [list_item_schema.test.ts#L120](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L120) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [list_item_schema.test.ts#L134](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L134) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [list_item_schema.test.ts#L148](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L148) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [list_item_schema.test.ts#L162](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L162) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [list_item_schema.test.ts#L176](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L176) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [list_item_schema.test.ts#L189](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts#L189) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [list_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [list_schema.test.ts#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L21) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [list_schema.test.ts#L33](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L33) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [list_schema.test.ts#L44](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L44) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [list_schema.test.ts#L55](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L55) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [list_schema.test.ts#L66](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L66) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [list_schema.test.ts#L78](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L78) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [list_schema.test.ts#L92](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L92) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [list_schema.test.ts#L106](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L106) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [list_schema.test.ts#L120](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L120) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [list_schema.test.ts#L134](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L134) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [list_schema.test.ts#L148](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L148) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [list_schema.test.ts#L162](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L162) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [list_schema.test.ts#L176](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L176) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [list_schema.test.ts#L189](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/list_schema.test.ts#L189) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [search_list_item_schema.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/search_list_item_schema.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [search_list_item_schema.test.ts#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/search_list_item_schema.test.ts#L21) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [search_list_item_schema.test.ts#L32](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/search_list_item_schema.test.ts#L32) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [search_list_item_schema.test.ts#L45](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/response/search_list_item_schema.test.ts#L45) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [comment.test.ts#L12](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/comment.test.ts#L12) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [comment.test.ts#L29](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/comment.test.ts#L29) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [comment.test.ts#L40](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/comment.test.ts#L40) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [comment.test.ts#L51](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/comment.test.ts#L51) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [comment.test.ts#L60](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/comment.test.ts#L60) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [comment.test.ts#L74](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/comment.test.ts#L74) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [comment.test.ts#L86](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/comment.test.ts#L86) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [comment.test.ts#L100](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/comment.test.ts#L100) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [comment.test.ts#L114](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/comment.test.ts#L114) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [comment.test.ts#L128](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/comment.test.ts#L128) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [comment.test.ts#L142](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/comment.test.ts#L142) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [comment.test.ts#L156](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/comment.test.ts#L156) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [comment.test.ts#L167](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/comment.test.ts#L167) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [comment.test.ts#L179](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/comment.test.ts#L179) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [comment.test.ts#L188](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/comment.test.ts#L188) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [comment.test.ts#L199](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/comment.test.ts#L199) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [comment.test.ts#L212](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/comment.test.ts#L212) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [comment.test.ts#L221](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/comment.test.ts#L221) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [comment.test.ts#L230](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/comment.test.ts#L230) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_comment.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/create_comment.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_comment.test.ts#L28](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/create_comment.test.ts#L28) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_comment.test.ts#L37](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/create_comment.test.ts#L37) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_comment.test.ts#L51](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/create_comment.test.ts#L51) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_comment.test.ts#L65](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/create_comment.test.ts#L65) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_comment.test.ts#L76](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/create_comment.test.ts#L76) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_comment.test.ts#L85](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/create_comment.test.ts#L85) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_comment.test.ts#L96](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/create_comment.test.ts#L96) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_comment.test.ts#L109](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/create_comment.test.ts#L109) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_comment.test.ts#L118](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/create_comment.test.ts#L118) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [create_comment.test.ts#L127](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/create_comment.test.ts#L127) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [default_comments_array.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_comments_array.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [default_comments_array.test.ts#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_comments_array.test.ts#L21) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [default_comments_array.test.ts#L30](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_comments_array.test.ts#L30) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [default_comments_array.test.ts#L39](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_comments_array.test.ts#L39) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [default_comments_array.test.ts#L50](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_comments_array.test.ts#L50) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [default_comments_array.test.ts#L61](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_comments_array.test.ts#L61) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [default_create_comments_array.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_create_comments_array.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [default_create_comments_array.test.ts#L22](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_create_comments_array.test.ts#L22) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [default_create_comments_array.test.ts#L31](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_create_comments_array.test.ts#L31) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [default_create_comments_array.test.ts#L40](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_create_comments_array.test.ts#L40) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [default_create_comments_array.test.ts#L53](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_create_comments_array.test.ts#L53) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [default_create_comments_array.test.ts#L65](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_create_comments_array.test.ts#L65) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [default_create_comments_array.test.ts#L76](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_create_comments_array.test.ts#L76) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [default_namespace.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_namespace.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [default_namespace.test.ts#L19](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_namespace.test.ts#L19) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [default_namespace.test.ts#L28](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_namespace.test.ts#L28) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [default_namespace.test.ts#L37](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_namespace.test.ts#L37) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [default_namespace.test.ts#L46](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_namespace.test.ts#L46) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [default_namespace.test.ts#L55](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_namespace.test.ts#L55) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [default_namespace_array.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_namespace_array.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [default_namespace_array.test.ts#L19](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_namespace_array.test.ts#L19) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [default_namespace_array.test.ts#L28](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_namespace_array.test.ts#L28) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [default_namespace_array.test.ts#L39](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_namespace_array.test.ts#L39) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [default_namespace_array.test.ts#L48](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_namespace_array.test.ts#L48) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [default_namespace_array.test.ts#L57](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_namespace_array.test.ts#L57) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [default_namespace_array.test.ts#L66](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_namespace_array.test.ts#L66) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [default_namespace_array.test.ts#L75](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_namespace_array.test.ts#L75) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [default_namespace_array.test.ts#L84](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_namespace_array.test.ts#L84) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [default_namespace_array.test.ts#L93](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_namespace_array.test.ts#L93) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [default_update_comments_array.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_update_comments_array.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [default_update_comments_array.test.ts#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_update_comments_array.test.ts#L21) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [default_update_comments_array.test.ts#L30](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_update_comments_array.test.ts#L30) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [default_update_comments_array.test.ts#L39](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_update_comments_array.test.ts#L39) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [default_update_comments_array.test.ts#L50](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_update_comments_array.test.ts#L50) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [default_update_comments_array.test.ts#L61](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/default_update_comments_array.test.ts#L61) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [empty_string_array.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/empty_string_array.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [empty_string_array.test.ts#L19](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/empty_string_array.test.ts#L19) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [empty_string_array.test.ts#L28](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/empty_string_array.test.ts#L28) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [empty_string_array.test.ts#L37](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/empty_string_array.test.ts#L37) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [empty_string_array.test.ts#L46](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/empty_string_array.test.ts#L46) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [empty_string_array.test.ts#L55](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/empty_string_array.test.ts#L55) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [empty_string_array.test.ts#L64](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/empty_string_array.test.ts#L64) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [empty_string_array.test.ts#L75](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/empty_string_array.test.ts#L75) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entries.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entries.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entries.test.ts#L26](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entries.test.ts#L26) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entries.test.ts#L35](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entries.test.ts#L35) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entries.test.ts#L44](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entries.test.ts#L44) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entries.test.ts#L53](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entries.test.ts#L53) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entries.test.ts#L62](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entries.test.ts#L62) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entries.test.ts#L78](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entries.test.ts#L78) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entries.test.ts#L87](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entries.test.ts#L87) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entries.test.ts#L96](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entries.test.ts#L96) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entries.test.ts#L105](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entries.test.ts#L105) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entries.test.ts#L114](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entries.test.ts#L114) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entries.test.ts#L123](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entries.test.ts#L123) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entries.test.ts#L134](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entries.test.ts#L134) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entries.test.ts#L143](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entries.test.ts#L143) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_exists.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_exists.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_exists.test.ts#L20](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_exists.test.ts#L20) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_exists.test.ts#L29](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_exists.test.ts#L29) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_exists.test.ts#L39](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_exists.test.ts#L39) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_exists.test.ts#L51](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_exists.test.ts#L51) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_exists.test.ts#L63](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_exists.test.ts#L63) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_exists.test.ts#L75](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_exists.test.ts#L75) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_list.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_list.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_list.test.ts#L20](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_list.test.ts#L20) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_list.test.ts#L29](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_list.test.ts#L29) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_list.test.ts#L39](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_list.test.ts#L39) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_list.test.ts#L51](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_list.test.ts#L51) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_list.test.ts#L65](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_list.test.ts#L65) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_list.test.ts#L77](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_list.test.ts#L77) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_list.test.ts#L91](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_list.test.ts#L91) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match.test.ts#L20](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match.test.ts#L20) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match.test.ts#L29](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match.test.ts#L29) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match.test.ts#L39](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match.test.ts#L39) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match.test.ts#L51](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match.test.ts#L51) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match.test.ts#L63](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match.test.ts#L63) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match.test.ts#L77](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match.test.ts#L77) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match.test.ts#L89](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match.test.ts#L89) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match.test.ts#L103](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match.test.ts#L103) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match_any.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match_any.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match_any.test.ts#L20](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match_any.test.ts#L20) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match_any.test.ts#L29](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match_any.test.ts#L29) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match_any.test.ts#L39](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match_any.test.ts#L39) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match_any.test.ts#L51](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match_any.test.ts#L51) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match_any.test.ts#L63](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match_any.test.ts#L63) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match_any.test.ts#L75](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match_any.test.ts#L75) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match_any.test.ts#L89](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match_any.test.ts#L89) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match_any.test.ts#L101](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match_any.test.ts#L101) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match_wildcard.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match_wildcard.test.ts#L20](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.test.ts#L20) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match_wildcard.test.ts#L29](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.test.ts#L29) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match_wildcard.test.ts#L39](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.test.ts#L39) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match_wildcard.test.ts#L51](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.test.ts#L51) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match_wildcard.test.ts#L63](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.test.ts#L63) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match_wildcard.test.ts#L77](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.test.ts#L77) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match_wildcard.test.ts#L89](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.test.ts#L89) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match_wildcard.test.ts#L101](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.test.ts#L101) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_nested.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_nested.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_nested.test.ts#L22](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_nested.test.ts#L22) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_nested.test.ts#L34](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_nested.test.ts#L34) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_nested.test.ts#L45](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_nested.test.ts#L45) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_nested.test.ts#L56](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_nested.test.ts#L56) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_nested.test.ts#L67](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_nested.test.ts#L67) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_nested.test.ts#L78](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_nested.test.ts#L78) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_nested.test.ts#L98](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_nested.test.ts#L98) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_nested.test.ts#L120](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/entry_nested.test.ts#L120) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [non_empty_entries_array.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [non_empty_entries_array.test.ts#L29](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts#L29) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [non_empty_entries_array.test.ts#L40](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts#L40) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [non_empty_entries_array.test.ts#L51](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts#L51) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [non_empty_entries_array.test.ts#L62](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts#L62) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [non_empty_entries_array.test.ts#L71](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts#L71) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [non_empty_entries_array.test.ts#L80](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts#L80) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [non_empty_entries_array.test.ts#L89](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts#L89) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [non_empty_entries_array.test.ts#L98](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts#L98) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [non_empty_entries_array.test.ts#L107](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts#L107) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [non_empty_entries_array.test.ts#L116](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts#L116) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [non_empty_entries_array.test.ts#L125](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts#L125) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [non_empty_nested_entries_array.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [non_empty_nested_entries_array.test.ts#L24](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts#L24) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [non_empty_nested_entries_array.test.ts#L35](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts#L35) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [non_empty_nested_entries_array.test.ts#L46](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts#L46) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [non_empty_nested_entries_array.test.ts#L57](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts#L57) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [non_empty_nested_entries_array.test.ts#L66](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts#L66) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [non_empty_nested_entries_array.test.ts#L75](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts#L75) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [non_empty_nested_entries_array.test.ts#L84](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts#L84) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [non_empty_nested_entries_array.test.ts#L101](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts#L101) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [non_empty_nested_entries_array.test.ts#L110](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts#L110) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [non_empty_or_nullable_string_array.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_or_nullable_string_array.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [non_empty_or_nullable_string_array.test.ts#L19](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_or_nullable_string_array.test.ts#L19) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [non_empty_or_nullable_string_array.test.ts#L30](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_or_nullable_string_array.test.ts#L30) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [non_empty_or_nullable_string_array.test.ts#L41](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_or_nullable_string_array.test.ts#L41) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [non_empty_or_nullable_string_array.test.ts#L52](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_or_nullable_string_array.test.ts#L52) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [non_empty_or_nullable_string_array.test.ts#L63](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_or_nullable_string_array.test.ts#L63) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [non_empty_string_array.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_string_array.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [non_empty_string_array.test.ts#L19](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_string_array.test.ts#L19) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [non_empty_string_array.test.ts#L30](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_string_array.test.ts#L30) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [non_empty_string_array.test.ts#L41](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_string_array.test.ts#L41) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [non_empty_string_array.test.ts#L52](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_string_array.test.ts#L52) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [non_empty_string_array.test.ts#L61](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_string_array.test.ts#L61) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [non_empty_string_array.test.ts#L70](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_string_array.test.ts#L70) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [non_empty_string_array.test.ts#L79](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_string_array.test.ts#L79) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [non_empty_string_array.test.ts#L90](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/non_empty_string_array.test.ts#L90) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_comment.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/update_comment.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_comment.test.ts#L28](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/update_comment.test.ts#L28) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_comment.test.ts#L39](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/update_comment.test.ts#L39) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_comment.test.ts#L50](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/update_comment.test.ts#L50) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_comment.test.ts#L60](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/update_comment.test.ts#L60) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_comment.test.ts#L69](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/update_comment.test.ts#L69) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_comment.test.ts#L80](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/update_comment.test.ts#L80) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_comment.test.ts#L91](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/update_comment.test.ts#L91) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_comment.test.ts#L100](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/update_comment.test.ts#L100) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_comment.test.ts#L111](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/update_comment.test.ts#L111) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_comment.test.ts#L124](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/update_comment.test.ts#L124) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_comment.test.ts#L133](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/update_comment.test.ts#L133) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [update_comment.test.ts#L142](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/update_comment.test.ts#L142) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entries.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entries.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entries.test.ts#L30](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entries.test.ts#L30) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entries.test.ts#L39](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entries.test.ts#L39) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entries.test.ts#L48](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entries.test.ts#L48) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entries.test.ts#L71](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entries.test.ts#L71) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entries.test.ts#L84](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entries.test.ts#L84) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entries.test.ts#L97](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entries.test.ts#L97) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entries.test.ts#L106](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entries.test.ts#L106) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_match.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match.test.ts#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_match.test.ts#L21) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match.test.ts#L32](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_match.test.ts#L32) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match.test.ts#L46](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_match.test.ts#L46) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match.test.ts#L58](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_match.test.ts#L58) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match.test.ts#L72](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_match.test.ts#L72) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match.test.ts#L84](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_match.test.ts#L84) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match.test.ts#L98](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_match.test.ts#L98) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match_any.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_any.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match_any.test.ts#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_any.test.ts#L21) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match_any.test.ts#L32](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_any.test.ts#L32) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match_any.test.ts#L46](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_any.test.ts#L46) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match_any.test.ts#L58](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_any.test.ts#L58) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match_any.test.ts#L70](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_any.test.ts#L70) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match_any.test.ts#L84](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_any.test.ts#L84) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_match_any.test.ts#L96](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_any.test.ts#L96) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_nested.test.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_nested.test.ts#L11) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_nested.test.ts#L27](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_nested.test.ts#L27) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_nested.test.ts#L39](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_nested.test.ts#L39) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_nested.test.ts#L50](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_nested.test.ts#L50) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_nested.test.ts#L61](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_nested.test.ts#L61) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_nested.test.ts#L72](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_nested.test.ts#L72) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_nested.test.ts#L83](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_nested.test.ts#L83) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_nested.test.ts#L103](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_nested.test.ts#L103) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.foldLeftRight" text="foldLeftRight"/> | [entry_nested.test.ts#L118](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/schemas/types/endpoint/entry_nested.test.ts#L118) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.formatErrors" text="formatErrors"/> | [shared_imports.ts#L22](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/shared_imports.ts#L22) | - |
 | <DocLink id="kibSecuritySolutionPluginApi" section="def-common.formatErrors" text="formatErrors"/> | [siem_server_deps.ts#L24](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/server/siem_server_deps.ts#L24) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.formatErrors" text="formatErrors"/> | [validate.ts#L18](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/server/routes/validate.ts#L18) | - |
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.formatErrors" text="formatErrors"/> | [validate.ts#L74](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/server/routes/validate.ts#L74) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_call_cluster.mock.ts#L9](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/get_call_cluster.mock.ts#L9) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_call_cluster.mock.ts#L26](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/get_call_cluster.mock.ts#L26) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_call_cluster.mock.ts#L30](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/common/get_call_cluster.mock.ts#L30) | - |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_call_cluster.mock.ts#L9](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/server/schemas/common/get_call_cluster.mock.ts#L9) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_call_cluster.mock.ts#L27](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/server/schemas/common/get_call_cluster.mock.ts#L27) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_call_cluster.mock.ts#L31](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/server/schemas/common/get_call_cluster.mock.ts#L31) | 7.16 |
 
 
 
@@ -1904,115 +262,115 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 
 | Deprecated API | Reference location | Remove By |
 | ---------------|-----------|-----------|
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [types.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/types.ts#L11) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [types.ts#L90](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/types.ts#L90) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [get_usage_collector.ts#L9](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/kibana_monitoring/collectors/get_usage_collector.ts#L9) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [get_usage_collector.ts#L22](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/kibana_monitoring/collectors/get_usage_collector.ts#L22) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [index.ts#L8](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/kibana_monitoring/collectors/index.ts#L8) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [index.ts#L19](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/kibana_monitoring/collectors/index.ts#L19) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [register_monitoring_telemetry_collection.ts#L8](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/register_monitoring_telemetry_collection.ts#L8) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [register_monitoring_telemetry_collection.ts#L34](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/register_monitoring_telemetry_collection.ts#L34) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [types.d.ts#L2](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/types.d.ts#L2) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [types.d.ts#L61](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/types.d.ts#L61) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [index.d.ts#L1](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/kibana_monitoring/collectors/index.d.ts#L1) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [index.d.ts#L5](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/kibana_monitoring/collectors/index.d.ts#L5) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [register_monitoring_telemetry_collection.d.ts#L1](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/register_monitoring_telemetry_collection.d.ts#L1) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [register_monitoring_telemetry_collection.d.ts#L3](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/register_monitoring_telemetry_collection.d.ts#L3) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [get_usage_collector.d.ts#L2](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/kibana_monitoring/collectors/get_usage_collector.d.ts#L2) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [get_usage_collector.d.ts#L5](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/kibana_monitoring/collectors/get_usage_collector.d.ts#L5) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [types.ts#L13](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/types.ts#L13) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [types.ts#L74](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/types.ts#L74) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [instantiate_client.ts#L9](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/es_client/instantiate_client.ts#L9) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [instantiate_client.ts#L29](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/es_client/instantiate_client.ts#L29) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [license_service.ts#L9](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/license_service.ts#L9) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [license_service.ts#L18](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/license_service.ts#L18) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [static_globals.ts#L8](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/static_globals.ts#L8) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [static_globals.ts#L18](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/static_globals.ts#L18) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [static_globals.ts#L43](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/static_globals.ts#L43) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [plugin.ts#L18](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/plugin.ts#L18) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [plugin.ts#L74](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/plugin.ts#L74) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [plugin.ts#L279](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/plugin.ts#L279) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [types.d.ts#L2](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/types.d.ts#L2) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [types.d.ts#L47](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/types.d.ts#L47) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [plugin.d.ts#L1](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/plugin.d.ts#L1) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [plugin.d.ts#L29](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/plugin.d.ts#L29) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [license_service.d.ts#L1](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/license_service.d.ts#L1) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [license_service.d.ts#L8](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/license_service.d.ts#L8) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [static_globals.d.ts#L1](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/static_globals.d.ts#L1) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [static_globals.d.ts#L8](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/static_globals.d.ts#L8) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [static_globals.d.ts#L15](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/static_globals.d.ts#L15) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [instantiate_client.d.ts#L2](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/es_client/instantiate_client.d.ts#L2) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [instantiate_client.d.ts#L5](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/es_client/instantiate_client.d.ts#L5) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [fetch_es_usage.ts#L8](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/kibana_monitoring/collectors/lib/fetch_es_usage.ts#L8) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [fetch_es_usage.ts#L45](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/kibana_monitoring/collectors/lib/fetch_es_usage.ts#L45) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [fetch_stack_product_usage.ts#L9](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/kibana_monitoring/collectors/lib/fetch_stack_product_usage.ts#L9) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [fetch_stack_product_usage.ts#L36](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/kibana_monitoring/collectors/lib/fetch_stack_product_usage.ts#L36) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_stack_products_usage.ts#L8](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/kibana_monitoring/collectors/lib/get_stack_products_usage.ts#L8) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_stack_products_usage.ts#L27](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/kibana_monitoring/collectors/lib/get_stack_products_usage.ts#L27) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [fetch_license_type.ts#L9](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/kibana_monitoring/collectors/lib/fetch_license_type.ts#L9) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [fetch_license_type.ts#L14](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/kibana_monitoring/collectors/lib/fetch_license_type.ts#L14) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_high_level_stats.ts#L10](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_high_level_stats.ts#L10) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_high_level_stats.ts#L251](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_high_level_stats.ts#L251) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_high_level_stats.ts#L272](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_high_level_stats.ts#L272) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_logstash_stats.ts#L9](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_logstash_stats.ts#L9) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_logstash_stats.ts#L264](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_logstash_stats.ts#L264) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_logstash_stats.ts#L328](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_logstash_stats.ts#L328) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_logstash_stats.ts#L395](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_logstash_stats.ts#L395) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_beats_stats.ts#L10](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_beats_stats.ts#L10) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_beats_stats.ts#L322](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_beats_stats.ts#L322) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_beats_stats.ts#L386](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_beats_stats.ts#L386) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_beats_stats.ts#L396](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_beats_stats.ts#L396) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_beats_stats.ts#L414](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_beats_stats.ts#L414) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_es_stats.ts#L9](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_es_stats.ts#L9) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_es_stats.ts#L20](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_es_stats.ts#L20) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_es_stats.ts#L38](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_es_stats.ts#L38) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_kibana_stats.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_kibana_stats.ts#L11) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_kibana_stats.ts#L186](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_kibana_stats.ts#L186) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_all_stats.ts#L12](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_all_stats.ts#L12) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_all_stats.ts#L31](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_all_stats.ts#L31) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_cluster_uuids.ts#L10](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_cluster_uuids.ts#L10) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_cluster_uuids.ts#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_cluster_uuids.ts#L21) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_cluster_uuids.ts#L33](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_cluster_uuids.ts#L33) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_licenses.ts#L9](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_licenses.ts#L9) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_licenses.ts#L18](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_licenses.ts#L18) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_licenses.ts#L35](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_licenses.ts#L35) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [disable_watcher_cluster_alerts.ts#L9](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/lib/alerts/disable_watcher_cluster_alerts.ts#L9) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [disable_watcher_cluster_alerts.ts#L25](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/lib/alerts/disable_watcher_cluster_alerts.ts#L25) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [disable_watcher_cluster_alerts.ts#L36](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/lib/alerts/disable_watcher_cluster_alerts.ts#L36) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_es_stats.d.ts#L2](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_es_stats.d.ts#L2) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_es_stats.d.ts#L10](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_es_stats.d.ts#L10) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_es_stats.d.ts#L20](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_es_stats.d.ts#L20) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_high_level_stats.d.ts#L2](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_high_level_stats.d.ts#L2) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_high_level_stats.d.ts#L78](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_high_level_stats.d.ts#L78) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_high_level_stats.d.ts#L83](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_high_level_stats.d.ts#L83) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_kibana_stats.d.ts#L2](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_kibana_stats.d.ts#L2) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_kibana_stats.d.ts#L82](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_kibana_stats.d.ts#L82) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_beats_stats.d.ts#L2](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_beats_stats.d.ts#L2) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_beats_stats.d.ts#L120](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_beats_stats.d.ts#L120) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_beats_stats.d.ts#L123](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_beats_stats.d.ts#L123) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_beats_stats.d.ts#L129](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_beats_stats.d.ts#L129) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_logstash_stats.d.ts#L2](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_logstash_stats.d.ts#L2) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_logstash_stats.d.ts#L100](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_logstash_stats.d.ts#L100) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_logstash_stats.d.ts#L103](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_logstash_stats.d.ts#L103) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_logstash_stats.d.ts#L109](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_logstash_stats.d.ts#L109) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_all_stats.d.ts#L1](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_all_stats.d.ts#L1) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_all_stats.d.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_all_stats.d.ts#L11) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_cluster_uuids.d.ts#L1](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_cluster_uuids.d.ts#L1) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_cluster_uuids.d.ts#L5](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_cluster_uuids.d.ts#L5) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_cluster_uuids.d.ts#L10](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_cluster_uuids.d.ts#L10) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_licenses.d.ts#L2](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_licenses.d.ts#L2) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_licenses.d.ts#L7](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_licenses.d.ts#L7) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_licenses.d.ts#L20](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_licenses.d.ts#L20) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [disable_watcher_cluster_alerts.d.ts#L2](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/lib/alerts/disable_watcher_cluster_alerts.d.ts#L2) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [disable_watcher_cluster_alerts.d.ts#L3](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/lib/alerts/disable_watcher_cluster_alerts.d.ts#L3) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [fetch_es_usage.d.ts#L1](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/kibana_monitoring/collectors/lib/fetch_es_usage.d.ts#L1) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [fetch_es_usage.d.ts#L4](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/kibana_monitoring/collectors/lib/fetch_es_usage.d.ts#L4) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [fetch_license_type.d.ts#L1](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/kibana_monitoring/collectors/lib/fetch_license_type.d.ts#L1) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [fetch_license_type.d.ts#L2](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/kibana_monitoring/collectors/lib/fetch_license_type.d.ts#L2) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [fetch_stack_product_usage.d.ts#L1](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/kibana_monitoring/collectors/lib/fetch_stack_product_usage.d.ts#L1) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [fetch_stack_product_usage.d.ts#L4](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/kibana_monitoring/collectors/lib/fetch_stack_product_usage.d.ts#L4) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_stack_products_usage.d.ts#L1](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/kibana_monitoring/collectors/lib/get_stack_products_usage.d.ts#L1) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_stack_products_usage.d.ts#L4](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/kibana_monitoring/collectors/lib/get_stack_products_usage.d.ts#L4) | - |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [types.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/types.ts#L11) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [types.ts#L90](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/types.ts#L90) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [get_usage_collector.ts#L9](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/kibana_monitoring/collectors/get_usage_collector.ts#L9) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [get_usage_collector.ts#L22](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/kibana_monitoring/collectors/get_usage_collector.ts#L22) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [index.ts#L8](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/kibana_monitoring/collectors/index.ts#L8) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [index.ts#L19](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/kibana_monitoring/collectors/index.ts#L19) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [register_monitoring_telemetry_collection.ts#L8](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/register_monitoring_telemetry_collection.ts#L8) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [register_monitoring_telemetry_collection.ts#L34](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/register_monitoring_telemetry_collection.ts#L34) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [types.d.ts#L2](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/types.d.ts#L2) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [types.d.ts#L61](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/types.d.ts#L61) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [index.d.ts#L1](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/kibana_monitoring/collectors/index.d.ts#L1) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [index.d.ts#L5](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/kibana_monitoring/collectors/index.d.ts#L5) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [register_monitoring_telemetry_collection.d.ts#L1](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/register_monitoring_telemetry_collection.d.ts#L1) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [register_monitoring_telemetry_collection.d.ts#L3](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/register_monitoring_telemetry_collection.d.ts#L3) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [get_usage_collector.d.ts#L2](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/kibana_monitoring/collectors/get_usage_collector.d.ts#L2) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [get_usage_collector.d.ts#L5](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/kibana_monitoring/collectors/get_usage_collector.d.ts#L5) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [types.ts#L13](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/types.ts#L13) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [types.ts#L74](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/types.ts#L74) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [instantiate_client.ts#L9](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/es_client/instantiate_client.ts#L9) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [instantiate_client.ts#L29](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/es_client/instantiate_client.ts#L29) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [license_service.ts#L9](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/license_service.ts#L9) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [license_service.ts#L18](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/license_service.ts#L18) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [static_globals.ts#L8](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/static_globals.ts#L8) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [static_globals.ts#L18](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/static_globals.ts#L18) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [static_globals.ts#L43](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/static_globals.ts#L43) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [plugin.ts#L18](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/plugin.ts#L18) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [plugin.ts#L74](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/plugin.ts#L74) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [plugin.ts#L279](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/plugin.ts#L279) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [types.d.ts#L2](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/types.d.ts#L2) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [types.d.ts#L47](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/types.d.ts#L47) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [plugin.d.ts#L1](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/plugin.d.ts#L1) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [plugin.d.ts#L29](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/plugin.d.ts#L29) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [license_service.d.ts#L1](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/license_service.d.ts#L1) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [license_service.d.ts#L8](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/license_service.d.ts#L8) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [static_globals.d.ts#L1](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/static_globals.d.ts#L1) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [static_globals.d.ts#L8](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/static_globals.d.ts#L8) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [static_globals.d.ts#L15](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/static_globals.d.ts#L15) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [instantiate_client.d.ts#L2](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/es_client/instantiate_client.d.ts#L2) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [instantiate_client.d.ts#L5](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/es_client/instantiate_client.d.ts#L5) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [fetch_es_usage.ts#L8](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/kibana_monitoring/collectors/lib/fetch_es_usage.ts#L8) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [fetch_es_usage.ts#L45](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/kibana_monitoring/collectors/lib/fetch_es_usage.ts#L45) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [fetch_stack_product_usage.ts#L9](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/kibana_monitoring/collectors/lib/fetch_stack_product_usage.ts#L9) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [fetch_stack_product_usage.ts#L36](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/kibana_monitoring/collectors/lib/fetch_stack_product_usage.ts#L36) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_stack_products_usage.ts#L8](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/kibana_monitoring/collectors/lib/get_stack_products_usage.ts#L8) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_stack_products_usage.ts#L27](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/kibana_monitoring/collectors/lib/get_stack_products_usage.ts#L27) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [fetch_license_type.ts#L9](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/kibana_monitoring/collectors/lib/fetch_license_type.ts#L9) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [fetch_license_type.ts#L14](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/kibana_monitoring/collectors/lib/fetch_license_type.ts#L14) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_high_level_stats.ts#L10](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_high_level_stats.ts#L10) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_high_level_stats.ts#L251](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_high_level_stats.ts#L251) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_high_level_stats.ts#L272](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_high_level_stats.ts#L272) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_logstash_stats.ts#L9](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_logstash_stats.ts#L9) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_logstash_stats.ts#L264](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_logstash_stats.ts#L264) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_logstash_stats.ts#L328](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_logstash_stats.ts#L328) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_logstash_stats.ts#L395](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_logstash_stats.ts#L395) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_beats_stats.ts#L10](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_beats_stats.ts#L10) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_beats_stats.ts#L322](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_beats_stats.ts#L322) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_beats_stats.ts#L386](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_beats_stats.ts#L386) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_beats_stats.ts#L396](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_beats_stats.ts#L396) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_beats_stats.ts#L414](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_beats_stats.ts#L414) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_es_stats.ts#L9](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_es_stats.ts#L9) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_es_stats.ts#L20](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_es_stats.ts#L20) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_es_stats.ts#L38](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_es_stats.ts#L38) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_kibana_stats.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_kibana_stats.ts#L11) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_kibana_stats.ts#L186](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_kibana_stats.ts#L186) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_all_stats.ts#L12](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_all_stats.ts#L12) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_all_stats.ts#L31](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_all_stats.ts#L31) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_cluster_uuids.ts#L10](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_cluster_uuids.ts#L10) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_cluster_uuids.ts#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_cluster_uuids.ts#L21) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_cluster_uuids.ts#L33](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_cluster_uuids.ts#L33) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_licenses.ts#L9](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_licenses.ts#L9) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_licenses.ts#L18](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_licenses.ts#L18) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_licenses.ts#L35](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/telemetry_collection/get_licenses.ts#L35) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [disable_watcher_cluster_alerts.ts#L9](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/lib/alerts/disable_watcher_cluster_alerts.ts#L9) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [disable_watcher_cluster_alerts.ts#L25](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/lib/alerts/disable_watcher_cluster_alerts.ts#L25) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [disable_watcher_cluster_alerts.ts#L36](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/server/lib/alerts/disable_watcher_cluster_alerts.ts#L36) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_es_stats.d.ts#L2](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_es_stats.d.ts#L2) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_es_stats.d.ts#L10](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_es_stats.d.ts#L10) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_es_stats.d.ts#L20](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_es_stats.d.ts#L20) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_high_level_stats.d.ts#L2](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_high_level_stats.d.ts#L2) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_high_level_stats.d.ts#L78](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_high_level_stats.d.ts#L78) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_high_level_stats.d.ts#L83](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_high_level_stats.d.ts#L83) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_kibana_stats.d.ts#L2](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_kibana_stats.d.ts#L2) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_kibana_stats.d.ts#L82](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_kibana_stats.d.ts#L82) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_beats_stats.d.ts#L2](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_beats_stats.d.ts#L2) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_beats_stats.d.ts#L120](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_beats_stats.d.ts#L120) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_beats_stats.d.ts#L123](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_beats_stats.d.ts#L123) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_beats_stats.d.ts#L129](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_beats_stats.d.ts#L129) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_logstash_stats.d.ts#L2](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_logstash_stats.d.ts#L2) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_logstash_stats.d.ts#L100](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_logstash_stats.d.ts#L100) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_logstash_stats.d.ts#L103](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_logstash_stats.d.ts#L103) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_logstash_stats.d.ts#L109](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_logstash_stats.d.ts#L109) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_all_stats.d.ts#L1](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_all_stats.d.ts#L1) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_all_stats.d.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_all_stats.d.ts#L11) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_cluster_uuids.d.ts#L1](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_cluster_uuids.d.ts#L1) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_cluster_uuids.d.ts#L5](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_cluster_uuids.d.ts#L5) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_cluster_uuids.d.ts#L10](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_cluster_uuids.d.ts#L10) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_licenses.d.ts#L2](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_licenses.d.ts#L2) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_licenses.d.ts#L7](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_licenses.d.ts#L7) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_licenses.d.ts#L20](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/telemetry_collection/get_licenses.d.ts#L20) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [disable_watcher_cluster_alerts.d.ts#L2](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/lib/alerts/disable_watcher_cluster_alerts.d.ts#L2) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [disable_watcher_cluster_alerts.d.ts#L3](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/lib/alerts/disable_watcher_cluster_alerts.d.ts#L3) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [fetch_es_usage.d.ts#L1](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/kibana_monitoring/collectors/lib/fetch_es_usage.d.ts#L1) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [fetch_es_usage.d.ts#L4](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/kibana_monitoring/collectors/lib/fetch_es_usage.d.ts#L4) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [fetch_license_type.d.ts#L1](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/kibana_monitoring/collectors/lib/fetch_license_type.d.ts#L1) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [fetch_license_type.d.ts#L2](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/kibana_monitoring/collectors/lib/fetch_license_type.d.ts#L2) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [fetch_stack_product_usage.d.ts#L1](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/kibana_monitoring/collectors/lib/fetch_stack_product_usage.d.ts#L1) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [fetch_stack_product_usage.d.ts#L4](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/kibana_monitoring/collectors/lib/fetch_stack_product_usage.d.ts#L4) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_stack_products_usage.d.ts#L1](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/kibana_monitoring/collectors/lib/get_stack_products_usage.d.ts#L1) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_stack_products_usage.d.ts#L4](https://github.com/elastic/kibana/tree/master/x-pack/plugins/monitoring/target/types/server/kibana_monitoring/collectors/lib/get_stack_products_usage.d.ts#L4) | 7.16 |
 
 
 
@@ -2025,15 +383,6 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 
 
 
-## rollup
-
-| Deprecated API | Reference location | Remove By |
-| ---------------|-----------|-----------|
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [plugin.ts#L12](https://github.com/elastic/kibana/tree/master/x-pack/plugins/rollup/server/plugin.ts#L12) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyCustomClusterClient" text="ILegacyCustomClusterClient"/> | [plugin.ts#L36](https://github.com/elastic/kibana/tree/master/x-pack/plugins/rollup/server/plugin.ts#L36) | - |
-
-
-
 ## savedObjectsManagement
 
 | Deprecated API | Reference location | Remove By |
@@ -2080,298 +429,6 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 
 | Deprecated API | Reference location | Remove By |
 | ---------------|-----------|-----------|
-| <DocLink id="kibListsPluginApi" section="def-common.CommentsArray" text="CommentsArray"/> | [shared_imports.ts#L10](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/common/shared_imports.ts#L10) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.CommentsArray" text="CommentsArray"/> | [helpers.tsx#L25](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L25) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.CommentsArray" text="CommentsArray"/> | [helpers.tsx#L176](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L176) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.CreateCommentsArray" text="CreateCommentsArray"/> | [shared_imports.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/common/shared_imports.ts#L11) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.Comment" text="Comment"/> | [shared_imports.ts#L12](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/common/shared_imports.ts#L12) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.Comment" text="Comment"/> | [helpers.tsx#L26](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L26) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.Comment" text="Comment"/> | [helpers.tsx#L332](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L332) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.Comment" text="Comment"/> | [helpers.tsx#L360](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L360) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.Comment" text="Comment"/> | [add_exception_comments.tsx#L20](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_comments.tsx#L20) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.Comment" text="Comment"/> | [add_exception_comments.tsx#L26](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_comments.tsx#L26) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.CreateComment" text="CreateComment"/> | [shared_imports.ts#L13](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/common/shared_imports.ts#L13) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.CreateComment" text="CreateComment"/> | [helpers.tsx#L27](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L27) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.CreateComment" text="CreateComment"/> | [helpers.tsx#L332](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L332) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.CreateComment" text="CreateComment"/> | [helpers.tsx#L360](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L360) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.Entry" text="Entry"/> | [shared_imports.ts#L19](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/common/shared_imports.ts#L19) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.Entry" text="Entry"/> | [types.ts#L15](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/types.ts#L15) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.Entry" text="Entry"/> | [types.ts#L103](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/types.ts#L103) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.Entry" text="Entry"/> | [helpers.tsx#L28](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L28) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.Entry" text="Entry"/> | [helpers.tsx#L307](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L307) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.Entry" text="Entry"/> | [helpers.tsx#L650](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L650) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.Entry" text="Entry"/> | [lists.ts#L13](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.ts#L13) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.Entry" text="Entry"/> | [lists.ts#L239](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.ts#L239) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryExists" text="EntryExists"/> | [shared_imports.ts#L20](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/common/shared_imports.ts#L20) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryExists" text="EntryExists"/> | [types.ts#L19](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/types.ts#L19) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryExists" text="EntryExists"/> | [types.ts#L98](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/types.ts#L98) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryExists" text="EntryExists"/> | [types.ts#L115](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/types.ts#L115) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryMatch" text="EntryMatch"/> | [shared_imports.ts#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/common/shared_imports.ts#L21) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryMatch" text="EntryMatch"/> | [types.ts#L16](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/types.ts#L16) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryMatch" text="EntryMatch"/> | [types.ts#L95](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/types.ts#L95) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryMatch" text="EntryMatch"/> | [types.ts#L112](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/types.ts#L112) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryMatch" text="EntryMatch"/> | [mapping.ts#L13](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/mapping.ts#L13) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryMatch" text="EntryMatch"/> | [mapping.ts#L104](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/mapping.ts#L104) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryMatch" text="EntryMatch"/> | [mapping.ts#L184](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/mapping.ts#L184) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryMatchAny" text="EntryMatchAny"/> | [shared_imports.ts#L22](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/common/shared_imports.ts#L22) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryMatchAny" text="EntryMatchAny"/> | [types.ts#L17](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/types.ts#L17) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryMatchAny" text="EntryMatchAny"/> | [types.ts#L97](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/types.ts#L97) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryMatchAny" text="EntryMatchAny"/> | [types.ts#L114](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/types.ts#L114) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryMatchWildcard" text="EntryMatchWildcard"/> | [shared_imports.ts#L23](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/common/shared_imports.ts#L23) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryMatchWildcard" text="EntryMatchWildcard"/> | [types.ts#L18](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/types.ts#L18) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryMatchWildcard" text="EntryMatchWildcard"/> | [types.ts#L96](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/types.ts#L96) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryMatchWildcard" text="EntryMatchWildcard"/> | [types.ts#L113](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/types.ts#L113) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryMatchWildcard" text="EntryMatchWildcard"/> | [mapping.ts#L14](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/mapping.ts#L14) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryMatchWildcard" text="EntryMatchWildcard"/> | [mapping.ts#L188](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/mapping.ts#L188) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryNested" text="EntryNested"/> | [shared_imports.ts#L24](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/common/shared_imports.ts#L24) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryNested" text="EntryNested"/> | [types.ts#L14](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/types.ts#L14) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryNested" text="EntryNested"/> | [types.ts#L109](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/types.ts#L109) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryNested" text="EntryNested"/> | [helpers.tsx#L40](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L40) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryNested" text="EntryNested"/> | [helpers.tsx#L307](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L307) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryNested" text="EntryNested"/> | [helpers.test.tsx#L46](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx#L46) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryNested" text="EntryNested"/> | [helpers.test.tsx#L425](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx#L425) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryNested" text="EntryNested"/> | [helpers.test.tsx#L444](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx#L444) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryNested" text="EntryNested"/> | [helpers.test.tsx#L471](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx#L471) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryNested" text="EntryNested"/> | [mapping.ts#L15](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/mapping.ts#L15) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryNested" text="EntryNested"/> | [mapping.ts#L192](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/mapping.ts#L192) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryNested" text="EntryNested"/> | [lists.ts#L13](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.ts#L13) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryNested" text="EntryNested"/> | [lists.ts#L239](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.ts#L239) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryList" text="EntryList"/> | [shared_imports.ts#L25](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/common/shared_imports.ts#L25) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryList" text="EntryList"/> | [create_field_and_set_tuples.ts#L8](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/lib/detection_engine/signals/filters/create_field_and_set_tuples.ts#L8) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryList" text="EntryList"/> | [create_field_and_set_tuples.ts#L19](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/lib/detection_engine/signals/filters/create_field_and_set_tuples.ts#L19) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryList" text="EntryList"/> | [create_field_and_set_tuples.test.ts#L14](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/lib/detection_engine/signals/filters/create_field_and_set_tuples.test.ts#L14) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryList" text="EntryList"/> | [create_field_and_set_tuples.test.ts#L78](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/lib/detection_engine/signals/filters/create_field_and_set_tuples.test.ts#L78) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryList" text="EntryList"/> | [create_field_and_set_tuples.test.ts#L90](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/lib/detection_engine/signals/filters/create_field_and_set_tuples.test.ts#L90) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryList" text="EntryList"/> | [create_field_and_set_tuples.test.ts#L102](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/lib/detection_engine/signals/filters/create_field_and_set_tuples.test.ts#L102) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryList" text="EntryList"/> | [create_field_and_set_tuples.test.ts#L115](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/lib/detection_engine/signals/filters/create_field_and_set_tuples.test.ts#L115) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryList" text="EntryList"/> | [create_field_and_set_tuples.test.ts#L131](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/lib/detection_engine/signals/filters/create_field_and_set_tuples.test.ts#L131) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryList" text="EntryList"/> | [create_field_and_set_tuples.test.ts#L144](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/lib/detection_engine/signals/filters/create_field_and_set_tuples.test.ts#L144) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryList" text="EntryList"/> | [lists.test.ts#L12](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.test.ts#L12) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntryList" text="EntryList"/> | [lists.test.ts#L329](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.test.ts#L329) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntriesArray" text="EntriesArray"/> | [shared_imports.ts#L26](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/common/shared_imports.ts#L26) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntriesArray" text="EntriesArray"/> | [utils.ts#L12](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/common/detection_engine/utils.ts#L12) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntriesArray" text="EntriesArray"/> | [utils.ts#L23](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/common/detection_engine/utils.ts#L23) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntriesArray" text="EntriesArray"/> | [utils.ts#L28](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/common/detection_engine/utils.ts#L28) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntriesArray" text="EntriesArray"/> | [utils.test.ts#L16](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/common/detection_engine/utils.test.ts#L16) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntriesArray" text="EntriesArray"/> | [utils.test.ts#L26](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/common/detection_engine/utils.test.ts#L26) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntriesArray" text="EntriesArray"/> | [utils.test.ts#L46](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/common/detection_engine/utils.test.ts#L46) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntriesArray" text="EntriesArray"/> | [utils.test.ts#L74](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/common/detection_engine/utils.test.ts#L74) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntriesArray" text="EntriesArray"/> | [utils.test.ts#L95](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/common/detection_engine/utils.test.ts#L95) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntriesArray" text="EntriesArray"/> | [helpers.tsx#L42](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L42) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntriesArray" text="EntriesArray"/> | [helpers.tsx#L87](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L87) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntriesArray" text="EntriesArray"/> | [helpers.tsx#L87](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L87) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntriesArray" text="EntriesArray"/> | [mapping.ts#L12](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/mapping.ts#L12) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntriesArray" text="EntriesArray"/> | [mapping.ts#L80](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/mapping.ts#L80) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntriesArray" text="EntriesArray"/> | [mapping.ts#L204](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/mapping.ts#L204) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntriesArray" text="EntriesArray"/> | [helpers.test.tsx#L62](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx#L62) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntriesArray" text="EntriesArray"/> | [helpers.test.tsx#L661](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx#L661) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntriesArray" text="EntriesArray"/> | [helpers.test.tsx#L702](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx#L702) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntriesArray" text="EntriesArray"/> | [helpers.test.tsx#L783](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx#L783) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntriesArray" text="EntriesArray"/> | [helpers.test.tsx#L787](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx#L787) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntriesArray" text="EntriesArray"/> | [helpers.test.tsx#L793](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx#L793) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntriesArray" text="EntriesArray"/> | [helpers.test.tsx#L800](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx#L800) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntriesArray" text="EntriesArray"/> | [helpers.test.tsx#L804](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx#L804) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntriesArray" text="EntriesArray"/> | [helpers.test.tsx#L810](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx#L810) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntriesArray" text="EntriesArray"/> | [index.test.tsx#L24](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.test.tsx#L24) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntriesArray" text="EntriesArray"/> | [index.test.tsx#L426](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.test.tsx#L426) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntriesArray" text="EntriesArray"/> | [index.test.tsx#L23](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/edit_exception_modal/index.test.tsx#L23) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntriesArray" text="EntriesArray"/> | [index.test.tsx#L133](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/edit_exception_modal/index.test.tsx#L133) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntriesArray" text="EntriesArray"/> | [lists.test.ts#L12](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.test.ts#L12) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntriesArray" text="EntriesArray"/> | [lists.test.ts#L73](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.test.ts#L73) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntriesArray" text="EntriesArray"/> | [lists.test.ts#L119](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.test.ts#L119) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntriesArray" text="EntriesArray"/> | [lists.test.ts#L170](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.test.ts#L170) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntriesArray" text="EntriesArray"/> | [lists.test.ts#L223](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.test.ts#L223) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntriesArray" text="EntriesArray"/> | [lists.test.ts#L275](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.test.ts#L275) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.EntriesArray" text="EntriesArray"/> | [lists.test.ts#L319](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.test.ts#L319) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.Operator" text="Operator"/> | [shared_imports.ts#L28](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/common/shared_imports.ts#L28) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorEnum" text="OperatorEnum"/> | [shared_imports.ts#L29](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/common/shared_imports.ts#L29) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorEnum" text="OperatorEnum"/> | [types.ts#L10](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/autocomplete/types.ts#L10) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorEnum" text="OperatorEnum"/> | [types.ts#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/autocomplete/types.ts#L21) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorEnum" text="OperatorEnum"/> | [types.ts#L24](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/types.ts#L24) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorEnum" text="OperatorEnum"/> | [types.ts#L77](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/types.ts#L77) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorEnum" text="OperatorEnum"/> | [types.ts#L85](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/types.ts#L85) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorEnum" text="OperatorEnum"/> | [operators.ts#L10](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/autocomplete/operators.ts#L10) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorEnum" text="OperatorEnum"/> | [operators.ts#L18](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/autocomplete/operators.ts#L18) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorEnum" text="OperatorEnum"/> | [operators.ts#L27](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/autocomplete/operators.ts#L27) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorEnum" text="OperatorEnum"/> | [operators.ts#L36](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/autocomplete/operators.ts#L36) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorEnum" text="OperatorEnum"/> | [operators.ts#L45](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/autocomplete/operators.ts#L45) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorEnum" text="OperatorEnum"/> | [operators.ts#L54](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/autocomplete/operators.ts#L54) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorEnum" text="OperatorEnum"/> | [operators.ts#L63](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/autocomplete/operators.ts#L63) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorEnum" text="OperatorEnum"/> | [operators.ts#L72](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/autocomplete/operators.ts#L72) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorEnum" text="OperatorEnum"/> | [operators.ts#L81](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/autocomplete/operators.ts#L81) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorEnum" text="OperatorEnum"/> | [helpers.test.tsx#L46](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx#L46) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorEnum" text="OperatorEnum"/> | [helpers.test.tsx#L347](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx#L347) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorEnum" text="OperatorEnum"/> | [helpers.test.tsx#L366](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx#L366) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorEnum" text="OperatorEnum"/> | [helpers.test.tsx#L387](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx#L387) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorEnum" text="OperatorEnum"/> | [helpers.test.tsx#L408](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx#L408) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [shared_imports.ts#L30](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/common/shared_imports.ts#L30) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [types.ts#L10](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/autocomplete/types.ts#L10) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [types.ts#L22](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/autocomplete/types.ts#L22) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [types.ts#L23](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/types.ts#L23) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [types.ts#L78](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/types.ts#L78) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [types.ts#L78](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/types.ts#L78) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [types.ts#L86](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/types.ts#L86) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [types.ts#L93](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/types.ts#L93) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [operators.ts#L10](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/autocomplete/operators.ts#L10) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [operators.ts#L17](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/autocomplete/operators.ts#L17) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [operators.ts#L26](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/autocomplete/operators.ts#L26) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [operators.ts#L35](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/autocomplete/operators.ts#L35) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [operators.ts#L44](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/autocomplete/operators.ts#L44) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [operators.ts#L53](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/autocomplete/operators.ts#L53) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [operators.ts#L62](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/autocomplete/operators.ts#L62) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [operators.ts#L71](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/autocomplete/operators.ts#L71) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [operators.ts#L80](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/autocomplete/operators.ts#L80) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [use_field_value_autocomplete.ts#L13](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/autocomplete/hooks/use_field_value_autocomplete.ts#L13) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [use_field_value_autocomplete.ts#L28](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/autocomplete/hooks/use_field_value_autocomplete.ts#L28) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [use_field_value_autocomplete.ts#L101](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/autocomplete/hooks/use_field_value_autocomplete.ts#L101) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [field_value_match.tsx#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_match.tsx#L21) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [field_value_match.tsx#L59](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_match.tsx#L59) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [field_value_match_any.tsx#L15](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_match_any.tsx#L15) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [field_value_match_any.tsx#L51](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_match_any.tsx#L51) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [use_field_value_autocomplete.test.ts#L18](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/autocomplete/hooks/use_field_value_autocomplete.test.ts#L18) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [use_field_value_autocomplete.test.ts#L51](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/autocomplete/hooks/use_field_value_autocomplete.test.ts#L51) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [use_field_value_autocomplete.test.ts#L71](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/autocomplete/hooks/use_field_value_autocomplete.test.ts#L71) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [use_field_value_autocomplete.test.ts#L94](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/autocomplete/hooks/use_field_value_autocomplete.test.ts#L94) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [use_field_value_autocomplete.test.ts#L117](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/autocomplete/hooks/use_field_value_autocomplete.test.ts#L117) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [use_field_value_autocomplete.test.ts#L152](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/autocomplete/hooks/use_field_value_autocomplete.test.ts#L152) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [use_field_value_autocomplete.test.ts#L192](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/autocomplete/hooks/use_field_value_autocomplete.test.ts#L192) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [use_field_value_autocomplete.test.ts#L228](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/autocomplete/hooks/use_field_value_autocomplete.test.ts#L228) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [use_field_value_autocomplete.test.ts#L254](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/autocomplete/hooks/use_field_value_autocomplete.test.ts#L254) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [use_field_value_autocomplete.test.ts#L289](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/autocomplete/hooks/use_field_value_autocomplete.test.ts#L289) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [helpers.tsx#L31](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L31) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [helpers.tsx#L105](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L105) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [helpers.tsx#L108](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L108) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [helpers.tsx#L110](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L110) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [helpers.tsx#L112](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L112) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [helpers.tsx#L114](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L114) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [helpers.tsx#L144](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L144) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [helpers.tsx#L145](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L145) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [helpers.tsx#L147](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L147) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [helpers.tsx#L149](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L149) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [helpers.tsx#L445](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L445) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [helpers.test.tsx#L46](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx#L46) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [helpers.test.tsx#L171](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx#L171) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [helpers.test.tsx#L178](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx#L178) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [helpers.test.tsx#L185](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx#L185) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [helpers.test.tsx#L192](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx#L192) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [helpers.test.tsx#L346](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx#L346) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [helpers.test.tsx#L365](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx#L365) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [helpers.test.tsx#L386](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx#L386) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [helpers.test.tsx#L407](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx#L407) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [helpers.test.tsx#L427](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx#L427) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [helpers.test.tsx#L446](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx#L446) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [helpers.test.tsx#L473](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx#L473) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OperatorTypeEnum" text="OperatorTypeEnum"/> | [helpers.test.tsx#L661](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx#L661) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [shared_imports.ts#L31](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/common/shared_imports.ts#L31) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [exceptions_viewer_header.tsx#L23](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.tsx#L23) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [exceptions_viewer_header.tsx#L27](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.tsx#L27) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [exceptions_viewer_header.tsx#L31](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.tsx#L31) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [exceptions_viewer_header.tsx#L94](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.tsx#L94) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [exceptions_viewer_header.tsx#L108](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.tsx#L108) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [exceptions_viewer_header.tsx#L113](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.tsx#L113) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [index.tsx#L23](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/index.tsx#L23) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [index.tsx#L59](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/index.tsx#L59) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [index.tsx#L231](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/index.tsx#L231) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [exceptions_viewer_header.stories.tsx#L15](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.stories.tsx#L15) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [exceptions_viewer_header.stories.tsx#L28](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.stories.tsx#L28) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [exceptions_viewer_header.stories.tsx#L28](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.stories.tsx#L28) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [exceptions_viewer_header.stories.tsx#L40](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.stories.tsx#L40) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [exceptions_viewer_header.stories.tsx#L40](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.stories.tsx#L40) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [exceptions_viewer_header.stories.tsx#L52](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.stories.tsx#L52) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [exceptions_viewer_header.stories.tsx#L64](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.stories.tsx#L64) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [exceptions_viewer_header.test.tsx#L12](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.test.tsx#L12) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [exceptions_viewer_header.test.tsx#L18](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.test.tsx#L18) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [exceptions_viewer_header.test.tsx#L18](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.test.tsx#L18) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [exceptions_viewer_header.test.tsx#L47](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.test.tsx#L47) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [exceptions_viewer_header.test.tsx#L47](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.test.tsx#L47) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [exceptions_viewer_header.test.tsx#L65](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.test.tsx#L65) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [exceptions_viewer_header.test.tsx#L83](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.test.tsx#L83) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [exceptions_viewer_header.test.tsx#L101](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.test.tsx#L101) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [exceptions_viewer_header.test.tsx#L101](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.test.tsx#L101) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [exceptions_viewer_header.test.tsx#L141](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.test.tsx#L141) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [exceptions_viewer_header.test.tsx#L141](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.test.tsx#L141) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [exceptions_viewer_header.test.tsx#L181](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.test.tsx#L181) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [exceptions_viewer_header.test.tsx#L199](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.test.tsx#L199) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [exceptions_viewer_header.test.tsx#L217](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.test.tsx#L217) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [exceptions_viewer_header.test.tsx#L217](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.test.tsx#L217) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [exceptions_viewer_header.test.tsx#L238](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.test.tsx#L238) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [exceptions_viewer_header.test.tsx#L238](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.test.tsx#L238) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [exceptions_viewer_header.test.tsx#L259](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.test.tsx#L259) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [exceptions_viewer_header.test.tsx#L259](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.test.tsx#L259) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [index.test.tsx#L15](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/index.test.tsx#L15) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [index.test.tsx#L95](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/index.test.tsx#L95) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [index.test.tsx#L112](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/index.test.tsx#L112) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [index.test.tsx#L148](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/index.test.tsx#L148) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [index.tsx#L85](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx#L85) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [index.tsx#L462](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx#L462) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [index.tsx#L467](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx#L467) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [index.tsx#L472](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx#L472) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [index.tsx#L473](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx#L473) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [index.tsx#L477](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx#L477) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [index.tsx#L481](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx#L481) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [index.tsx#L484](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx#L484) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [constants.ts#L10](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/management/pages/event_filters/constants.ts#L10) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListTypeEnum" text="ExceptionListTypeEnum"/> | [constants.ts#L18](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/management/pages/event_filters/constants.ts#L18) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.comment" text="comment"/> | [shared_imports.ts#L34](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/common/shared_imports.ts#L34) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.comment" text="comment"/> | [helpers.tsx#L33](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L33) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.comment" text="comment"/> | [helpers.tsx#L363](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L363) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.exceptionListType" text="exceptionListType"/> | [shared_imports.ts#L33](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/common/shared_imports.ts#L33) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.exceptionListType" text="exceptionListType"/> | [lists.ts#L10](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/common/detection_engine/schemas/types/lists.ts#L10) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.exceptionListType" text="exceptionListType"/> | [lists.ts#L21](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/common/detection_engine/schemas/types/lists.ts#L21) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.entry" text="entry"/> | [shared_imports.ts#L37](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/common/shared_imports.ts#L37) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.entry" text="entry"/> | [helpers.tsx#L34](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L34) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.entry" text="entry"/> | [helpers.tsx#L252](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L252) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.entriesNested" text="entriesNested"/> | [shared_imports.ts#L38](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/common/shared_imports.ts#L38) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.entriesNested" text="entriesNested"/> | [helpers.tsx#L10](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/helpers.tsx#L10) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.entriesNested" text="entriesNested"/> | [helpers.tsx#L44](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/helpers.tsx#L44) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.entriesNested" text="entriesNested"/> | [helpers.tsx#L35](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L35) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.entriesNested" text="entriesNested"/> | [helpers.tsx#L232](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L232) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.entriesNested" text="entriesNested"/> | [helpers.tsx#L244](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L244) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.entriesMatch" text="entriesMatch"/> | [shared_imports.ts#L40](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/common/shared_imports.ts#L40) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.entriesMatchAny" text="entriesMatchAny"/> | [shared_imports.ts#L41](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/common/shared_imports.ts#L41) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.entriesMatchWildcard" text="entriesMatchWildcard"/> | [shared_imports.ts#L42](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/common/shared_imports.ts#L42) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.entriesExists" text="entriesExists"/> | [shared_imports.ts#L43](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/common/shared_imports.ts#L43) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.entriesList" text="entriesList"/> | [shared_imports.ts#L44](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/common/shared_imports.ts#L44) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.entriesList" text="entriesList"/> | [create_field_and_set_tuples.ts#L8](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/lib/detection_engine/signals/filters/create_field_and_set_tuples.ts#L8) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.entriesList" text="entriesList"/> | [create_field_and_set_tuples.ts#L20](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/lib/detection_engine/signals/filters/create_field_and_set_tuples.ts#L20) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.entriesList" text="entriesList"/> | [filter_events_against_list.ts#L8](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/lib/detection_engine/signals/filters/filter_events_against_list.ts#L8) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.entriesList" text="entriesList"/> | [filter_events_against_list.ts#L55](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/lib/detection_engine/signals/filters/filter_events_against_list.ts#L55) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListType" text="ExceptionListType"/> | [shared_imports.ts#L46](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/common/shared_imports.ts#L46) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListType" text="ExceptionListType"/> | [reducer.ts#L15](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/reducer.ts#L15) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListType" text="ExceptionListType"/> | [reducer.ts#L31](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/reducer.ts#L31) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListType" text="ExceptionListType"/> | [reducer.ts#L57](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/viewer/reducer.ts#L57) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListType" text="ExceptionListType"/> | [use_fetch_or_create_rule_exception_list.test.tsx#L15](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/use_fetch_or_create_rule_exception_list.test.tsx#L15) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListType" text="ExceptionListType"/> | [use_fetch_or_create_rule_exception_list.test.tsx#L46](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/use_fetch_or_create_rule_exception_list.test.tsx#L46) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListType" text="ExceptionListType"/> | [use_fetch_or_create_rule_exception_list.test.tsx#L47](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/use_fetch_or_create_rule_exception_list.test.tsx#L47) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListType" text="ExceptionListType"/> | [helpers.tsx#L44](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L44) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListType" text="ExceptionListType"/> | [helpers.tsx#L59](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L59) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListType" text="ExceptionListType"/> | [index.tsx#L37](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.tsx#L37) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListType" text="ExceptionListType"/> | [index.tsx#L70](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.tsx#L70) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListType" text="ExceptionListType"/> | [helpers.ts#L16](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/helpers.ts#L16) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListType" text="ExceptionListType"/> | [helpers.ts#L319](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/helpers.ts#L319) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListType" text="ExceptionListType"/> | [index.tsx#L36](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/edit_exception_modal/index.tsx#L36) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListType" text="ExceptionListType"/> | [index.tsx#L63](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/edit_exception_modal/index.tsx#L63) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListType" text="ExceptionListType"/> | [constants.ts#L9](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/management/pages/event_filters/constants.ts#L9) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListType" text="ExceptionListType"/> | [constants.ts#L18](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/management/pages/event_filters/constants.ts#L18) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListType" text="ExceptionListType"/> | [alert_context_menu.tsx#L47](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alert_context_menu.tsx#L47) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.ExceptionListType" text="ExceptionListType"/> | [alert_context_menu.tsx#L113](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alert_context_menu.tsx#L113) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.osType" text="osType"/> | [shared_imports.ts#L55](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/common/shared_imports.ts#L55) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.osType" text="osType"/> | [helpers.tsx#L43](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L43) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.osType" text="osType"/> | [helpers.tsx#L404](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L404) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.osTypeArray" text="osTypeArray"/> | [shared_imports.ts#L56](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/common/shared_imports.ts#L56) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OsTypeArray" text="OsTypeArray"/> | [shared_imports.ts#L57](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/common/shared_imports.ts#L57) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OsTypeArray" text="OsTypeArray"/> | [helpers.tsx#L41](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L41) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OsTypeArray" text="OsTypeArray"/> | [helpers.tsx#L60](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L60) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OsTypeArray" text="OsTypeArray"/> | [helpers.tsx#L389](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L389) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OsTypeArray" text="OsTypeArray"/> | [helpers.tsx#L399](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L399) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OsTypeArray" text="OsTypeArray"/> | [helpers.tsx#L400](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx#L400) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OsTypeArray" text="OsTypeArray"/> | [index.tsx#L65](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.tsx#L65) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OsTypeArray" text="OsTypeArray"/> | [index.tsx#L305](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.tsx#L305) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OsTypeArray" text="OsTypeArray"/> | [index.tsx#L56](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/edit_exception_modal/index.tsx#L56) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OsTypeArray" text="OsTypeArray"/> | [index.tsx#L285](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/edit_exception_modal/index.tsx#L285) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OsTypeArray" text="OsTypeArray"/> | [helpers.test.tsx#L63](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx#L63) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OsTypeArray" text="OsTypeArray"/> | [helpers.test.tsx#L596](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx#L596) | - |
-| <DocLink id="kibListsPluginApi" section="def-common.OsTypeArray" text="OsTypeArray"/> | [helpers.test.tsx#L609](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx#L609) | - |
 | <DocLink id="kibCorePluginApi" section="def-public.AppLeaveHandler" text="AppLeaveHandler"/> | [index.tsx#L14](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/timelines/components/flyout/index.tsx#L14) | - |
 | <DocLink id="kibCorePluginApi" section="def-public.AppLeaveHandler" text="AppLeaveHandler"/> | [index.tsx#L30](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/timelines/components/flyout/index.tsx#L30) | - |
 | <DocLink id="kibCorePluginApi" section="def-public.AppLeaveHandler" text="AppLeaveHandler"/> | [index.tsx#L27](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/app/home/index.tsx#L27) | - |
@@ -2381,27 +438,11 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 | <DocLink id="kibCorePluginApi" section="def-public.AppLeaveHandler" text="AppLeaveHandler"/> | [app.tsx#L14](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/app/app.tsx#L14) | - |
 | <DocLink id="kibCorePluginApi" section="def-public.AppLeaveHandler" text="AppLeaveHandler"/> | [app.tsx#L33](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/app/app.tsx#L33) | - |
 | <DocLink id="kibCorePluginApi" section="def-public.AppLeaveHandler" text="AppLeaveHandler"/> | [app.tsx#L73](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/public/app/app.tsx#L73) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [metadata.test.ts#L9](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata.test.ts#L9) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [metadata.test.ts#L57](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata.test.ts#L57) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [metadata.test.ts#L80](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata.test.ts#L80) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [metadata_v1.test.ts#L9](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata_v1.test.ts#L9) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [metadata_v1.test.ts#L52](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata_v1.test.ts#L52) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyClusterClient" text="ILegacyClusterClient"/> | [metadata_v1.test.ts#L74](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata_v1.test.ts#L74) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [service.ts#L11](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/endpoint/routes/policy/service.ts#L11) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [service.ts#L52](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/endpoint/routes/policy/service.ts#L52) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [mocks.ts#L8](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/endpoint/mocks.ts#L8) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [mocks.ts#L135](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/endpoint/mocks.ts#L135) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [metadata.test.ts#L10](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata.test.ts#L10) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [metadata.test.ts#L58](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata.test.ts#L58) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [metadata_v1.test.ts#L10](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata_v1.test.ts#L10) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [metadata_v1.test.ts#L53](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/endpoint/routes/metadata/metadata_v1.test.ts#L53) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [handlers.test.ts#L16](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/endpoint/routes/policy/handlers.test.ts#L16) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.ILegacyScopedClusterClient" text="ILegacyScopedClusterClient"/> | [handlers.test.ts#L36](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/endpoint/routes/policy/handlers.test.ts#L36) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [sender.ts#L10](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/lib/telemetry/sender.ts#L10) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [sender.ts#L447](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/lib/telemetry/sender.ts#L447) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [sender.ts#L466](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/lib/telemetry/sender.ts#L466) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyCallAPIOptions" text="LegacyCallAPIOptions"/> | [types.ts#L53](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/lib/detection_engine/types.ts#L53) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.LegacyCallAPIOptions" text="LegacyCallAPIOptions"/> | [types.ts#L110](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/lib/detection_engine/types.ts#L110) | - |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [sender.ts#L10](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/lib/telemetry/sender.ts#L10) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [sender.ts#L447](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/lib/telemetry/sender.ts#L447) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [sender.ts#L466](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/lib/telemetry/sender.ts#L466) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyCallAPIOptions" text="LegacyCallAPIOptions"/> | [types.ts#L53](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/lib/detection_engine/types.ts#L53) | 7.16 |
+| <DocLink id="kibCorePluginApi" section="def-server.LegacyCallAPIOptions" text="LegacyCallAPIOptions"/> | [types.ts#L110](https://github.com/elastic/kibana/tree/master/x-pack/plugins/security_solution/server/lib/detection_engine/types.ts#L110) | 7.16 |
 
 
 
diff --git a/api_docs/event_log.json b/api_docs/event_log.json
index 74175ad318761..0804068c4e108 100644
--- a/api_docs/event_log.json
+++ b/api_docs/event_log.json
@@ -687,7 +687,7 @@
             "label": "logEvent",
             "description": [],
             "signature": [
-              "(properties: DeepPartial<DeepWriteable<Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; url?: string | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; hash?: string | undefined; provider?: string | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; uuid?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; } & {}>>> | undefined) => void"
+              "(properties: DeepPartial<DeepWriteable<Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; url?: string | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}>>> | undefined) => void"
             ],
             "source": {
               "path": "x-pack/plugins/event_log/server/types.ts",
@@ -703,7 +703,7 @@
                 "label": "properties",
                 "description": [],
                 "signature": [
-                  "DeepPartial<DeepWriteable<Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; url?: string | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; hash?: string | undefined; provider?: string | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; uuid?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; } & {}>>> | undefined"
+                  "DeepPartial<DeepWriteable<Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; url?: string | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}>>> | undefined"
                 ],
                 "source": {
                   "path": "x-pack/plugins/event_log/server/types.ts",
@@ -723,7 +723,7 @@
             "label": "startTiming",
             "description": [],
             "signature": [
-              "(event: DeepPartial<DeepWriteable<Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; url?: string | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; hash?: string | undefined; provider?: string | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; uuid?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; } & {}>>> | undefined) => void"
+              "(event: DeepPartial<DeepWriteable<Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; url?: string | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}>>> | undefined) => void"
             ],
             "source": {
               "path": "x-pack/plugins/event_log/server/types.ts",
@@ -739,7 +739,7 @@
                 "label": "event",
                 "description": [],
                 "signature": [
-                  "DeepPartial<DeepWriteable<Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; url?: string | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; hash?: string | undefined; provider?: string | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; uuid?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; } & {}>>> | undefined"
+                  "DeepPartial<DeepWriteable<Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; url?: string | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}>>> | undefined"
                 ],
                 "source": {
                   "path": "x-pack/plugins/event_log/server/types.ts",
@@ -759,7 +759,7 @@
             "label": "stopTiming",
             "description": [],
             "signature": [
-              "(event: DeepPartial<DeepWriteable<Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; url?: string | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; hash?: string | undefined; provider?: string | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; uuid?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; } & {}>>> | undefined) => void"
+              "(event: DeepPartial<DeepWriteable<Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; url?: string | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}>>> | undefined) => void"
             ],
             "source": {
               "path": "x-pack/plugins/event_log/server/types.ts",
@@ -775,7 +775,7 @@
                 "label": "event",
                 "description": [],
                 "signature": [
-                  "DeepPartial<DeepWriteable<Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; url?: string | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; hash?: string | undefined; provider?: string | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; uuid?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; } & {}>>> | undefined"
+                  "DeepPartial<DeepWriteable<Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; url?: string | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}>>> | undefined"
                 ],
                 "source": {
                   "path": "x-pack/plugins/event_log/server/types.ts",
@@ -850,7 +850,7 @@
             "label": "data",
             "description": [],
             "signature": [
-              "(Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; url?: string | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; hash?: string | undefined; provider?: string | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; uuid?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; } & {}> | undefined)[]"
+              "(Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; url?: string | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}> | undefined)[]"
             ],
             "source": {
               "path": "x-pack/plugins/event_log/server/es/cluster_client_adapter.ts",
@@ -872,7 +872,7 @@
         "label": "IEvent",
         "description": [],
         "signature": [
-          "undefined | DeepPartial<DeepWriteable<Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; url?: string | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; hash?: string | undefined; provider?: string | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; uuid?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; } & {}>>>"
+          "undefined | DeepPartial<DeepWriteable<Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; url?: string | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}>>>"
         ],
         "source": {
           "path": "x-pack/plugins/event_log/generated/schemas.ts",
@@ -889,7 +889,7 @@
         "label": "IValidatedEvent",
         "description": [],
         "signature": [
-          "undefined | Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; url?: string | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; hash?: string | undefined; provider?: string | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; uuid?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; } & {}>"
+          "undefined | Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; url?: string | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}>"
         ],
         "source": {
           "path": "x-pack/plugins/event_log/generated/schemas.ts",
@@ -1171,7 +1171,7 @@
           "label": "getLogger",
           "description": [],
           "signature": [
-            "(properties: DeepPartial<DeepWriteable<Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; url?: string | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; hash?: string | undefined; provider?: string | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; uuid?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; } & {}>>> | undefined) => ",
+            "(properties: DeepPartial<DeepWriteable<Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; url?: string | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}>>> | undefined) => ",
             {
               "pluginId": "eventLog",
               "scope": "server",
@@ -1194,7 +1194,7 @@
               "label": "properties",
               "description": [],
               "signature": [
-                "DeepPartial<DeepWriteable<Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; url?: string | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; hash?: string | undefined; provider?: string | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; uuid?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; } & {}>>> | undefined"
+                "DeepPartial<DeepWriteable<Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; end?: string | undefined; category?: string[] | undefined; url?: string | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}>>> | undefined"
               ],
               "source": {
                 "path": "x-pack/plugins/event_log/server/types.ts",
diff --git a/api_docs/fleet.json b/api_docs/fleet.json
index a1ac222cd16bb..433d47e94dd29 100644
--- a/api_docs/fleet.json
+++ b/api_docs/fleet.json
@@ -243,7 +243,7 @@
         "description": [],
         "source": {
           "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-          "lineNumber": 50
+          "lineNumber": 52
         },
         "deprecated": false,
         "children": [
@@ -256,7 +256,7 @@
             "description": [],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-              "lineNumber": 51
+              "lineNumber": 53
             },
             "deprecated": false
           },
@@ -272,7 +272,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-              "lineNumber": 52
+              "lineNumber": 54
             },
             "deprecated": false
           },
@@ -285,7 +285,7 @@
             "description": [],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-              "lineNumber": 53
+              "lineNumber": 55
             },
             "deprecated": false
           },
@@ -298,7 +298,7 @@
             "description": [],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-              "lineNumber": 54
+              "lineNumber": 56
             },
             "deprecated": false
           },
@@ -311,7 +311,7 @@
             "description": [],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-              "lineNumber": 55
+              "lineNumber": 57
             },
             "deprecated": false
           },
@@ -324,7 +324,7 @@
             "description": [],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-              "lineNumber": 56
+              "lineNumber": 58
             },
             "deprecated": false
           },
@@ -347,7 +347,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-              "lineNumber": 57
+              "lineNumber": 59
             },
             "deprecated": false
           },
@@ -370,7 +370,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-              "lineNumber": 58
+              "lineNumber": 60
             },
             "deprecated": false
           }
@@ -2971,7 +2971,7 @@
         ],
         "source": {
           "path": "x-pack/plugins/fleet/server/services/package_policy.ts",
-          "lineNumber": 648
+          "lineNumber": 650
         },
         "deprecated": false,
         "initialIsOpen": false
@@ -10214,7 +10214,7 @@
         "description": [],
         "source": {
           "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-          "lineNumber": 50
+          "lineNumber": 52
         },
         "deprecated": false,
         "children": [
@@ -10227,7 +10227,7 @@
             "description": [],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-              "lineNumber": 51
+              "lineNumber": 53
             },
             "deprecated": false
           },
@@ -10243,7 +10243,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-              "lineNumber": 52
+              "lineNumber": 54
             },
             "deprecated": false
           },
@@ -10256,7 +10256,7 @@
             "description": [],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-              "lineNumber": 53
+              "lineNumber": 55
             },
             "deprecated": false
           },
@@ -10269,7 +10269,7 @@
             "description": [],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-              "lineNumber": 54
+              "lineNumber": 56
             },
             "deprecated": false
           },
@@ -10282,7 +10282,7 @@
             "description": [],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-              "lineNumber": 55
+              "lineNumber": 57
             },
             "deprecated": false
           },
@@ -10295,7 +10295,7 @@
             "description": [],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-              "lineNumber": 56
+              "lineNumber": 58
             },
             "deprecated": false
           },
@@ -10318,7 +10318,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-              "lineNumber": 57
+              "lineNumber": 59
             },
             "deprecated": false
           },
@@ -10341,7 +10341,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-              "lineNumber": 58
+              "lineNumber": 60
             },
             "deprecated": false
           }
@@ -10357,7 +10357,7 @@
         "description": [],
         "source": {
           "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-          "lineNumber": 37
+          "lineNumber": 38
         },
         "deprecated": false,
         "children": [
@@ -10370,7 +10370,7 @@
             "description": [],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-              "lineNumber": 38
+              "lineNumber": 39
             },
             "deprecated": false
           },
@@ -10383,7 +10383,23 @@
             "description": [],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-              "lineNumber": 39
+              "lineNumber": 40
+            },
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "fleet",
+            "id": "def-common.NewPackagePolicyInput.keep_enabled",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "keep_enabled",
+            "description": [],
+            "signature": [
+              "boolean | undefined"
+            ],
+            "source": {
+              "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
+              "lineNumber": 41
             },
             "deprecated": false
           },
@@ -10407,7 +10423,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-              "lineNumber": 40
+              "lineNumber": 42
             },
             "deprecated": false
           },
@@ -10431,7 +10447,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-              "lineNumber": 41
+              "lineNumber": 43
             },
             "deprecated": false
           },
@@ -10454,7 +10470,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-              "lineNumber": 42
+              "lineNumber": 44
             },
             "deprecated": false
           }
@@ -10487,6 +10503,22 @@
             },
             "deprecated": false
           },
+          {
+            "parentPluginId": "fleet",
+            "id": "def-common.NewPackagePolicyInputStream.keep_enabled",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "keep_enabled",
+            "description": [],
+            "signature": [
+              "boolean | undefined"
+            ],
+            "source": {
+              "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
+              "lineNumber": 24
+            },
+            "deprecated": false
+          },
           {
             "parentPluginId": "fleet",
             "id": "def-common.NewPackagePolicyInputStream.data_stream",
@@ -10499,7 +10531,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-              "lineNumber": 24
+              "lineNumber": 25
             },
             "deprecated": false
           },
@@ -10523,7 +10555,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-              "lineNumber": 28
+              "lineNumber": 29
             },
             "deprecated": false
           },
@@ -10547,7 +10579,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-              "lineNumber": 29
+              "lineNumber": 30
             },
             "deprecated": false
           }
@@ -10581,7 +10613,7 @@
         ],
         "source": {
           "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-          "lineNumber": 65
+          "lineNumber": 67
         },
         "deprecated": false,
         "children": [
@@ -10594,7 +10626,7 @@
             "description": [],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-              "lineNumber": 66
+              "lineNumber": 68
             },
             "deprecated": false
           },
@@ -10617,7 +10649,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-              "lineNumber": 67
+              "lineNumber": 69
             },
             "deprecated": false
           },
@@ -10633,7 +10665,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-              "lineNumber": 68
+              "lineNumber": 70
             },
             "deprecated": false
           },
@@ -10646,7 +10678,7 @@
             "description": [],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-              "lineNumber": 69
+              "lineNumber": 71
             },
             "deprecated": false
           },
@@ -10659,7 +10691,7 @@
             "description": [],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-              "lineNumber": 70
+              "lineNumber": 72
             },
             "deprecated": false
           },
@@ -10672,7 +10704,7 @@
             "description": [],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-              "lineNumber": 71
+              "lineNumber": 73
             },
             "deprecated": false
           },
@@ -10685,7 +10717,7 @@
             "description": [],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-              "lineNumber": 72
+              "lineNumber": 74
             },
             "deprecated": false
           },
@@ -10698,7 +10730,7 @@
             "description": [],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-              "lineNumber": 73
+              "lineNumber": 75
             },
             "deprecated": false
           }
@@ -10792,11 +10824,11 @@
             "section": "def-common.NewPackagePolicyInput",
             "text": "NewPackagePolicyInput"
           },
-          ", \"type\" | \"enabled\" | \"config\" | \"vars\">"
+          ", \"type\" | \"enabled\" | \"config\" | \"keep_enabled\" | \"vars\">"
         ],
         "source": {
           "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-          "lineNumber": 45
+          "lineNumber": 47
         },
         "deprecated": false,
         "children": [
@@ -10819,7 +10851,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-              "lineNumber": 46
+              "lineNumber": 48
             },
             "deprecated": false
           },
@@ -10835,7 +10867,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-              "lineNumber": 47
+              "lineNumber": 49
             },
             "deprecated": false
           }
@@ -10868,7 +10900,7 @@
         ],
         "source": {
           "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-          "lineNumber": 32
+          "lineNumber": 33
         },
         "deprecated": false,
         "children": [
@@ -10881,7 +10913,7 @@
             "description": [],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-              "lineNumber": 33
+              "lineNumber": 34
             },
             "deprecated": false
           },
@@ -10897,7 +10929,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-              "lineNumber": 34
+              "lineNumber": 35
             },
             "deprecated": false
           }
@@ -11170,7 +11202,7 @@
             "label": "categories",
             "description": [],
             "signature": [
-              "(\"custom\" | \"security\" | \"monitoring\" | \"network\" | \"cloud\" | \"kubernetes\" | \"aws\" | \"azure\" | \"config_management\" | \"containers\" | \"crm\" | \"datastore\" | \"elastic_stack\" | \"google_cloud\" | \"languages\" | \"message_queue\" | \"notification\" | \"os_system\" | \"productivity\" | \"support\" | \"ticketing\" | \"version_control\" | \"web\" | undefined)[] | undefined"
+              "(\"custom\" | \"security\" | \"monitoring\" | \"cloud\" | \"kubernetes\" | \"aws\" | \"azure\" | \"config_management\" | \"containers\" | \"crm\" | \"datastore\" | \"elastic_stack\" | \"google_cloud\" | \"languages\" | \"message_queue\" | \"network\" | \"notification\" | \"os_system\" | \"productivity\" | \"support\" | \"ticketing\" | \"version_control\" | \"web\" | undefined)[] | undefined"
             ],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/models/package_spec.ts",
@@ -13314,7 +13346,7 @@
         ],
         "source": {
           "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-          "lineNumber": 61
+          "lineNumber": 63
         },
         "deprecated": false,
         "children": [
@@ -13330,7 +13362,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-              "lineNumber": 62
+              "lineNumber": 64
             },
             "deprecated": false
           }
@@ -15065,7 +15097,7 @@
         ],
         "source": {
           "path": "x-pack/plugins/fleet/common/types/models/package_policy.ts",
-          "lineNumber": 76
+          "lineNumber": 78
         },
         "deprecated": false,
         "initialIsOpen": false
@@ -15112,7 +15144,7 @@
         "label": "PackageSpecCategory",
         "description": [],
         "signature": [
-          "\"custom\" | \"security\" | \"monitoring\" | \"network\" | \"cloud\" | \"kubernetes\" | \"aws\" | \"azure\" | \"config_management\" | \"containers\" | \"crm\" | \"datastore\" | \"elastic_stack\" | \"google_cloud\" | \"languages\" | \"message_queue\" | \"notification\" | \"os_system\" | \"productivity\" | \"support\" | \"ticketing\" | \"version_control\" | \"web\""
+          "\"custom\" | \"security\" | \"monitoring\" | \"cloud\" | \"kubernetes\" | \"aws\" | \"azure\" | \"config_management\" | \"containers\" | \"crm\" | \"datastore\" | \"elastic_stack\" | \"google_cloud\" | \"languages\" | \"message_queue\" | \"network\" | \"notification\" | \"os_system\" | \"productivity\" | \"support\" | \"ticketing\" | \"version_control\" | \"web\""
         ],
         "source": {
           "path": "x-pack/plugins/fleet/common/types/models/package_spec.ts",
diff --git a/api_docs/home.json b/api_docs/home.json
index 55d93aaf19def..350f8a04dc09d 100644
--- a/api_docs/home.json
+++ b/api_docs/home.json
@@ -963,7 +963,7 @@
               "plugin": "cloud",
               "link": {
                 "path": "x-pack/plugins/cloud/public/plugin.ts",
-                "lineNumber": 67
+                "lineNumber": 66
               }
             },
             {
@@ -977,7 +977,7 @@
               "plugin": "apm",
               "link": {
                 "path": "x-pack/plugins/apm/public/plugin.ts",
-                "lineNumber": 86
+                "lineNumber": 82
               }
             }
           ]
diff --git a/api_docs/kibana_react.json b/api_docs/kibana_react.json
index 1918c347e180e..0edb7b93454ed 100644
--- a/api_docs/kibana_react.json
+++ b/api_docs/kibana_react.json
@@ -37,7 +37,7 @@
         ],
         "source": {
           "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-          "lineNumber": 86
+          "lineNumber": 84
         },
         "deprecated": false,
         "children": [
@@ -53,7 +53,7 @@
             ],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 90
+              "lineNumber": 88
             },
             "deprecated": false,
             "children": [
@@ -75,7 +75,7 @@
                 ],
                 "source": {
                   "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-                  "lineNumber": 90
+                  "lineNumber": 88
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -95,7 +95,7 @@
             ],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 111
+              "lineNumber": 109
             },
             "deprecated": false,
             "children": [],
@@ -113,7 +113,7 @@
             ],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 115
+              "lineNumber": 113
             },
             "deprecated": false,
             "children": [],
@@ -131,7 +131,7 @@
             ],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 120
+              "lineNumber": 118
             },
             "deprecated": false,
             "children": [],
@@ -149,7 +149,7 @@
             ],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 124
+              "lineNumber": 122
             },
             "deprecated": false
           },
@@ -165,7 +165,7 @@
             ],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 156
+              "lineNumber": 154
             },
             "deprecated": false,
             "children": [],
@@ -183,7 +183,7 @@
             ],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 166
+              "lineNumber": 164
             },
             "deprecated": false,
             "children": [],
@@ -201,7 +201,7 @@
             ],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 196
+              "lineNumber": 194
             },
             "deprecated": false,
             "children": [],
@@ -219,7 +219,7 @@
             ],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 200
+              "lineNumber": 198
             },
             "deprecated": false,
             "children": [],
@@ -237,7 +237,7 @@
             ],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 204
+              "lineNumber": 202
             },
             "deprecated": false,
             "children": [
@@ -250,7 +250,7 @@
                 "description": [],
                 "source": {
                   "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-                  "lineNumber": 204
+                  "lineNumber": 202
                 },
                 "deprecated": false,
                 "children": [
@@ -263,7 +263,7 @@
                     "description": [],
                     "source": {
                       "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-                      "lineNumber": 204
+                      "lineNumber": 202
                     },
                     "deprecated": false
                   }
@@ -284,7 +284,7 @@
             ],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 215
+              "lineNumber": 213
             },
             "deprecated": false,
             "children": [],
@@ -302,7 +302,7 @@
             ],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 223
+              "lineNumber": 221
             },
             "deprecated": false,
             "children": [],
@@ -320,7 +320,7 @@
             ],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 277
+              "lineNumber": 275
             },
             "deprecated": false,
             "children": [],
@@ -338,7 +338,7 @@
             ],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 319
+              "lineNumber": 317
             },
             "deprecated": false,
             "children": [],
@@ -346,35 +346,17 @@
           },
           {
             "parentPluginId": "kibanaReact",
-            "id": "def-public.TableListView.renderToolsLeft",
+            "id": "def-public.TableListView.renderNoItemsMessage",
             "type": "Function",
             "tags": [],
-            "label": "renderToolsLeft",
-            "description": [],
-            "signature": [
-              "() => JSX.Element | undefined"
-            ],
-            "source": {
-              "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 350
-            },
-            "deprecated": false,
-            "children": [],
-            "returnComment": []
-          },
-          {
-            "parentPluginId": "kibanaReact",
-            "id": "def-public.TableListView.renderTable",
-            "type": "Function",
-            "tags": [],
-            "label": "renderTable",
+            "label": "renderNoItemsMessage",
             "description": [],
             "signature": [
               "() => JSX.Element"
             ],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 381
+              "lineNumber": 348
             },
             "deprecated": false,
             "children": [],
@@ -382,17 +364,17 @@
           },
           {
             "parentPluginId": "kibanaReact",
-            "id": "def-public.TableListView.renderListingOrEmptyState",
+            "id": "def-public.TableListView.renderToolsLeft",
             "type": "Function",
             "tags": [],
-            "label": "renderListingOrEmptyState",
+            "label": "renderToolsLeft",
             "description": [],
             "signature": [
-              "() => JSX.Element"
+              "() => JSX.Element | undefined"
             ],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 461
+              "lineNumber": 370
             },
             "deprecated": false,
             "children": [],
@@ -400,17 +382,17 @@
           },
           {
             "parentPluginId": "kibanaReact",
-            "id": "def-public.TableListView.renderListing",
+            "id": "def-public.TableListView.renderTable",
             "type": "Function",
             "tags": [],
-            "label": "renderListing",
+            "label": "renderTable",
             "description": [],
             "signature": [
               "() => JSX.Element"
             ],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 468
+              "lineNumber": 401
             },
             "deprecated": false,
             "children": [],
@@ -418,17 +400,17 @@
           },
           {
             "parentPluginId": "kibanaReact",
-            "id": "def-public.TableListView.renderPageContent",
+            "id": "def-public.TableListView.renderCreateButton",
             "type": "Function",
             "tags": [],
-            "label": "renderPageContent",
+            "label": "renderCreateButton",
             "description": [],
             "signature": [
               "() => JSX.Element | undefined"
             ],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 513
+              "lineNumber": 481
             },
             "deprecated": false,
             "children": [],
@@ -446,7 +428,7 @@
             ],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 525
+              "lineNumber": 500
             },
             "deprecated": false,
             "children": [],
@@ -1057,6 +1039,59 @@
         "deprecated": false,
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "kibanaReact",
+        "id": "def-public.KibanaPageTemplate",
+        "type": "Function",
+        "tags": [],
+        "label": "KibanaPageTemplate",
+        "description": [],
+        "signature": [
+          "({ template, pageHeader, children, isEmptyState, restrictWidth, bottomBar, bottomBarProps, ...rest }: React.PropsWithChildren<",
+          {
+            "pluginId": "kibanaReact",
+            "scope": "public",
+            "docId": "kibKibanaReactPluginApi",
+            "section": "def-public.KibanaPageTemplateProps",
+            "text": "KibanaPageTemplateProps"
+          },
+          ">) => JSX.Element"
+        ],
+        "source": {
+          "path": "src/plugins/kibana_react/public/page_template/page_template.tsx",
+          "lineNumber": 22
+        },
+        "deprecated": false,
+        "children": [
+          {
+            "parentPluginId": "kibanaReact",
+            "id": "def-public.KibanaPageTemplate.$1",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "{\n  template,\n  pageHeader,\n  children,\n  isEmptyState,\n  restrictWidth = true,\n  bottomBar,\n  bottomBarProps,\n  ...rest\n}",
+            "description": [],
+            "signature": [
+              "React.PropsWithChildren<",
+              {
+                "pluginId": "kibanaReact",
+                "scope": "public",
+                "docId": "kibKibanaReactPluginApi",
+                "section": "def-public.KibanaPageTemplateProps",
+                "text": "KibanaPageTemplateProps"
+              },
+              ">"
+            ],
+            "source": {
+              "path": "src/plugins/kibana_react/public/page_template/page_template.tsx",
+              "lineNumber": 22
+            },
+            "deprecated": false,
+            "isRequired": true
+          }
+        ],
+        "returnComment": [],
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "kibanaReact",
         "id": "def-public.Markdown",
@@ -2718,7 +2753,7 @@
         "description": [],
         "source": {
           "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-          "lineNumber": 38
+          "lineNumber": 33
         },
         "deprecated": false,
         "children": [
@@ -2734,7 +2769,7 @@
             ],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 39
+              "lineNumber": 34
             },
             "deprecated": false,
             "children": [],
@@ -2752,7 +2787,7 @@
             ],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 40
+              "lineNumber": 35
             },
             "deprecated": false,
             "children": [
@@ -2768,7 +2803,7 @@
                 ],
                 "source": {
                   "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-                  "lineNumber": 40
+                  "lineNumber": 35
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -2788,7 +2823,7 @@
             ],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 41
+              "lineNumber": 36
             },
             "deprecated": false,
             "children": [
@@ -2804,7 +2839,7 @@
                 ],
                 "source": {
                   "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-                  "lineNumber": 41
+                  "lineNumber": 36
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -2821,7 +2856,7 @@
             "description": [],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 42
+              "lineNumber": 37
             },
             "deprecated": false
           },
@@ -2834,7 +2869,7 @@
             "description": [],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 43
+              "lineNumber": 38
             },
             "deprecated": false
           },
@@ -2850,7 +2885,7 @@
             ],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 44
+              "lineNumber": 39
             },
             "deprecated": false,
             "children": [
@@ -2866,7 +2901,7 @@
                 ],
                 "source": {
                   "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-                  "lineNumber": 44
+                  "lineNumber": 39
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -2883,7 +2918,7 @@
             "description": [],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 45
+              "lineNumber": 40
             },
             "deprecated": false
           },
@@ -2896,7 +2931,7 @@
             "description": [],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 46
+              "lineNumber": 41
             },
             "deprecated": false
           },
@@ -2909,23 +2944,25 @@
             "description": [],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 47
+              "lineNumber": 42
             },
             "deprecated": false
           },
           {
             "parentPluginId": "kibanaReact",
-            "id": "def-public.TableListViewProps.noItemsFragment",
+            "id": "def-public.TableListViewProps.emptyPrompt",
             "type": "Object",
             "tags": [],
-            "label": "noItemsFragment",
-            "description": [],
+            "label": "emptyPrompt",
+            "description": [
+              "\nShould be an EuiEmptyPrompt (but TS doesn't support this typing)"
+            ],
             "signature": [
               "JSX.Element | undefined"
             ],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 48
+              "lineNumber": 46
             },
             "deprecated": false
           },
@@ -2942,7 +2979,7 @@
             ],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 49
+              "lineNumber": 47
             },
             "deprecated": false
           },
@@ -2955,7 +2992,7 @@
             "description": [],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 50
+              "lineNumber": 48
             },
             "deprecated": false
           },
@@ -2979,7 +3016,7 @@
             ],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 51
+              "lineNumber": 49
             },
             "deprecated": false
           },
@@ -2997,7 +3034,7 @@
             ],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 56
+              "lineNumber": 54
             },
             "deprecated": false
           },
@@ -3012,7 +3049,7 @@
             ],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 60
+              "lineNumber": 58
             },
             "deprecated": false
           },
@@ -3025,12 +3062,9 @@
             "description": [
               "\nDescribes the content of the table. If not specified, the caption will be \"This table contains {itemCount} rows.\""
             ],
-            "signature": [
-              "string | undefined"
-            ],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 64
+              "lineNumber": 62
             },
             "deprecated": false
           },
@@ -3047,7 +3081,7 @@
             ],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 65
+              "lineNumber": 63
             },
             "deprecated": false
           }
@@ -3063,7 +3097,7 @@
         "description": [],
         "source": {
           "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-          "lineNumber": 68
+          "lineNumber": 66
         },
         "deprecated": false,
         "children": [
@@ -3079,7 +3113,7 @@
             ],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 69
+              "lineNumber": 67
             },
             "deprecated": false
           },
@@ -3092,7 +3126,7 @@
             "description": [],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 70
+              "lineNumber": 68
             },
             "deprecated": false
           },
@@ -3105,7 +3139,7 @@
             "description": [],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 71
+              "lineNumber": 69
             },
             "deprecated": false
           },
@@ -3118,7 +3152,7 @@
             "description": [],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 72
+              "lineNumber": 70
             },
             "deprecated": false
           },
@@ -3131,7 +3165,7 @@
             "description": [],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 73
+              "lineNumber": 71
             },
             "deprecated": false
           },
@@ -3144,7 +3178,7 @@
             "description": [],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 74
+              "lineNumber": 72
             },
             "deprecated": false
           },
@@ -3161,7 +3195,7 @@
             ],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 75
+              "lineNumber": 73
             },
             "deprecated": false
           },
@@ -3174,7 +3208,7 @@
             "description": [],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 76
+              "lineNumber": 74
             },
             "deprecated": false
           },
@@ -3190,7 +3224,7 @@
             ],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 77
+              "lineNumber": 75
             },
             "deprecated": false
           },
@@ -3203,7 +3237,7 @@
             "description": [],
             "source": {
               "path": "src/plugins/kibana_react/public/table_list_view/table_list_view.tsx",
-              "lineNumber": 78
+              "lineNumber": 76
             },
             "deprecated": false
           }
@@ -3558,6 +3592,32 @@
         "deprecated": false,
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "kibanaReact",
+        "id": "def-public.KibanaPageTemplateProps",
+        "type": "Type",
+        "tags": [],
+        "label": "KibanaPageTemplateProps",
+        "description": [],
+        "signature": [
+          "Pick<",
+          "EuiPageProps",
+          ", \"children\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"title\" | \"id\" | \"placeholder\" | \"defaultChecked\" | \"defaultValue\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"className\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"hidden\" | \"lang\" | \"slot\" | \"spellCheck\" | \"style\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"role\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"security\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-label\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"css\" | \"grow\" | \"data-test-subj\" | \"direction\" | \"restrictWidth\"> & ",
+          "DisambiguateSet",
+          "<{ template?: \"default\" | undefined; bottomBar?: React.ReactNode; bottomBarProps?: (",
+          "CommonProps",
+          " & React.HTMLAttributes<HTMLElement> & ",
+          "DisambiguateSet",
+          "<{ position?: \"fixed\" | undefined; usePortal?: boolean | undefined; affordForDisplacement?: boolean | undefined; }, { position: \"static\" | \"sticky\"; }> & { position: \"static\" | \"sticky\"; } & { paddingSize?: \"m\" | \"s\" | \"none\" | \"l\" | undefined; bodyClassName?: string | undefined; landmarkHeading?: string | undefined; top?: string | number | undefined; right?: string | number | undefined; bottom?: string | number | undefined; left?: string | number | undefined; }) | (",
+          "CommonProps"
+        ],
+        "source": {
+          "path": "src/plugins/kibana_react/public/page_template/page_template.tsx",
+          "lineNumber": 12
+        },
+        "deprecated": false,
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "kibanaReact",
         "id": "def-public.KibanaServices",
diff --git a/api_docs/licensing.json b/api_docs/licensing.json
index bfef0eb7c7c1a..093ebeebfb355 100644
--- a/api_docs/licensing.json
+++ b/api_docs/licensing.json
@@ -605,6 +605,20 @@
                   "lineNumber": 44
                 }
               },
+              {
+                "plugin": "securitySolution",
+                "link": {
+                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/actions/isolation.test.ts",
+                  "lineNumber": 54
+                }
+              },
+              {
+                "plugin": "securitySolution",
+                "link": {
+                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/actions/isolation.test.ts",
+                  "lineNumber": 55
+                }
+              },
               {
                 "plugin": "securitySolution",
                 "link": {
@@ -2181,6 +2195,20 @@
                   "lineNumber": 44
                 }
               },
+              {
+                "plugin": "securitySolution",
+                "link": {
+                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/actions/isolation.test.ts",
+                  "lineNumber": 54
+                }
+              },
+              {
+                "plugin": "securitySolution",
+                "link": {
+                  "path": "x-pack/plugins/security_solution/server/endpoint/routes/actions/isolation.test.ts",
+                  "lineNumber": 55
+                }
+              },
               {
                 "plugin": "securitySolution",
                 "link": {
diff --git a/api_docs/lists.json b/api_docs/lists.json
index 4e97dd9f8449f..fb258fa0ac0a2 100644
--- a/api_docs/lists.json
+++ b/api_docs/lists.json
@@ -320,7 +320,7 @@
         "signature": [
           "({ http, listItem, signal, }: ",
           "AddExceptionListItemProps",
-          ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
+          ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
         ],
         "source": {
           "path": "x-pack/plugins/lists/public/exceptions/api.ts",
@@ -474,7 +474,7 @@
         "label": "transformNewItemOutput",
         "description": [],
         "signature": [
-          "(exceptionItem: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) => { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
+          "(exceptionItem: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) => { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
         ],
         "source": {
           "path": "x-pack/plugins/lists/public/exceptions/transforms.ts",
@@ -490,7 +490,7 @@
             "label": "exceptionItem",
             "description": [],
             "signature": [
-              "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
+              "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
             ],
             "source": {
               "path": "x-pack/plugins/lists/public/exceptions/transforms.ts",
@@ -513,7 +513,7 @@
           "\nTransforms the output of exception items to compensate for technical debt or UI concerns such as\nReactJS preferences for having ids within arrays if the data is not modeled that way.\n\nIf you add a new transform of the output called \"myNewTransform\" do it\nin the form of:\nflow(removeIdFromExceptionItemsEntries, myNewTransform)(exceptionItem)\n"
         ],
         "signature": [
-          "(exceptionItem: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })) => { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })"
+          "(exceptionItem: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })) => { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })"
         ],
         "source": {
           "path": "x-pack/plugins/lists/public/exceptions/transforms.ts",
@@ -529,7 +529,7 @@
             "label": "exceptionItem",
             "description": [],
             "signature": [
-              "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })"
+              "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })"
             ],
             "source": {
               "path": "x-pack/plugins/lists/public/exceptions/transforms.ts",
@@ -554,7 +554,7 @@
         "signature": [
           "({ http, listItem, signal, }: ",
           "UpdateExceptionListItemProps",
-          ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
+          ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
         ],
         "source": {
           "path": "x-pack/plugins/lists/public/exceptions/api.ts",
@@ -1416,7 +1416,7 @@
             "label": "exceptions",
             "description": [],
             "signature": [
-              "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]"
+              "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]"
             ],
             "source": {
               "path": "x-pack/plugins/lists/public/exceptions/types.ts",
@@ -1658,7 +1658,7 @@
             "signature": [
               "({ itemId, id, namespaceType, }: ",
               "GetExceptionListItemOptions",
-              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
+              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
@@ -1760,7 +1760,7 @@
             "signature": [
               "({ comments, description, entries, itemId, meta, name, osTypes, tags, type, }: ",
               "CreateEndpointListItemOptions",
-              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
+              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
@@ -1800,7 +1800,7 @@
             "signature": [
               "({ _version, comments, description, entries, id, itemId, meta, name, osTypes, tags, type, }: ",
               "UpdateEndpointListItemOptions",
-              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
+              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
@@ -1840,7 +1840,7 @@
             "signature": [
               "({ itemId, id, }: ",
               "GetEndpointListItemOptions",
-              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
+              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
@@ -1998,7 +1998,7 @@
                 "section": "def-server.CreateExceptionListItemOptions",
                 "text": "CreateExceptionListItemOptions"
               },
-              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
+              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
@@ -2048,7 +2048,7 @@
                 "section": "def-server.UpdateExceptionListItemOptions",
                 "text": "UpdateExceptionListItemOptions"
               },
-              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
+              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
@@ -2092,7 +2092,7 @@
             "signature": [
               "({ id, itemId, namespaceType, }: ",
               "DeleteExceptionListItemOptions",
-              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
+              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
@@ -2170,7 +2170,7 @@
             "signature": [
               "({ id, itemId, }: ",
               "DeleteEndpointListItemOptions",
-              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
+              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
@@ -2208,7 +2208,7 @@
             "signature": [
               "({ listId, filter, perPage, page, sortField, sortOrder, namespaceType, }: ",
               "FindExceptionListItemOptions",
-              ") => Promise<{ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } | null>"
+              ") => Promise<{ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } | null>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
@@ -2246,7 +2246,7 @@
             "signature": [
               "({ listId, filter, perPage, page, sortField, sortOrder, namespaceType, }: ",
               "FindExceptionListsItemOptions",
-              ") => Promise<{ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } | null>"
+              ") => Promise<{ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } | null>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
@@ -2284,7 +2284,7 @@
             "signature": [
               "({ perPage, page, sortField, sortOrder, valueListId, }: ",
               "FindValueListExceptionListsItems",
-              ") => Promise<{ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } | null>"
+              ") => Promise<{ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } | null>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
@@ -2362,7 +2362,7 @@
             "signature": [
               "({ filter, perPage, page, sortField, sortOrder, }: ",
               "FindEndpointListItemOptions",
-              ") => Promise<{ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } | null>"
+              ") => Promise<{ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } | null>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
@@ -3499,7 +3499,7 @@
         "description": [],
         "source": {
           "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-          "lineNumber": 117
+          "lineNumber": 119
         },
         "deprecated": false,
         "children": [
@@ -3515,7 +3515,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 118
+              "lineNumber": 120
             },
             "deprecated": false
           },
@@ -3527,11 +3527,11 @@
             "label": "entries",
             "description": [],
             "signature": [
-              "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]"
+              "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 119
+              "lineNumber": 121
             },
             "deprecated": false
           },
@@ -3544,7 +3544,7 @@
             "description": [],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 120
+              "lineNumber": 122
             },
             "deprecated": false
           },
@@ -3557,7 +3557,7 @@
             "description": [],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 121
+              "lineNumber": 123
             },
             "deprecated": false
           },
@@ -3573,7 +3573,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 122
+              "lineNumber": 124
             },
             "deprecated": false
           },
@@ -3586,7 +3586,7 @@
             "description": [],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 123
+              "lineNumber": 125
             },
             "deprecated": false
           },
@@ -3602,7 +3602,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 124
+              "lineNumber": 126
             },
             "deprecated": false
           },
@@ -3615,7 +3615,7 @@
             "description": [],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 125
+              "lineNumber": 127
             },
             "deprecated": false
           },
@@ -3631,7 +3631,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 126
+              "lineNumber": 128
             },
             "deprecated": false
           },
@@ -3647,7 +3647,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 127
+              "lineNumber": 129
             },
             "deprecated": false
           },
@@ -3663,7 +3663,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 128
+              "lineNumber": 130
             },
             "deprecated": false
           }
@@ -3789,7 +3789,7 @@
         "description": [],
         "source": {
           "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-          "lineNumber": 143
+          "lineNumber": 145
         },
         "deprecated": false,
         "children": [
@@ -3805,7 +3805,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 144
+              "lineNumber": 146
             },
             "deprecated": false
           },
@@ -3821,7 +3821,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 145
+              "lineNumber": 147
             },
             "deprecated": false
           },
@@ -3833,11 +3833,11 @@
             "label": "entries",
             "description": [],
             "signature": [
-              "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]"
+              "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 146
+              "lineNumber": 148
             },
             "deprecated": false
           },
@@ -3853,7 +3853,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 147
+              "lineNumber": 149
             },
             "deprecated": false
           },
@@ -3869,7 +3869,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 148
+              "lineNumber": 150
             },
             "deprecated": false
           },
@@ -3885,7 +3885,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 149
+              "lineNumber": 151
             },
             "deprecated": false
           },
@@ -3901,7 +3901,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 150
+              "lineNumber": 152
             },
             "deprecated": false
           },
@@ -3917,7 +3917,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 151
+              "lineNumber": 153
             },
             "deprecated": false
           },
@@ -3933,7 +3933,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 152
+              "lineNumber": 154
             },
             "deprecated": false
           },
@@ -3949,7 +3949,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 153
+              "lineNumber": 155
             },
             "deprecated": false
           },
@@ -3965,7 +3965,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 154
+              "lineNumber": 156
             },
             "deprecated": false
           },
@@ -3981,7 +3981,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 155
+              "lineNumber": 157
             },
             "deprecated": false
           }
@@ -4004,7 +4004,7 @@
         "label": "buildExceptionFilter",
         "description": [],
         "signature": [
-          "({ lists, excludeExceptions, chunkSize, }: { lists: (({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) | { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; })[]; excludeExceptions: boolean; chunkSize: number; }) => ",
+          "({ lists, excludeExceptions, chunkSize, }: { lists: (({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) | { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; })[]; excludeExceptions: boolean; chunkSize: number; }) => ",
           {
             "pluginId": "data",
             "scope": "common",
@@ -4016,7 +4016,7 @@
         ],
         "source": {
           "path": "x-pack/plugins/lists/common/exceptions/build_exceptions_filter.ts",
-          "lineNumber": 69
+          "lineNumber": 68
         },
         "deprecated": false,
         "children": [
@@ -4029,7 +4029,7 @@
             "description": [],
             "source": {
               "path": "x-pack/plugins/lists/common/exceptions/build_exceptions_filter.ts",
-              "lineNumber": 73
+              "lineNumber": 72
             },
             "deprecated": false,
             "children": [
@@ -4041,11 +4041,11 @@
                 "label": "lists",
                 "description": [],
                 "signature": [
-                  "(({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) | { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; })[]"
+                  "(({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) | { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; })[]"
                 ],
                 "source": {
                   "path": "x-pack/plugins/lists/common/exceptions/build_exceptions_filter.ts",
-                  "lineNumber": 74
+                  "lineNumber": 73
                 },
                 "deprecated": false
               },
@@ -4058,7 +4058,7 @@
                 "description": [],
                 "source": {
                   "path": "x-pack/plugins/lists/common/exceptions/build_exceptions_filter.ts",
-                  "lineNumber": 75
+                  "lineNumber": 74
                 },
                 "deprecated": false
               },
@@ -4071,7 +4071,7 @@
                 "description": [],
                 "source": {
                   "path": "x-pack/plugins/lists/common/exceptions/build_exceptions_filter.ts",
-                  "lineNumber": 76
+                  "lineNumber": 75
                 },
                 "deprecated": false
               }
@@ -4088,1134 +4088,121 @@
         "parentPluginId": "lists",
         "id": "def-common.ExceptionListTypeEnum",
         "type": "Enum",
-        "tags": [
-          "deprecated"
-        ],
+        "tags": [],
         "label": "ExceptionListTypeEnum",
         "description": [],
+        "signature": [
+          "ExceptionListTypeEnum"
+        ],
         "source": {
-          "path": "x-pack/plugins/lists/common/schemas/common/schemas.ts",
-          "lineNumber": 337
+          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/exception_list/index.d.ts",
+          "lineNumber": 14
         },
-        "deprecated": true,
-        "references": [
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/common/shared_imports.ts",
-              "lineNumber": 31
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.tsx",
-              "lineNumber": 23
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.tsx",
-              "lineNumber": 27
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.tsx",
-              "lineNumber": 31
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.tsx",
-              "lineNumber": 94
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.tsx",
-              "lineNumber": 108
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.tsx",
-              "lineNumber": 113
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/index.tsx",
-              "lineNumber": 23
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/index.tsx",
-              "lineNumber": 59
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/index.tsx",
-              "lineNumber": 231
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.stories.tsx",
-              "lineNumber": 15
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.stories.tsx",
-              "lineNumber": 28
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.stories.tsx",
-              "lineNumber": 28
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.stories.tsx",
-              "lineNumber": 40
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.stories.tsx",
-              "lineNumber": 40
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.stories.tsx",
-              "lineNumber": 52
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.stories.tsx",
-              "lineNumber": 64
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.test.tsx",
-              "lineNumber": 12
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.test.tsx",
-              "lineNumber": 18
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.test.tsx",
-              "lineNumber": 18
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.test.tsx",
-              "lineNumber": 47
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.test.tsx",
-              "lineNumber": 47
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.test.tsx",
-              "lineNumber": 65
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.test.tsx",
-              "lineNumber": 83
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.test.tsx",
-              "lineNumber": 101
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.test.tsx",
-              "lineNumber": 101
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.test.tsx",
-              "lineNumber": 141
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.test.tsx",
-              "lineNumber": 141
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.test.tsx",
-              "lineNumber": 181
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.test.tsx",
-              "lineNumber": 199
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.test.tsx",
-              "lineNumber": 217
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.test.tsx",
-              "lineNumber": 217
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.test.tsx",
-              "lineNumber": 238
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.test.tsx",
-              "lineNumber": 238
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.test.tsx",
-              "lineNumber": 259
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exceptions_viewer_header.test.tsx",
-              "lineNumber": 259
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/index.test.tsx",
-              "lineNumber": 15
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/index.test.tsx",
-              "lineNumber": 95
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/index.test.tsx",
-              "lineNumber": 112
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/index.test.tsx",
-              "lineNumber": 148
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx",
-              "lineNumber": 85
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx",
-              "lineNumber": 462
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx",
-              "lineNumber": 467
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx",
-              "lineNumber": 472
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx",
-              "lineNumber": 473
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx",
-              "lineNumber": 477
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx",
-              "lineNumber": 481
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx",
-              "lineNumber": 484
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/management/pages/event_filters/constants.ts",
-              "lineNumber": 10
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/management/pages/event_filters/constants.ts",
-              "lineNumber": 18
-            }
-          }
-        ],
+        "deprecated": false,
         "initialIsOpen": false
       },
       {
         "parentPluginId": "lists",
-        "id": "def-common.OperatorEnum",
+        "id": "def-common.ListOperatorEnum",
         "type": "Enum",
-        "tags": [
-          "deprecated"
-        ],
-        "label": "OperatorEnum",
+        "tags": [],
+        "label": "ListOperatorEnum",
         "description": [],
+        "signature": [
+          "ListOperatorEnum"
+        ],
         "source": {
-          "path": "x-pack/plugins/lists/common/schemas/common/schemas.ts",
-          "lineNumber": 425
+          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/list_operator/index.d.ts",
+          "lineNumber": 7
         },
-        "deprecated": true,
-        "references": [
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/common/shared_imports.ts",
-              "lineNumber": 29
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/autocomplete/types.ts",
-              "lineNumber": 10
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/autocomplete/types.ts",
-              "lineNumber": 21
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/types.ts",
-              "lineNumber": 24
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/types.ts",
-              "lineNumber": 77
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/types.ts",
-              "lineNumber": 85
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/autocomplete/operators.ts",
-              "lineNumber": 10
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/autocomplete/operators.ts",
-              "lineNumber": 18
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/autocomplete/operators.ts",
-              "lineNumber": 27
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/autocomplete/operators.ts",
-              "lineNumber": 36
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/autocomplete/operators.ts",
-              "lineNumber": 45
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/autocomplete/operators.ts",
-              "lineNumber": 54
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/autocomplete/operators.ts",
-              "lineNumber": 63
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/autocomplete/operators.ts",
-              "lineNumber": 72
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/autocomplete/operators.ts",
-              "lineNumber": 81
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx",
-              "lineNumber": 46
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx",
-              "lineNumber": 347
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx",
-              "lineNumber": 366
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx",
-              "lineNumber": 387
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx",
-              "lineNumber": 408
-            }
-          }
-        ],
+        "deprecated": false,
         "initialIsOpen": false
       },
       {
         "parentPluginId": "lists",
-        "id": "def-common.OperatorTypeEnum",
+        "id": "def-common.ListOperatorTypeEnum",
         "type": "Enum",
-        "tags": [
-          "deprecated"
+        "tags": [],
+        "label": "ListOperatorTypeEnum",
+        "description": [],
+        "signature": [
+          "ListOperatorTypeEnum"
         ],
-        "label": "OperatorTypeEnum",
+        "source": {
+          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/list_operator/index.d.ts",
+          "lineNumber": 11
+        },
+        "deprecated": false,
+        "initialIsOpen": false
+      }
+    ],
+    "misc": [
+      {
+        "parentPluginId": "lists",
+        "id": "def-common.Comment",
+        "type": "Type",
+        "tags": [],
+        "label": "Comment",
         "description": [],
+        "signature": [
+          "{ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; }"
+        ],
         "source": {
-          "path": "x-pack/plugins/lists/common/schemas/common/schemas.ts",
-          "lineNumber": 433
+          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/comment/index.d.ts",
+          "lineNumber": 21
         },
-        "deprecated": true,
-        "references": [
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/common/shared_imports.ts",
-              "lineNumber": 30
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/autocomplete/types.ts",
-              "lineNumber": 10
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/autocomplete/types.ts",
-              "lineNumber": 22
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/types.ts",
-              "lineNumber": 23
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/types.ts",
-              "lineNumber": 78
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/types.ts",
-              "lineNumber": 78
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/types.ts",
-              "lineNumber": 86
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/types.ts",
-              "lineNumber": 93
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/autocomplete/operators.ts",
-              "lineNumber": 10
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/autocomplete/operators.ts",
-              "lineNumber": 17
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/autocomplete/operators.ts",
-              "lineNumber": 26
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/autocomplete/operators.ts",
-              "lineNumber": 35
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/autocomplete/operators.ts",
-              "lineNumber": 44
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/autocomplete/operators.ts",
-              "lineNumber": 53
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/autocomplete/operators.ts",
-              "lineNumber": 62
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/autocomplete/operators.ts",
-              "lineNumber": 71
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/autocomplete/operators.ts",
-              "lineNumber": 80
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/autocomplete/hooks/use_field_value_autocomplete.ts",
-              "lineNumber": 13
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/autocomplete/hooks/use_field_value_autocomplete.ts",
-              "lineNumber": 28
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/autocomplete/hooks/use_field_value_autocomplete.ts",
-              "lineNumber": 101
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_match.tsx",
-              "lineNumber": 21
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_match.tsx",
-              "lineNumber": 59
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_match_any.tsx",
-              "lineNumber": 15
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_match_any.tsx",
-              "lineNumber": 51
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/autocomplete/hooks/use_field_value_autocomplete.test.ts",
-              "lineNumber": 18
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/autocomplete/hooks/use_field_value_autocomplete.test.ts",
-              "lineNumber": 51
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/autocomplete/hooks/use_field_value_autocomplete.test.ts",
-              "lineNumber": 71
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/autocomplete/hooks/use_field_value_autocomplete.test.ts",
-              "lineNumber": 94
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/autocomplete/hooks/use_field_value_autocomplete.test.ts",
-              "lineNumber": 117
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/autocomplete/hooks/use_field_value_autocomplete.test.ts",
-              "lineNumber": 152
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/autocomplete/hooks/use_field_value_autocomplete.test.ts",
-              "lineNumber": 192
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/autocomplete/hooks/use_field_value_autocomplete.test.ts",
-              "lineNumber": 228
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/autocomplete/hooks/use_field_value_autocomplete.test.ts",
-              "lineNumber": 254
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/autocomplete/hooks/use_field_value_autocomplete.test.ts",
-              "lineNumber": 289
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 31
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 105
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 108
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 110
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 112
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 114
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 144
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 145
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 147
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 149
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 445
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx",
-              "lineNumber": 46
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx",
-              "lineNumber": 171
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx",
-              "lineNumber": 178
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx",
-              "lineNumber": 185
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx",
-              "lineNumber": 192
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx",
-              "lineNumber": 346
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx",
-              "lineNumber": 365
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx",
-              "lineNumber": 386
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx",
-              "lineNumber": 407
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx",
-              "lineNumber": 427
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx",
-              "lineNumber": 446
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx",
-              "lineNumber": 473
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx",
-              "lineNumber": 661
-            }
-          }
-        ],
-        "initialIsOpen": false
-      }
-    ],
-    "misc": [
-      {
-        "parentPluginId": "lists",
-        "id": "def-common.Comment",
-        "type": "Type",
-        "tags": [
-          "deprecated"
-        ],
-        "label": "Comment",
-        "description": [],
-        "signature": [
-          "{ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; }"
-        ],
-        "source": {
-          "path": "x-pack/plugins/lists/common/schemas/types/comment.ts",
-          "lineNumber": 46
-        },
-        "deprecated": true,
-        "references": [
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/common/shared_imports.ts",
-              "lineNumber": 12
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 26
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 332
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 360
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_comments.tsx",
-              "lineNumber": 20
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_comments.tsx",
-              "lineNumber": 26
-            }
-          }
-        ],
+        "deprecated": false,
         "initialIsOpen": false
       },
       {
         "parentPluginId": "lists",
         "id": "def-common.CommentsArray",
         "type": "Type",
-        "tags": [
-          "deprecated"
-        ],
+        "tags": [],
         "label": "CommentsArray",
         "description": [],
         "signature": [
           "({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]"
         ],
         "source": {
-          "path": "x-pack/plugins/lists/common/schemas/types/comment.ts",
-          "lineNumber": 41
+          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/comment/index.d.ts",
+          "lineNumber": 20
         },
-        "deprecated": true,
-        "references": [
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/common/shared_imports.ts",
-              "lineNumber": 10
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 25
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 176
-            }
-          }
-        ],
+        "deprecated": false,
         "initialIsOpen": false
       },
       {
         "parentPluginId": "lists",
         "id": "def-common.CreateComment",
         "type": "Type",
-        "tags": [
-          "deprecated"
-        ],
+        "tags": [],
         "label": "CreateComment",
         "description": [],
         "signature": [
           "{ comment: string; }"
         ],
         "source": {
-          "path": "x-pack/plugins/lists/common/schemas/types/create_comment.ts",
-          "lineNumber": 24
+          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/create_comment/index.d.ts",
+          "lineNumber": 5
         },
-        "deprecated": true,
-        "references": [
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/common/shared_imports.ts",
-              "lineNumber": 13
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 27
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 332
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 360
-            }
-          }
-        ],
+        "deprecated": false,
         "initialIsOpen": false
       },
       {
         "parentPluginId": "lists",
         "id": "def-common.CreateCommentsArray",
         "type": "Type",
-        "tags": [
-          "deprecated"
-        ],
+        "tags": [],
         "label": "CreateCommentsArray",
         "description": [],
         "signature": [
           "{ comment: string; }[]"
         ],
         "source": {
-          "path": "x-pack/plugins/lists/common/schemas/types/create_comment.ts",
-          "lineNumber": 34
+          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/create_comment/index.d.ts",
+          "lineNumber": 9
         },
-        "deprecated": true,
-        "references": [
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/common/shared_imports.ts",
-              "lineNumber": 11
-            }
-          }
-        ],
+        "deprecated": false,
         "initialIsOpen": false
       },
       {
@@ -5226,11 +4213,11 @@
         "label": "CreateExceptionListItemSchema",
         "description": [],
         "signature": [
-          "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
+          "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
         ],
         "source": {
           "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.ts",
-          "lineNumber": 55
+          "lineNumber": 51
         },
         "deprecated": false,
         "initialIsOpen": false
@@ -5247,7 +4234,7 @@
         ],
         "source": {
           "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.ts",
-          "lineNumber": 50
+          "lineNumber": 47
         },
         "deprecated": false,
         "initialIsOpen": false
@@ -5351,791 +4338,136 @@
         "parentPluginId": "lists",
         "id": "def-common.EntriesArray",
         "type": "Type",
-        "tags": [
-          "deprecated"
-        ],
+        "tags": [],
         "label": "EntriesArray",
         "description": [],
         "signature": [
-          "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]"
+          "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]"
         ],
         "source": {
-          "path": "x-pack/plugins/lists/common/schemas/types/entries.ts",
-          "lineNumber": 53
+          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entries/index.d.ts",
+          "lineNumber": 191
         },
-        "deprecated": true,
-        "references": [
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/common/shared_imports.ts",
-              "lineNumber": 26
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/common/detection_engine/utils.ts",
-              "lineNumber": 12
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/common/detection_engine/utils.ts",
-              "lineNumber": 23
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/common/detection_engine/utils.ts",
-              "lineNumber": 28
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/common/detection_engine/utils.test.ts",
-              "lineNumber": 16
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/common/detection_engine/utils.test.ts",
-              "lineNumber": 26
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/common/detection_engine/utils.test.ts",
-              "lineNumber": 46
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/common/detection_engine/utils.test.ts",
-              "lineNumber": 74
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/common/detection_engine/utils.test.ts",
-              "lineNumber": 95
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 42
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 87
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 87
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/mapping.ts",
-              "lineNumber": 12
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/mapping.ts",
-              "lineNumber": 80
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/mapping.ts",
-              "lineNumber": 204
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx",
-              "lineNumber": 62
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx",
-              "lineNumber": 661
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx",
-              "lineNumber": 702
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx",
-              "lineNumber": 783
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx",
-              "lineNumber": 787
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx",
-              "lineNumber": 793
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx",
-              "lineNumber": 800
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx",
-              "lineNumber": 804
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx",
-              "lineNumber": 810
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.test.tsx",
-              "lineNumber": 24
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.test.tsx",
-              "lineNumber": 426
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/edit_exception_modal/index.test.tsx",
-              "lineNumber": 23
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/edit_exception_modal/index.test.tsx",
-              "lineNumber": 133
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.test.ts",
-              "lineNumber": 12
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.test.ts",
-              "lineNumber": 73
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.test.ts",
-              "lineNumber": 119
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.test.ts",
-              "lineNumber": 170
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.test.ts",
-              "lineNumber": 223
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.test.ts",
-              "lineNumber": 275
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.test.ts",
-              "lineNumber": 319
-            }
-          }
-        ],
+        "deprecated": false,
         "initialIsOpen": false
       },
       {
         "parentPluginId": "lists",
         "id": "def-common.Entry",
         "type": "Type",
-        "tags": [
-          "deprecated"
-        ],
+        "tags": [],
         "label": "Entry",
         "description": [],
         "signature": [
           "{ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; }"
         ],
         "source": {
-          "path": "x-pack/plugins/lists/common/schemas/types/entries.ts",
-          "lineNumber": 34
+          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entries/index.d.ts",
+          "lineNumber": 79
         },
-        "deprecated": true,
-        "references": [
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/common/shared_imports.ts",
-              "lineNumber": 19
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/types.ts",
-              "lineNumber": 15
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/types.ts",
-              "lineNumber": 103
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 28
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 307
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 650
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.ts",
-              "lineNumber": 13
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.ts",
-              "lineNumber": 239
-            }
-          }
-        ],
+        "deprecated": false,
         "initialIsOpen": false
       },
       {
         "parentPluginId": "lists",
         "id": "def-common.EntryExists",
         "type": "Type",
-        "tags": [
-          "deprecated"
-        ],
+        "tags": [],
         "label": "EntryExists",
         "description": [],
         "signature": [
           "{ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; }"
         ],
         "source": {
-          "path": "x-pack/plugins/lists/common/schemas/types/entry_exists.ts",
-          "lineNumber": 27
+          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entries_exist/index.d.ts",
+          "lineNumber": 12
         },
-        "deprecated": true,
-        "references": [
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/common/shared_imports.ts",
-              "lineNumber": 20
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/types.ts",
-              "lineNumber": 19
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/types.ts",
-              "lineNumber": 98
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/types.ts",
-              "lineNumber": 115
-            }
-          }
-        ],
+        "deprecated": false,
         "initialIsOpen": false
       },
       {
         "parentPluginId": "lists",
         "id": "def-common.EntryList",
         "type": "Type",
-        "tags": [
-          "deprecated"
-        ],
+        "tags": [],
         "label": "EntryList",
         "description": [],
         "signature": [
           "{ field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; }"
         ],
         "source": {
-          "path": "x-pack/plugins/lists/common/schemas/types/entry_list.ts",
-          "lineNumber": 28
+          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entries_list/index.d.ts",
+          "lineNumber": 40
         },
-        "deprecated": true,
-        "references": [
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/common/shared_imports.ts",
-              "lineNumber": 25
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/signals/filters/create_field_and_set_tuples.ts",
-              "lineNumber": 8
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/signals/filters/create_field_and_set_tuples.ts",
-              "lineNumber": 19
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/signals/filters/create_field_and_set_tuples.test.ts",
-              "lineNumber": 14
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/signals/filters/create_field_and_set_tuples.test.ts",
-              "lineNumber": 78
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/signals/filters/create_field_and_set_tuples.test.ts",
-              "lineNumber": 90
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/signals/filters/create_field_and_set_tuples.test.ts",
-              "lineNumber": 102
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/signals/filters/create_field_and_set_tuples.test.ts",
-              "lineNumber": 115
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/signals/filters/create_field_and_set_tuples.test.ts",
-              "lineNumber": 131
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/signals/filters/create_field_and_set_tuples.test.ts",
-              "lineNumber": 144
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.test.ts",
-              "lineNumber": 12
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.test.ts",
-              "lineNumber": 329
-            }
-          }
-        ],
+        "deprecated": false,
         "initialIsOpen": false
       },
       {
         "parentPluginId": "lists",
         "id": "def-common.EntryMatch",
         "type": "Type",
-        "tags": [
-          "deprecated"
-        ],
+        "tags": [],
         "label": "EntryMatch",
         "description": [],
         "signature": [
           "{ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; }"
         ],
         "source": {
-          "path": "x-pack/plugins/lists/common/schemas/types/entry_match.ts",
-          "lineNumber": 28
+          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entry_match/index.d.ts",
+          "lineNumber": 13
         },
-        "deprecated": true,
-        "references": [
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/common/shared_imports.ts",
-              "lineNumber": 21
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/types.ts",
-              "lineNumber": 16
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/types.ts",
-              "lineNumber": 95
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/types.ts",
-              "lineNumber": 112
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/mapping.ts",
-              "lineNumber": 13
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/mapping.ts",
-              "lineNumber": 104
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/mapping.ts",
-              "lineNumber": 184
-            }
-          }
-        ],
+        "deprecated": false,
         "initialIsOpen": false
       },
       {
         "parentPluginId": "lists",
         "id": "def-common.EntryMatchAny",
         "type": "Type",
-        "tags": [
-          "deprecated"
-        ],
+        "tags": [],
         "label": "EntryMatchAny",
         "description": [],
         "signature": [
           "{ field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; }"
         ],
         "source": {
-          "path": "x-pack/plugins/lists/common/schemas/types/entry_match_any.ts",
-          "lineNumber": 30
+          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entry_match_any/index.d.ts",
+          "lineNumber": 13
         },
-        "deprecated": true,
-        "references": [
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/common/shared_imports.ts",
-              "lineNumber": 22
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/types.ts",
-              "lineNumber": 17
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/types.ts",
-              "lineNumber": 97
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/types.ts",
-              "lineNumber": 114
-            }
-          }
-        ],
+        "deprecated": false,
         "initialIsOpen": false
       },
       {
         "parentPluginId": "lists",
         "id": "def-common.EntryMatchWildcard",
         "type": "Type",
-        "tags": [
-          "deprecated"
-        ],
+        "tags": [],
         "label": "EntryMatchWildcard",
         "description": [],
         "signature": [
-          "{ field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; }"
-        ],
-        "source": {
-          "path": "x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.ts",
-          "lineNumber": 28
-        },
-        "deprecated": true,
-        "references": [
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/common/shared_imports.ts",
-              "lineNumber": 23
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/types.ts",
-              "lineNumber": 18
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/types.ts",
-              "lineNumber": 96
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/types.ts",
-              "lineNumber": 113
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/mapping.ts",
-              "lineNumber": 14
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/mapping.ts",
-              "lineNumber": 188
-            }
-          }
-        ],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "lists",
-        "id": "def-common.EntryNested",
-        "type": "Type",
-        "tags": [
-          "deprecated"
-        ],
-        "label": "EntryNested",
-        "description": [],
-        "signature": [
-          "{ entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; }"
-        ],
-        "source": {
-          "path": "x-pack/plugins/lists/common/schemas/types/entry_nested.ts",
-          "lineNumber": 28
-        },
-        "deprecated": true,
-        "references": [
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/common/shared_imports.ts",
-              "lineNumber": 24
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/types.ts",
-              "lineNumber": 14
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/types.ts",
-              "lineNumber": 109
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 40
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 307
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx",
-              "lineNumber": 46
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx",
-              "lineNumber": 425
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx",
-              "lineNumber": 444
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx",
-              "lineNumber": 471
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/mapping.ts",
-              "lineNumber": 15
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/mapping.ts",
-              "lineNumber": 192
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.ts",
-              "lineNumber": 13
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.ts",
-              "lineNumber": 239
-            }
-          }
+          "{ field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; }"
+        ],
+        "source": {
+          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entry_match_wildcard/index.d.ts",
+          "lineNumber": 13
+        },
+        "deprecated": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "lists",
+        "id": "def-common.EntryNested",
+        "type": "Type",
+        "tags": [],
+        "label": "EntryNested",
+        "description": [],
+        "signature": [
+          "{ entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; }"
         ],
+        "source": {
+          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entry_nested/index.d.ts",
+          "lineNumber": 37
+        },
+        "deprecated": false,
         "initialIsOpen": false
       },
       {
@@ -6182,11 +4514,11 @@
         "label": "ExceptionListItemSchema",
         "description": [],
         "signature": [
-          "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }"
+          "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }"
         ],
         "source": {
           "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.ts",
-          "lineNumber": 53
+          "lineNumber": 56
         },
         "deprecated": false,
         "initialIsOpen": false
@@ -6203,7 +4535,7 @@
         ],
         "source": {
           "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.ts",
-          "lineNumber": 52
+          "lineNumber": 54
         },
         "deprecated": false,
         "initialIsOpen": false
@@ -6212,154 +4544,34 @@
         "parentPluginId": "lists",
         "id": "def-common.ExceptionListType",
         "type": "Type",
-        "tags": [
-          "deprecated"
-        ],
+        "tags": [],
         "label": "ExceptionListType",
         "description": [],
         "signature": [
           "\"endpoint\" | \"detection\" | \"endpoint_events\""
         ],
         "source": {
-          "path": "x-pack/plugins/lists/common/schemas/common/schemas.ts",
-          "lineNumber": 327
+          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/exception_list/index.d.ts",
+          "lineNumber": 12
         },
-        "deprecated": true,
-        "references": [
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/common/shared_imports.ts",
-              "lineNumber": 46
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/reducer.ts",
-              "lineNumber": 15
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/reducer.ts",
-              "lineNumber": 31
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/reducer.ts",
-              "lineNumber": 57
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/use_fetch_or_create_rule_exception_list.test.tsx",
-              "lineNumber": 15
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/use_fetch_or_create_rule_exception_list.test.tsx",
-              "lineNumber": 46
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/use_fetch_or_create_rule_exception_list.test.tsx",
-              "lineNumber": 47
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 44
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 59
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.tsx",
-              "lineNumber": 37
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.tsx",
-              "lineNumber": 70
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/helpers.ts",
-              "lineNumber": 16
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/helpers.ts",
-              "lineNumber": 319
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/edit_exception_modal/index.tsx",
-              "lineNumber": 36
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/edit_exception_modal/index.tsx",
-              "lineNumber": 63
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/management/pages/event_filters/constants.ts",
-              "lineNumber": 9
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/management/pages/event_filters/constants.ts",
-              "lineNumber": 18
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alert_context_menu.tsx",
-              "lineNumber": 47
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alert_context_menu.tsx",
-              "lineNumber": 113
-            }
-          }
+        "deprecated": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "lists",
+        "id": "def-common.ListOperator",
+        "type": "Type",
+        "tags": [],
+        "label": "ListOperator",
+        "description": [],
+        "signature": [
+          "\"excluded\" | \"included\""
         ],
+        "source": {
+          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/list_operator/index.d.ts",
+          "lineNumber": 6
+        },
+        "deprecated": false,
         "initialIsOpen": false
       },
       {
@@ -6374,7 +4586,7 @@
         ],
         "source": {
           "path": "x-pack/plugins/lists/common/schemas/response/list_schema.ts",
-          "lineNumber": 48
+          "lineNumber": 50
         },
         "deprecated": false,
         "initialIsOpen": false
@@ -6390,8 +4602,8 @@
           "\"single\" | \"agnostic\""
         ],
         "source": {
-          "path": "x-pack/plugins/lists/common/schemas/types/default_namespace.ts",
-          "lineNumber": 12
+          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/default_namespace/index.d.ts",
+          "lineNumber": 6
         },
         "deprecated": false,
         "initialIsOpen": false
@@ -6407,150 +4619,27 @@
           "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]"
         ],
         "source": {
-          "path": "x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.ts",
-          "lineNumber": 17
+          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/non_empty_nested_entries_array/index.d.ts",
+          "lineNumber": 62
         },
         "deprecated": false,
         "initialIsOpen": false
       },
-      {
-        "parentPluginId": "lists",
-        "id": "def-common.Operator",
-        "type": "Type",
-        "tags": [
-          "deprecated"
-        ],
-        "label": "Operator",
-        "description": [],
-        "signature": [
-          "\"excluded\" | \"included\""
-        ],
-        "source": {
-          "path": "x-pack/plugins/lists/common/schemas/common/schemas.ts",
-          "lineNumber": 420
-        },
-        "deprecated": true,
-        "references": [
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/common/shared_imports.ts",
-              "lineNumber": 28
-            }
-          }
-        ],
-        "initialIsOpen": false
-      },
       {
         "parentPluginId": "lists",
         "id": "def-common.OsTypeArray",
         "type": "Type",
-        "tags": [
-          "deprecated"
-        ],
+        "tags": [],
         "label": "OsTypeArray",
         "description": [],
         "signature": [
           "(\"windows\" | \"linux\" | \"macos\")[]"
         ],
         "source": {
-          "path": "x-pack/plugins/lists/common/schemas/common/schemas.ts",
-          "lineNumber": 492
+          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/os_type/index.d.ts",
+          "lineNumber": 9
         },
-        "deprecated": true,
-        "references": [
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/common/shared_imports.ts",
-              "lineNumber": 57
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 41
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 60
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 389
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 399
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 400
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.tsx",
-              "lineNumber": 65
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.tsx",
-              "lineNumber": 305
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/edit_exception_modal/index.tsx",
-              "lineNumber": 56
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/edit_exception_modal/index.tsx",
-              "lineNumber": 285
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx",
-              "lineNumber": 63
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx",
-              "lineNumber": 596
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx",
-              "lineNumber": 609
-            }
-          }
-        ],
+        "deprecated": false,
         "initialIsOpen": false
       },
       {
@@ -6564,8 +4653,8 @@
           "\"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\""
         ],
         "source": {
-          "path": "x-pack/plugins/lists/common/schemas/common/schemas.ts",
-          "lineNumber": 188
+          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/type/index.d.ts",
+          "lineNumber": 56
         },
         "deprecated": false,
         "initialIsOpen": false
@@ -6578,11 +4667,11 @@
         "label": "UpdateExceptionListItemSchema",
         "description": [],
         "signature": [
-          "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
+          "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
         ],
         "source": {
           "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.ts",
-          "lineNumber": 55
+          "lineNumber": 52
         },
         "deprecated": false,
         "initialIsOpen": false
@@ -6593,9 +4682,7 @@
         "parentPluginId": "lists",
         "id": "def-common.comment",
         "type": "Object",
-        "tags": [
-          "deprecated"
-        ],
+        "tags": [],
         "label": "comment",
         "description": [],
         "signature": [
@@ -6610,33 +4697,10 @@
           "StringC"
         ],
         "source": {
-          "path": "x-pack/plugins/lists/common/schemas/types/comment.ts",
-          "lineNumber": 16
+          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/comment/index.d.ts",
+          "lineNumber": 2
         },
-        "deprecated": true,
-        "references": [
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/common/shared_imports.ts",
-              "lineNumber": 34
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 33
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 363
-            }
-          }
-        ],
+        "deprecated": false,
         "initialIsOpen": false
       },
       {
@@ -6659,7 +4723,7 @@
         ],
         "source": {
           "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.ts",
-          "lineNumber": 33
+          "lineNumber": 29
         },
         "deprecated": false,
         "initialIsOpen": false
@@ -6668,9 +4732,7 @@
         "parentPluginId": "lists",
         "id": "def-common.entriesExists",
         "type": "Object",
-        "tags": [
-          "deprecated"
-        ],
+        "tags": [],
         "label": "entriesExists",
         "description": [],
         "signature": [
@@ -6685,28 +4747,17 @@
           "KeyofC"
         ],
         "source": {
-          "path": "x-pack/plugins/lists/common/schemas/types/entry_exists.ts",
-          "lineNumber": 16
+          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entries_exist/index.d.ts",
+          "lineNumber": 2
         },
-        "deprecated": true,
-        "references": [
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/common/shared_imports.ts",
-              "lineNumber": 43
-            }
-          }
-        ],
+        "deprecated": false,
         "initialIsOpen": false
       },
       {
         "parentPluginId": "lists",
         "id": "def-common.entriesList",
         "type": "Object",
-        "tags": [
-          "deprecated"
-        ],
+        "tags": [],
         "label": "entriesList",
         "description": [],
         "signature": [
@@ -6721,56 +4772,17 @@
           "TypeC"
         ],
         "source": {
-          "path": "x-pack/plugins/lists/common/schemas/types/entry_list.ts",
-          "lineNumber": 16
+          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entries_list/index.d.ts",
+          "lineNumber": 2
         },
-        "deprecated": true,
-        "references": [
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/common/shared_imports.ts",
-              "lineNumber": 44
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/signals/filters/create_field_and_set_tuples.ts",
-              "lineNumber": 8
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/signals/filters/create_field_and_set_tuples.ts",
-              "lineNumber": 20
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/signals/filters/filter_events_against_list.ts",
-              "lineNumber": 8
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/signals/filters/filter_events_against_list.ts",
-              "lineNumber": 55
-            }
-          }
-        ],
+        "deprecated": false,
         "initialIsOpen": false
       },
       {
         "parentPluginId": "lists",
         "id": "def-common.entriesMatch",
         "type": "Object",
-        "tags": [
-          "deprecated"
-        ],
+        "tags": [],
         "label": "entriesMatch",
         "description": [],
         "signature": [
@@ -6785,28 +4797,17 @@
           "KeyofC"
         ],
         "source": {
-          "path": "x-pack/plugins/lists/common/schemas/types/entry_match.ts",
-          "lineNumber": 16
+          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entry_match/index.d.ts",
+          "lineNumber": 2
         },
-        "deprecated": true,
-        "references": [
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/common/shared_imports.ts",
-              "lineNumber": 40
-            }
-          }
-        ],
+        "deprecated": false,
         "initialIsOpen": false
       },
       {
         "parentPluginId": "lists",
         "id": "def-common.entriesMatchAny",
         "type": "Object",
-        "tags": [
-          "deprecated"
-        ],
+        "tags": [],
         "label": "entriesMatchAny",
         "description": [],
         "signature": [
@@ -6821,28 +4822,17 @@
           "KeyofC"
         ],
         "source": {
-          "path": "x-pack/plugins/lists/common/schemas/types/entry_match_any.ts",
-          "lineNumber": 18
+          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entry_match_any/index.d.ts",
+          "lineNumber": 2
         },
-        "deprecated": true,
-        "references": [
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/common/shared_imports.ts",
-              "lineNumber": 41
-            }
-          }
-        ],
+        "deprecated": false,
         "initialIsOpen": false
       },
       {
         "parentPluginId": "lists",
         "id": "def-common.entriesMatchWildcard",
         "type": "Object",
-        "tags": [
-          "deprecated"
-        ],
+        "tags": [],
         "label": "entriesMatchWildcard",
         "description": [],
         "signature": [
@@ -6857,28 +4847,17 @@
           "KeyofC"
         ],
         "source": {
-          "path": "x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.ts",
-          "lineNumber": 16
+          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entry_match_wildcard/index.d.ts",
+          "lineNumber": 2
         },
-        "deprecated": true,
-        "references": [
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/common/shared_imports.ts",
-              "lineNumber": 42
-            }
-          }
-        ],
+        "deprecated": false,
         "initialIsOpen": false
       },
       {
         "parentPluginId": "lists",
         "id": "def-common.entriesNested",
         "type": "Object",
-        "tags": [
-          "deprecated"
-        ],
+        "tags": [],
         "label": "entriesNested",
         "description": [],
         "signature": [
@@ -6887,69 +4866,23 @@
           "TypeC",
           "<{ entries: ",
           "Type",
-          "<({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[], ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[], unknown>; field: ",
+          "<({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[], ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[], unknown>; field: ",
           "Type",
           "<string, string, unknown>; type: ",
           "KeyofC"
         ],
         "source": {
-          "path": "x-pack/plugins/lists/common/schemas/types/entry_nested.ts",
-          "lineNumber": 17
+          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entry_nested/index.d.ts",
+          "lineNumber": 2
         },
-        "deprecated": true,
-        "references": [
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/common/shared_imports.ts",
-              "lineNumber": 38
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/helpers.tsx",
-              "lineNumber": 10
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/viewer/helpers.tsx",
-              "lineNumber": 44
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 35
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 232
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 244
-            }
-          }
-        ],
+        "deprecated": false,
         "initialIsOpen": false
       },
       {
         "parentPluginId": "lists",
         "id": "def-common.entry",
         "type": "Object",
-        "tags": [
-          "deprecated"
-        ],
+        "tags": [],
         "label": "entry",
         "description": [],
         "signature": [
@@ -6964,33 +4897,10 @@
           "KeyofC"
         ],
         "source": {
-          "path": "x-pack/plugins/lists/common/schemas/types/entries.ts",
-          "lineNumber": 23
+          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entries/index.d.ts",
+          "lineNumber": 2
         },
-        "deprecated": true,
-        "references": [
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/common/shared_imports.ts",
-              "lineNumber": 37
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 34
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 252
-            }
-          }
-        ],
+        "deprecated": false,
         "initialIsOpen": false
       },
       {
@@ -7013,7 +4923,7 @@
         ],
         "source": {
           "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.ts",
-          "lineNumber": 30
+          "lineNumber": 33
         },
         "deprecated": false,
         "initialIsOpen": false
@@ -7022,9 +4932,7 @@
         "parentPluginId": "lists",
         "id": "def-common.exceptionListType",
         "type": "Object",
-        "tags": [
-          "deprecated"
-        ],
+        "tags": [],
         "label": "exceptionListType",
         "description": [],
         "signature": [
@@ -7032,33 +4940,28 @@
           "<{ detection: null; endpoint: null; endpoint_events: null; }>"
         ],
         "source": {
-          "path": "x-pack/plugins/lists/common/schemas/common/schemas.ts",
-          "lineNumber": 313
+          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/exception_list/index.d.ts",
+          "lineNumber": 2
         },
-        "deprecated": true,
-        "references": [
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/common/shared_imports.ts",
-              "lineNumber": 33
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/common/detection_engine/schemas/types/lists.ts",
-              "lineNumber": 10
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/common/detection_engine/schemas/types/lists.ts",
-              "lineNumber": 21
-            }
-          }
+        "deprecated": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "lists",
+        "id": "def-common.listOperator",
+        "type": "Object",
+        "tags": [],
+        "label": "listOperator",
+        "description": [],
+        "signature": [
+          "KeyofC",
+          "<{ excluded: null; included: null; }>"
         ],
+        "source": {
+          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/list_operator/index.d.ts",
+          "lineNumber": 2
+        },
+        "deprecated": false,
         "initialIsOpen": false
       },
       {
@@ -7081,7 +4984,7 @@
         ],
         "source": {
           "path": "x-pack/plugins/lists/common/schemas/response/list_schema.ts",
-          "lineNumber": 28
+          "lineNumber": 30
         },
         "deprecated": false,
         "initialIsOpen": false
@@ -7098,8 +5001,8 @@
           "<{ agnostic: null; single: null; }>"
         ],
         "source": {
-          "path": "x-pack/plugins/lists/common/schemas/types/default_namespace.ts",
-          "lineNumber": 11
+          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/default_namespace/index.d.ts",
+          "lineNumber": 2
         },
         "deprecated": false,
         "initialIsOpen": false
@@ -7123,8 +5026,8 @@
           "KeyofC"
         ],
         "source": {
-          "path": "x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.ts",
-          "lineNumber": 15
+          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/non_empty_nested_entries_array/index.d.ts",
+          "lineNumber": 2
         },
         "deprecated": false,
         "initialIsOpen": false
@@ -7133,9 +5036,7 @@
         "parentPluginId": "lists",
         "id": "def-common.osType",
         "type": "Object",
-        "tags": [
-          "deprecated"
-        ],
+        "tags": [],
         "label": "osType",
         "description": [],
         "signature": [
@@ -7143,42 +5044,17 @@
           "<{ linux: null; macos: null; windows: null; }>"
         ],
         "source": {
-          "path": "x-pack/plugins/lists/common/schemas/common/schemas.ts",
-          "lineNumber": 473
+          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/os_type/index.d.ts",
+          "lineNumber": 2
         },
-        "deprecated": true,
-        "references": [
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/common/shared_imports.ts",
-              "lineNumber": 55
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 43
-            }
-          },
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx",
-              "lineNumber": 404
-            }
-          }
-        ],
+        "deprecated": false,
         "initialIsOpen": false
       },
       {
         "parentPluginId": "lists",
         "id": "def-common.osTypeArray",
         "type": "Object",
-        "tags": [
-          "deprecated"
-        ],
+        "tags": [],
         "label": "osTypeArray",
         "description": [],
         "signature": [
@@ -7186,19 +5062,10 @@
           "<(\"windows\" | \"linux\" | \"macos\")[], (\"windows\" | \"linux\" | \"macos\")[] | undefined, unknown>"
         ],
         "source": {
-          "path": "x-pack/plugins/lists/common/schemas/common/schemas.ts",
-          "lineNumber": 487
+          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/os_type/index.d.ts",
+          "lineNumber": 8
         },
-        "deprecated": true,
-        "references": [
-          {
-            "plugin": "securitySolution",
-            "link": {
-              "path": "x-pack/plugins/security_solution/common/shared_imports.ts",
-              "lineNumber": 56
-            }
-          }
-        ],
+        "deprecated": false,
         "initialIsOpen": false
       }
     ]
diff --git a/api_docs/ml.json b/api_docs/ml.json
index 6b8f4a3ce525a..8d66cc4a3e6ef 100644
--- a/api_docs/ml.json
+++ b/api_docs/ml.json
@@ -2912,6 +2912,72 @@
         ],
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "ml",
+        "id": "def-server.IndicesOptions",
+        "type": "Interface",
+        "tags": [],
+        "label": "IndicesOptions",
+        "description": [],
+        "source": {
+          "path": "x-pack/plugins/ml/common/types/anomaly_detection_jobs/datafeed.ts",
+          "lineNumber": 19
+        },
+        "deprecated": false,
+        "children": [
+          {
+            "parentPluginId": "ml",
+            "id": "def-server.IndicesOptions.allow_no_indices",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "allow_no_indices",
+            "description": [],
+            "signature": [
+              "boolean | undefined"
+            ],
+            "source": {
+              "path": "x-pack/plugins/ml/common/types/anomaly_detection_jobs/datafeed.ts",
+              "lineNumber": 20
+            },
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "ml",
+            "id": "def-server.IndicesOptions.expand_wildcards",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "expand_wildcards",
+            "description": [],
+            "signature": [
+              "string | ",
+              "ExpandWildcardOptions",
+              "[] | undefined"
+            ],
+            "source": {
+              "path": "x-pack/plugins/ml/common/types/anomaly_detection_jobs/datafeed.ts",
+              "lineNumber": 21
+            },
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "ml",
+            "id": "def-server.IndicesOptions.ignore_unavailable",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "ignore_unavailable",
+            "description": [],
+            "signature": [
+              "boolean | undefined"
+            ],
+            "source": {
+              "path": "x-pack/plugins/ml/common/types/anomaly_detection_jobs/datafeed.ts",
+              "lineNumber": 22
+            },
+            "deprecated": false
+          }
+        ],
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "ml",
         "id": "def-server.Influencer",
@@ -3903,23 +3969,6 @@
         "deprecated": false,
         "initialIsOpen": false
       },
-      {
-        "parentPluginId": "ml",
-        "id": "def-server.IndicesOptions",
-        "type": "Type",
-        "tags": [],
-        "label": "IndicesOptions",
-        "description": [],
-        "signature": [
-          "estypes.IndicesOptions"
-        ],
-        "source": {
-          "path": "x-pack/plugins/ml/common/types/anomaly_detection_jobs/datafeed.ts",
-          "lineNumber": 18
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
       {
         "parentPluginId": "ml",
         "id": "def-server.Job",
diff --git a/api_docs/monitoring.json b/api_docs/monitoring.json
index a11d5005dfc86..8b9e7f9dfde52 100644
--- a/api_docs/monitoring.json
+++ b/api_docs/monitoring.json
@@ -128,9 +128,9 @@
         "label": "MonitoringConfig",
         "description": [],
         "signature": [
-          "{ ui: { elasticsearch: MonitoringElasticsearchConfig; enabled: boolean; container: Readonly<{} & { logstash: Readonly<{} & { enabled: boolean; }>; elasticsearch: Readonly<{} & { enabled: boolean; }>; apm: Readonly<{} & { enabled: boolean; }>; }>; logs: Readonly<{} & { index: string; }>; metricbeat: Readonly<{} & { index: string; }>; ccs: Readonly<{} & { enabled: boolean; }>; max_bucket_size: number; min_interval_seconds: number; show_license_expiration: boolean; }; enabled: boolean; kibana: Readonly<{} & { collection: Readonly<{} & { enabled: boolean; interval: number; }>; }>; agent: Readonly<{} & { interval: string; }>; licensing: Readonly<{} & { api_polling_frequency: ",
+          "{ ui: { elasticsearch: MonitoringElasticsearchConfig; enabled: boolean; container: Readonly<{} & { logstash: Readonly<{} & { enabled: boolean; }>; elasticsearch: Readonly<{} & { enabled: boolean; }>; apm: Readonly<{} & { enabled: boolean; }>; }>; logs: Readonly<{} & { index: string; }>; metricbeat: Readonly<{} & { index: string; }>; ccs: Readonly<{} & { enabled: boolean; }>; max_bucket_size: number; min_interval_seconds: number; show_license_expiration: boolean; }; enabled: boolean; kibana: Readonly<{} & { collection: Readonly<{} & { enabled: boolean; interval: number; }>; }>; licensing: Readonly<{} & { api_polling_frequency: ",
           "Duration",
-          "; }>; cluster_alerts: Readonly<{} & { enabled: boolean; allowedSpaces: string[]; email_notifications: Readonly<{} & { enabled: boolean; email_address: string; }>; }>; tests: Readonly<{} & { cloud_detector: Readonly<{} & { enabled: boolean; }>; }>; }"
+          "; }>; agent: Readonly<{} & { interval: string; }>; cluster_alerts: Readonly<{} & { enabled: boolean; allowedSpaces: string[]; email_notifications: Readonly<{} & { enabled: boolean; email_address: string; }>; }>; tests: Readonly<{} & { cloud_detector: Readonly<{} & { enabled: boolean; }>; }>; }"
         ],
         "source": {
           "path": "x-pack/plugins/monitoring/server/config.ts",
diff --git a/api_docs/observability.json b/api_docs/observability.json
index 12f0b9b2d7982..980df52f0e77a 100644
--- a/api_docs/observability.json
+++ b/api_docs/observability.json
@@ -1,41 +1,7 @@
 {
   "id": "observability",
   "client": {
-    "classes": [
-      {
-        "parentPluginId": "observability",
-        "id": "def-public.FormatterRuleRegistry",
-        "type": "Class",
-        "tags": [],
-        "label": "FormatterRuleRegistry",
-        "description": [],
-        "signature": [
-          {
-            "pluginId": "observability",
-            "scope": "public",
-            "docId": "kibObservabilityPluginApi",
-            "section": "def-public.FormatterRuleRegistry",
-            "text": "FormatterRuleRegistry"
-          },
-          "<TFieldMap> extends ",
-          {
-            "pluginId": "ruleRegistry",
-            "scope": "public",
-            "docId": "kibRuleRegistryPluginApi",
-            "section": "def-public.RuleRegistry",
-            "text": "RuleRegistry"
-          },
-          "<TFieldMap, FormattableRuleType<TFieldMap>>"
-        ],
-        "source": {
-          "path": "x-pack/plugins/observability/public/rules/formatter_rule_registry.ts",
-          "lineNumber": 27
-        },
-        "deprecated": false,
-        "children": [],
-        "initialIsOpen": false
-      }
-    ],
+    "classes": [],
     "functions": [
       {
         "parentPluginId": "observability",
@@ -163,6 +129,33 @@
         "returnComment": [],
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "observability",
+        "id": "def-public.createObservabilityRuleTypeRegistryMock",
+        "type": "Function",
+        "tags": [],
+        "label": "createObservabilityRuleTypeRegistryMock",
+        "description": [],
+        "signature": [
+          "() => { register: (type: ",
+          {
+            "pluginId": "triggersActionsUi",
+            "scope": "public",
+            "docId": "kibTriggersActionsUiPluginApi",
+            "section": "def-public.AlertTypeModel",
+            "text": "AlertTypeModel"
+          },
+          "<any> & { format: Formatter; }) => void; getFormatter: (typeId: string) => Formatter | undefined; } & { registerFormatter: () => void; }"
+        ],
+        "source": {
+          "path": "x-pack/plugins/observability/public/rules/observability_rule_type_registry_mock.ts",
+          "lineNumber": 14
+        },
+        "deprecated": false,
+        "children": [],
+        "returnComment": [],
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "observability",
         "id": "def-public.FieldValueSuggestions",
@@ -848,7 +841,7 @@
         "label": "useUiTracker",
         "description": [],
         "signature": [
-          "({\n  app: defaultApp,\n}: { app?: \"apm\" | \"uptime\" | \"fleet\" | \"infra_metrics\" | \"infra_logs\" | \"synthetics\" | \"observability-overview\" | \"stack_monitoring\" | \"ux\" | undefined; }) => ({ app, metric, metricType }: ",
+          "({\n  app: defaultApp,\n}: { app?: \"apm\" | \"fleet\" | \"uptime\" | \"infra_metrics\" | \"infra_logs\" | \"synthetics\" | \"observability-overview\" | \"stack_monitoring\" | \"ux\" | undefined; }) => ({ app, metric, metricType }: ",
           {
             "pluginId": "observability",
             "scope": "public",
@@ -885,7 +878,7 @@
                 "label": "app",
                 "description": [],
                 "signature": [
-                  "\"apm\" | \"uptime\" | \"fleet\" | \"infra_metrics\" | \"infra_logs\" | \"synthetics\" | \"observability-overview\" | \"stack_monitoring\" | \"ux\" | undefined"
+                  "\"apm\" | \"fleet\" | \"uptime\" | \"infra_metrics\" | \"infra_logs\" | \"synthetics\" | \"observability-overview\" | \"stack_monitoring\" | \"ux\" | undefined"
                 ],
                 "source": {
                   "path": "x-pack/plugins/observability/public/hooks/use_track_metric.tsx",
@@ -1939,29 +1932,19 @@
           },
           {
             "parentPluginId": "observability",
-            "id": "def-public.ObservabilityPublicPluginsSetup.ruleRegistry",
+            "id": "def-public.ObservabilityPublicPluginsSetup.triggersActionsUi",
             "type": "Object",
             "tags": [],
-            "label": "ruleRegistry",
+            "label": "triggersActionsUi",
             "description": [],
             "signature": [
-              "{ registry: ",
-              {
-                "pluginId": "ruleRegistry",
-                "scope": "public",
-                "docId": "kibRuleRegistryPluginApi",
-                "section": "def-public.RuleRegistry",
-                "text": "RuleRegistry"
-              },
-              "<{ readonly 'kibana.rac.producer': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.uuid': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.id': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.start': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.end': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.duration.us': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.severity.level': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.severity.value': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.status': { readonly type: \"keyword\"; }; readonly '@timestamp': { readonly type: \"date\"; readonly array: false; readonly required: true; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'event.kind': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.action': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.uuid': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.category': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; }, ",
               {
                 "pluginId": "triggersActionsUi",
                 "scope": "public",
                 "docId": "kibTriggersActionsUiPluginApi",
-                "section": "def-public.AlertTypeModel",
-                "text": "AlertTypeModel"
-              },
-              "<Record<string, unknown>>>; }"
+                "section": "def-public.TriggersAndActionsUIPublicPluginSetup",
+                "text": "TriggersAndActionsUIPublicPluginSetup"
+              }
             ],
             "source": {
               "path": "x-pack/plugins/observability/public/plugin.ts",
@@ -2031,6 +2014,28 @@
             },
             "deprecated": false
           },
+          {
+            "parentPluginId": "observability",
+            "id": "def-public.ObservabilityPublicPluginsStart.triggersActionsUi",
+            "type": "Object",
+            "tags": [],
+            "label": "triggersActionsUi",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "triggersActionsUi",
+                "scope": "public",
+                "docId": "kibTriggersActionsUiPluginApi",
+                "section": "def-public.TriggersAndActionsUIPublicPluginStart",
+                "text": "TriggersAndActionsUIPublicPluginStart"
+              }
+            ],
+            "source": {
+              "path": "x-pack/plugins/observability/public/plugin.ts",
+              "lineNumber": 48
+            },
+            "deprecated": false
+          },
           {
             "parentPluginId": "observability",
             "id": "def-public.ObservabilityPublicPluginsStart.data",
@@ -2049,7 +2054,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/observability/public/plugin.ts",
-              "lineNumber": 48
+              "lineNumber": 49
             },
             "deprecated": false
           },
@@ -2071,7 +2076,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/observability/public/plugin.ts",
-              "lineNumber": 49
+              "lineNumber": 50
             },
             "deprecated": false
           }
@@ -2849,6 +2854,23 @@
         "deprecated": false,
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "observability",
+        "id": "def-public.ObservabilityRuleTypeRegistry",
+        "type": "Type",
+        "tags": [],
+        "label": "ObservabilityRuleTypeRegistry",
+        "description": [],
+        "signature": [
+          "{ register: (type: AlertTypeModel<any> & { format: Formatter; }) => void; getFormatter: (typeId: string) => Formatter | undefined; }"
+        ],
+        "source": {
+          "path": "x-pack/plugins/observability/public/rules/create_observability_rule_type_registry.ts",
+          "lineNumber": 31
+        },
+        "deprecated": false,
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "observability",
         "id": "def-public.SectionLinkProps",
@@ -2943,11 +2965,26 @@
       "label": "ObservabilityPublicSetup",
       "description": [],
       "signature": [
-        "{ dashboard: { register: typeof registerDataHandler; }; ruleRegistry: FormatterRuleRegistry<{ readonly 'kibana.rac.producer': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.uuid': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.id': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.start': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.end': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.duration.us': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.severity.level': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.severity.value': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.status': { readonly type: \"keyword\"; }; readonly '@timestamp': { readonly type: \"date\"; readonly array: false; readonly required: true; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'event.kind': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.action': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.uuid': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.category': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; } & { 'kibana.observability.evaluation.value': { type: \"scaled_float\"; scaling_factor: number; }; 'kibana.observability.evaluation.threshold': { type: \"scaled_float\"; scaling_factor: number; }; 'host.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; 'service.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; }>; isAlertingExperienceEnabled: () => boolean; }"
+        "{ dashboard: { register: typeof registerDataHandler; }; observabilityRuleTypeRegistry: { register: (type: ",
+        {
+          "pluginId": "triggersActionsUi",
+          "scope": "public",
+          "docId": "kibTriggersActionsUiPluginApi",
+          "section": "def-public.AlertTypeModel",
+          "text": "AlertTypeModel"
+        },
+        "<any> & { format: (options: { fields: { readonly '@timestamp': string; readonly tags?: string[] | undefined; readonly \"kibana.rac.alert.uuid\"?: string | undefined; readonly 'event.kind'?: string | undefined; readonly 'event.action'?: string | undefined; readonly 'rule.uuid'?: string | undefined; readonly 'rule.id'?: string | undefined; readonly 'rule.name'?: string | undefined; readonly 'rule.category'?: string | undefined; readonly \"kibana.rac.alert.producer\"?: string | undefined; readonly \"kibana.rac.alert.id\"?: string | undefined; readonly \"kibana.rac.alert.start\"?: string | undefined; readonly \"kibana.rac.alert.end\"?: string | undefined; readonly \"kibana.rac.alert.duration.us\"?: number | undefined; readonly \"kibana.rac.alert.severity.level\"?: string | undefined; readonly \"kibana.rac.alert.severity.value\"?: number | undefined; readonly \"kibana.rac.alert.status\"?: string | undefined; readonly \"kibana.rac.alert.evaluation.threshold\"?: number | undefined; readonly \"kibana.rac.alert.evaluation.value\"?: number | undefined; } & Record<string, any>; formatters: { asDuration: typeof ",
+        "asDuration",
+        "; asPercent: typeof ",
+        "asPercent",
+        "; }; }) => { reason: string; link: string; }; }) => void; getFormatter: (typeId: string) => ((options: { fields: { readonly '@timestamp': string; readonly tags?: string[] | undefined; readonly \"kibana.rac.alert.uuid\"?: string | undefined; readonly 'event.kind'?: string | undefined; readonly 'event.action'?: string | undefined; readonly 'rule.uuid'?: string | undefined; readonly 'rule.id'?: string | undefined; readonly 'rule.name'?: string | undefined; readonly 'rule.category'?: string | undefined; readonly \"kibana.rac.alert.producer\"?: string | undefined; readonly \"kibana.rac.alert.id\"?: string | undefined; readonly \"kibana.rac.alert.start\"?: string | undefined; readonly \"kibana.rac.alert.end\"?: string | undefined; readonly \"kibana.rac.alert.duration.us\"?: number | undefined; readonly \"kibana.rac.alert.severity.level\"?: string | undefined; readonly \"kibana.rac.alert.severity.value\"?: number | undefined; readonly \"kibana.rac.alert.status\"?: string | undefined; readonly \"kibana.rac.alert.evaluation.threshold\"?: number | undefined; readonly \"kibana.rac.alert.evaluation.value\"?: number | undefined; } & Record<string, any>; formatters: { asDuration: typeof ",
+        "asDuration",
+        "; asPercent: typeof ",
+        "asPercent"
       ],
       "source": {
         "path": "x-pack/plugins/observability/public/plugin.ts",
-        "lineNumber": 37
+        "lineNumber": 38
       },
       "deprecated": false,
       "lifecycle": "setup",
@@ -2965,7 +3002,7 @@
       ],
       "source": {
         "path": "x-pack/plugins/observability/public/plugin.ts",
-        "lineNumber": 52
+        "lineNumber": 53
       },
       "deprecated": false,
       "lifecycle": "start",
@@ -3412,14 +3449,19 @@
           },
           {
             "parentPluginId": "observability",
-            "id": "def-server.ObservabilityRouteHandlerResources.ruleRegistry",
+            "id": "def-server.ObservabilityRouteHandlerResources.ruleDataClient",
             "type": "Object",
             "tags": [],
-            "label": "ruleRegistry",
+            "label": "ruleDataClient",
             "description": [],
             "signature": [
-              "RuleRegistry",
-              "<{ readonly 'kibana.rac.producer': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.uuid': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.id': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.start': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.end': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.duration.us': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.severity.level': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.severity.value': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.status': { readonly type: \"keyword\"; }; readonly '@timestamp': { readonly type: \"date\"; readonly array: false; readonly required: true; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'event.kind': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.action': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.uuid': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.category': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; } & { 'kibana.observability.evaluation.value': { type: \"scaled_float\"; scaling_factor: number; }; 'kibana.observability.evaluation.threshold': { type: \"scaled_float\"; scaling_factor: number; }; 'host.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; 'service.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; }>"
+              {
+                "pluginId": "ruleRegistry",
+                "scope": "server",
+                "docId": "kibRuleRegistryPluginApi",
+                "section": "def-server.RuleDataClient",
+                "text": "RuleDataClient"
+              }
             ],
             "source": {
               "path": "x-pack/plugins/observability/server/routes/types.ts",
@@ -3538,7 +3580,7 @@
         "label": "ObservabilityAPIReturnType",
         "description": [],
         "signature": [
-          "TEndpoint extends \"GET /api/observability/rules/alerts/top\" | \"GET /api/observability/rules/alerts/dynamic_index_pattern\" ? ({ \"GET /api/observability/rules/alerts/top\": ServerRoute<\"GET /api/observability/rules/alerts/top\", t.TypeC<{ query: t.IntersectionC<[t.TypeC<{ start: t.Type<number, string, unknown>; end: t.Type<number, string, unknown>; }>, t.PartialC<{ kuery: t.StringC; size: t.Type<number, unknown, unknown>; }>]>; }>, ObservabilityRouteHandlerResources, any, ObservabilityRouteCreateOptions>; } & { \"GET /api/observability/rules/alerts/dynamic_index_pattern\": ServerRoute<\"GET /api/observability/rules/alerts/dynamic_index_pattern\", undefined, ObservabilityRouteHandlerResources, { title: string; timeFieldName: string; fields: ",
+          "TEndpoint extends \"GET /api/observability/rules/alerts/top\" | \"GET /api/observability/rules/alerts/dynamic_index_pattern\" ? ({ \"GET /api/observability/rules/alerts/top\": ServerRoute<\"GET /api/observability/rules/alerts/top\", t.TypeC<{ query: t.IntersectionC<[t.TypeC<{ start: t.Type<number, string, unknown>; end: t.Type<number, string, unknown>; }>, t.PartialC<{ kuery: t.StringC; size: t.Type<number, unknown, unknown>; }>]>; }>, ObservabilityRouteHandlerResources, Partial<Record<never, unknown[]>>[], ObservabilityRouteCreateOptions>; } & { \"GET /api/observability/rules/alerts/dynamic_index_pattern\": ServerRoute<\"GET /api/observability/rules/alerts/dynamic_index_pattern\", undefined, ObservabilityRouteHandlerResources, { title: string; timeFieldName: string; fields: ",
           "IndexPatternFieldDescriptor",
           "[]; }, ObservabilityRouteCreateOptions>; })[TEndpoint] extends ServerRoute<any, any, any, infer TReturnType, Record<string, any>> ? TReturnType : never : never"
         ],
@@ -3566,23 +3608,6 @@
         "deprecated": false,
         "initialIsOpen": false
       },
-      {
-        "parentPluginId": "observability",
-        "id": "def-server.ObservabilityRuleRegistryClient",
-        "type": "Type",
-        "tags": [],
-        "label": "ObservabilityRuleRegistryClient",
-        "description": [],
-        "signature": [
-          "ScopedRuleRegistryClient<{ readonly 'kibana.rac.producer': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.uuid': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.id': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.start': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.end': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.duration.us': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.severity.level': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.severity.value': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.status': { readonly type: \"keyword\"; }; readonly '@timestamp': { readonly type: \"date\"; readonly array: false; readonly required: true; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'event.kind': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.action': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.uuid': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.category': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; } & { 'kibana.observability.evaluation.value': { type: \"scaled_float\"; scaling_factor: number; }; 'kibana.observability.evaluation.threshold': { type: \"scaled_float\"; scaling_factor: number; }; 'host.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; 'service.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; }>"
-        ],
-        "source": {
-          "path": "x-pack/plugins/observability/server/types.ts",
-          "lineNumber": 35
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
       {
         "parentPluginId": "observability",
         "id": "def-server.ObservabilityServerRouteRepository",
@@ -3684,7 +3709,7 @@
       ],
       "source": {
         "path": "x-pack/plugins/observability/server/plugin.ts",
-        "lineNumber": 22
+        "lineNumber": 21
       },
       "deprecated": false,
       "lifecycle": "setup",
diff --git a/api_docs/observability.mdx b/api_docs/observability.mdx
index 59a9b7f550477..353e65b0fa080 100644
--- a/api_docs/observability.mdx
+++ b/api_docs/observability.mdx
@@ -22,9 +22,6 @@ import observabilityObj from './observability.json';
 ### Functions
 <DocDefinitionList data={observabilityObj.client.functions}/>
 
-### Classes
-<DocDefinitionList data={observabilityObj.client.classes}/>
-
 ### Interfaces
 <DocDefinitionList data={observabilityObj.client.interfaces}/>
 
diff --git a/api_docs/presentation_util.json b/api_docs/presentation_util.json
index b9d23b3fc534a..555cf8a77f800 100644
--- a/api_docs/presentation_util.json
+++ b/api_docs/presentation_util.json
@@ -575,6 +575,22 @@
         },
         "deprecated": false,
         "children": [
+          {
+            "parentPluginId": "presentationUtil",
+            "id": "def-public.PresentationLabsService.isProjectEnabled",
+            "type": "Function",
+            "tags": [],
+            "label": "isProjectEnabled",
+            "description": [],
+            "signature": [
+              "(id: \"labs:presentation:timeToPresent\" | \"labs:canvas:useDataService\") => boolean"
+            ],
+            "source": {
+              "path": "src/plugins/presentation_util/public/services/labs.ts",
+              "lineNumber": 23
+            },
+            "deprecated": false
+          },
           {
             "parentPluginId": "presentationUtil",
             "id": "def-public.PresentationLabsService.getProjectIDs",
@@ -587,7 +603,7 @@
             ],
             "source": {
               "path": "src/plugins/presentation_util/public/services/labs.ts",
-              "lineNumber": 23
+              "lineNumber": 24
             },
             "deprecated": false
           },
@@ -610,7 +626,7 @@
             ],
             "source": {
               "path": "src/plugins/presentation_util/public/services/labs.ts",
-              "lineNumber": 24
+              "lineNumber": 25
             },
             "deprecated": false
           },
@@ -634,7 +650,7 @@
             ],
             "source": {
               "path": "src/plugins/presentation_util/public/services/labs.ts",
-              "lineNumber": 25
+              "lineNumber": 26
             },
             "deprecated": false
           },
@@ -650,7 +666,7 @@
             ],
             "source": {
               "path": "src/plugins/presentation_util/public/services/labs.ts",
-              "lineNumber": 26
+              "lineNumber": 27
             },
             "deprecated": false
           },
@@ -666,7 +682,7 @@
             ],
             "source": {
               "path": "src/plugins/presentation_util/public/services/labs.ts",
-              "lineNumber": 27
+              "lineNumber": 28
             },
             "deprecated": false
           }
@@ -883,7 +899,7 @@
         ],
         "source": {
           "path": "src/plugins/presentation_util/common/labs.ts",
-          "lineNumber": 78
+          "lineNumber": 79
         },
         "deprecated": false,
         "initialIsOpen": false
@@ -900,7 +916,7 @@
         ],
         "source": {
           "path": "src/plugins/presentation_util/common/labs.ts",
-          "lineNumber": 54
+          "lineNumber": 55
         },
         "deprecated": false,
         "initialIsOpen": false
@@ -919,7 +935,7 @@
         ],
         "source": {
           "path": "src/plugins/presentation_util/common/labs.ts",
-          "lineNumber": 14
+          "lineNumber": 15
         },
         "deprecated": false,
         "initialIsOpen": false
@@ -1038,7 +1054,7 @@
         ],
         "source": {
           "path": "src/plugins/presentation_util/common/labs.ts",
-          "lineNumber": 80
+          "lineNumber": 81
         },
         "deprecated": false,
         "children": [],
@@ -1065,7 +1081,7 @@
         ],
         "source": {
           "path": "src/plugins/presentation_util/common/labs.ts",
-          "lineNumber": 82
+          "lineNumber": 83
         },
         "deprecated": false,
         "children": [
@@ -1081,7 +1097,7 @@
             ],
             "source": {
               "path": "src/plugins/presentation_util/common/labs.ts",
-              "lineNumber": 82
+              "lineNumber": 83
             },
             "deprecated": false,
             "isRequired": true
@@ -1104,7 +1120,7 @@
             ],
             "source": {
               "path": "src/plugins/presentation_util/common/labs.ts",
-              "lineNumber": 82
+              "lineNumber": 83
             },
             "deprecated": false,
             "isRequired": true
@@ -1124,7 +1140,7 @@
         "description": [],
         "source": {
           "path": "src/plugins/presentation_util/common/labs.ts",
-          "lineNumber": 68
+          "lineNumber": 69
         },
         "deprecated": false,
         "children": [
@@ -1140,7 +1156,7 @@
             ],
             "source": {
               "path": "src/plugins/presentation_util/common/labs.ts",
-              "lineNumber": 69
+              "lineNumber": 70
             },
             "deprecated": false
           },
@@ -1153,7 +1169,7 @@
             "description": [],
             "source": {
               "path": "src/plugins/presentation_util/common/labs.ts",
-              "lineNumber": 70
+              "lineNumber": 71
             },
             "deprecated": false
           },
@@ -1166,7 +1182,7 @@
             "description": [],
             "source": {
               "path": "src/plugins/presentation_util/common/labs.ts",
-              "lineNumber": 71
+              "lineNumber": 72
             },
             "deprecated": false
           },
@@ -1179,7 +1195,7 @@
             "description": [],
             "source": {
               "path": "src/plugins/presentation_util/common/labs.ts",
-              "lineNumber": 72
+              "lineNumber": 73
             },
             "deprecated": false
           },
@@ -1195,7 +1211,7 @@
             ],
             "source": {
               "path": "src/plugins/presentation_util/common/labs.ts",
-              "lineNumber": 73
+              "lineNumber": 74
             },
             "deprecated": false
           },
@@ -1208,7 +1224,7 @@
             "description": [],
             "source": {
               "path": "src/plugins/presentation_util/common/labs.ts",
-              "lineNumber": 74
+              "lineNumber": 75
             },
             "deprecated": false
           },
@@ -1224,7 +1240,7 @@
             ],
             "source": {
               "path": "src/plugins/presentation_util/common/labs.ts",
-              "lineNumber": 75
+              "lineNumber": 76
             },
             "deprecated": false
           }
@@ -1246,7 +1262,7 @@
         ],
         "source": {
           "path": "src/plugins/presentation_util/common/labs.ts",
-          "lineNumber": 55
+          "lineNumber": 56
         },
         "deprecated": false,
         "initialIsOpen": false
@@ -1263,7 +1279,24 @@
         ],
         "source": {
           "path": "src/plugins/presentation_util/common/labs.ts",
-          "lineNumber": 58
+          "lineNumber": 59
+        },
+        "deprecated": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "presentationUtil",
+        "id": "def-common.LABS_PROJECT_PREFIX",
+        "type": "string",
+        "tags": [],
+        "label": "LABS_PROJECT_PREFIX",
+        "description": [],
+        "signature": [
+          "\"labs:\""
+        ],
+        "source": {
+          "path": "src/plugins/presentation_util/common/labs.ts",
+          "lineNumber": 11
         },
         "deprecated": false,
         "initialIsOpen": false
@@ -1314,7 +1347,7 @@
         ],
         "source": {
           "path": "src/plugins/presentation_util/common/labs.ts",
-          "lineNumber": 78
+          "lineNumber": 79
         },
         "deprecated": false,
         "initialIsOpen": false
@@ -1331,7 +1364,7 @@
         ],
         "source": {
           "path": "src/plugins/presentation_util/common/labs.ts",
-          "lineNumber": 54
+          "lineNumber": 55
         },
         "deprecated": false,
         "initialIsOpen": false
@@ -1348,7 +1381,7 @@
         ],
         "source": {
           "path": "src/plugins/presentation_util/common/labs.ts",
-          "lineNumber": 62
+          "lineNumber": 63
         },
         "deprecated": false,
         "initialIsOpen": false
@@ -1365,7 +1398,7 @@
         ],
         "source": {
           "path": "src/plugins/presentation_util/common/labs.ts",
-          "lineNumber": 56
+          "lineNumber": 57
         },
         "deprecated": false,
         "initialIsOpen": false
@@ -1382,7 +1415,7 @@
         ],
         "source": {
           "path": "src/plugins/presentation_util/common/labs.ts",
-          "lineNumber": 12
+          "lineNumber": 13
         },
         "deprecated": false,
         "initialIsOpen": false
@@ -1399,7 +1432,7 @@
         ],
         "source": {
           "path": "src/plugins/presentation_util/common/labs.ts",
-          "lineNumber": 11
+          "lineNumber": 12
         },
         "deprecated": false,
         "initialIsOpen": false
@@ -1418,7 +1451,7 @@
         ],
         "source": {
           "path": "src/plugins/presentation_util/common/labs.ts",
-          "lineNumber": 15
+          "lineNumber": 16
         },
         "deprecated": false,
         "initialIsOpen": false
@@ -1435,7 +1468,7 @@
         ],
         "source": {
           "path": "src/plugins/presentation_util/common/labs.ts",
-          "lineNumber": 14
+          "lineNumber": 15
         },
         "deprecated": false,
         "initialIsOpen": false
@@ -1451,7 +1484,7 @@
         ],
         "source": {
           "path": "src/plugins/presentation_util/common/labs.ts",
-          "lineNumber": 22
+          "lineNumber": 23
         },
         "deprecated": false,
         "children": [
@@ -1464,7 +1497,7 @@
             "description": [],
             "source": {
               "path": "src/plugins/presentation_util/common/labs.ts",
-              "lineNumber": 23
+              "lineNumber": 24
             },
             "deprecated": false,
             "children": [
@@ -1480,7 +1513,7 @@
                 ],
                 "source": {
                   "path": "src/plugins/presentation_util/common/labs.ts",
-                  "lineNumber": 24
+                  "lineNumber": 25
                 },
                 "deprecated": false
               },
@@ -1496,7 +1529,7 @@
                 ],
                 "source": {
                   "path": "src/plugins/presentation_util/common/labs.ts",
-                  "lineNumber": 25
+                  "lineNumber": 26
                 },
                 "deprecated": false
               },
@@ -1512,7 +1545,7 @@
                 ],
                 "source": {
                   "path": "src/plugins/presentation_util/common/labs.ts",
-                  "lineNumber": 26
+                  "lineNumber": 27
                 },
                 "deprecated": false
               },
@@ -1528,7 +1561,7 @@
                 ],
                 "source": {
                   "path": "src/plugins/presentation_util/common/labs.ts",
-                  "lineNumber": 27
+                  "lineNumber": 28
                 },
                 "deprecated": false
               },
@@ -1541,7 +1574,7 @@
                 "description": [],
                 "source": {
                   "path": "src/plugins/presentation_util/common/labs.ts",
-                  "lineNumber": 28
+                  "lineNumber": 29
                 },
                 "deprecated": false
               },
@@ -1554,7 +1587,7 @@
                 "description": [],
                 "source": {
                   "path": "src/plugins/presentation_util/common/labs.ts",
-                  "lineNumber": 31
+                  "lineNumber": 32
                 },
                 "deprecated": false
               },
@@ -1570,7 +1603,7 @@
                 ],
                 "source": {
                   "path": "src/plugins/presentation_util/common/labs.ts",
-                  "lineNumber": 34
+                  "lineNumber": 35
                 },
                 "deprecated": false
               }
@@ -1585,7 +1618,7 @@
             "description": [],
             "source": {
               "path": "src/plugins/presentation_util/common/labs.ts",
-              "lineNumber": 36
+              "lineNumber": 37
             },
             "deprecated": false,
             "children": [
@@ -1601,7 +1634,7 @@
                 ],
                 "source": {
                   "path": "src/plugins/presentation_util/common/labs.ts",
-                  "lineNumber": 37
+                  "lineNumber": 38
                 },
                 "deprecated": false
               },
@@ -1617,7 +1650,7 @@
                 ],
                 "source": {
                   "path": "src/plugins/presentation_util/common/labs.ts",
-                  "lineNumber": 38
+                  "lineNumber": 39
                 },
                 "deprecated": false
               },
@@ -1633,7 +1666,7 @@
                 ],
                 "source": {
                   "path": "src/plugins/presentation_util/common/labs.ts",
-                  "lineNumber": 39
+                  "lineNumber": 40
                 },
                 "deprecated": false
               },
@@ -1649,7 +1682,7 @@
                 ],
                 "source": {
                   "path": "src/plugins/presentation_util/common/labs.ts",
-                  "lineNumber": 40
+                  "lineNumber": 41
                 },
                 "deprecated": false
               },
@@ -1662,7 +1695,7 @@
                 "description": [],
                 "source": {
                   "path": "src/plugins/presentation_util/common/labs.ts",
-                  "lineNumber": 41
+                  "lineNumber": 42
                 },
                 "deprecated": false
               },
@@ -1675,7 +1708,7 @@
                 "description": [],
                 "source": {
                   "path": "src/plugins/presentation_util/common/labs.ts",
-                  "lineNumber": 44
+                  "lineNumber": 45
                 },
                 "deprecated": false
               },
@@ -1691,7 +1724,7 @@
                 ],
                 "source": {
                   "path": "src/plugins/presentation_util/common/labs.ts",
-                  "lineNumber": 50
+                  "lineNumber": 51
                 },
                 "deprecated": false
               }
@@ -1712,7 +1745,7 @@
         ],
         "source": {
           "path": "src/plugins/presentation_util/common/labs.ts",
-          "lineNumber": 16
+          "lineNumber": 17
         },
         "deprecated": false,
         "initialIsOpen": false
diff --git a/api_docs/reporting.json b/api_docs/reporting.json
index 20158f63029f1..66cb2e3f4d68d 100644
--- a/api_docs/reporting.json
+++ b/api_docs/reporting.json
@@ -971,7 +971,7 @@
                     "section": "def-server.PluginInitializerContext",
                     "text": "PluginInitializerContext"
                   },
-                  "<Readonly<{ encryptionKey?: string | undefined; } & { enabled: boolean; index: string; capture: Readonly<{} & { browser: Readonly<{} & { type: string; chromium: Readonly<{ inspect?: boolean | undefined; disableSandbox?: boolean | undefined; } & { proxy: Readonly<{ server?: string | undefined; bypass?: string[] | undefined; } & { enabled: boolean; }>; }>; autoDownload: boolean; }>; timeouts: Readonly<{} & { openUrl: number | moment.Duration; waitForElements: number | moment.Duration; renderComplete: number | moment.Duration; }>; networkPolicy: Readonly<{} & { enabled: boolean; rules: Readonly<{ host?: string | undefined; protocol?: string | undefined; } & { allow: boolean; }>[]; }>; zoom: number; viewport: Readonly<{} & { height: number; width: number; }>; loadDelay: number | moment.Duration; maxAttempts: number; }>; roles: Readonly<{} & { enabled: boolean; allow: string[]; }>; kibanaServer: Readonly<{ port?: number | undefined; hostname?: string | undefined; protocol?: string | undefined; } & {}>; queue: Readonly<{} & { timeout: number | moment.Duration; pollInterval: number | moment.Duration; indexInterval: string; pollEnabled: boolean; pollIntervalErrorMultiplier: number; }>; csv: Readonly<{} & { scroll: Readonly<{} & { size: number; duration: string; }>; checkForFormulas: boolean; escapeFormulaValues: boolean; enablePanelActionDownload: boolean; maxSizeBytes: number | ",
+                  "<Readonly<{ encryptionKey?: string | undefined; } & { enabled: boolean; index: string; capture: Readonly<{} & { browser: Readonly<{} & { type: string; chromium: Readonly<{ inspect?: boolean | undefined; disableSandbox?: boolean | undefined; } & { proxy: Readonly<{ server?: string | undefined; bypass?: string[] | undefined; } & { enabled: boolean; }>; }>; autoDownload: boolean; }>; timeouts: Readonly<{} & { openUrl: number | moment.Duration; waitForElements: number | moment.Duration; renderComplete: number | moment.Duration; }>; networkPolicy: Readonly<{} & { enabled: boolean; rules: Readonly<{ host?: string | undefined; protocol?: string | undefined; } & { allow: boolean; }>[]; }>; zoom: number; viewport: Readonly<{} & { height: number; width: number; }>; loadDelay: number | moment.Duration; maxAttempts: number; }>; roles: Readonly<{} & { enabled: boolean; allow: string[]; }>; kibanaServer: Readonly<{ hostname?: string | undefined; port?: number | undefined; protocol?: string | undefined; } & {}>; queue: Readonly<{} & { timeout: number | moment.Duration; pollInterval: number | moment.Duration; indexInterval: string; pollEnabled: boolean; pollIntervalErrorMultiplier: number; }>; csv: Readonly<{} & { scroll: Readonly<{} & { size: number; duration: string; }>; checkForFormulas: boolean; escapeFormulaValues: boolean; enablePanelActionDownload: boolean; maxSizeBytes: number | ",
                   "ByteSizeValue",
                   "; useByteOrderMarkEncoding: boolean; }>; poll: Readonly<{} & { jobCompletionNotifier: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; jobsRefresh: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; }>; }>>"
                 ],
@@ -1915,7 +1915,7 @@
                     "section": "def-server.PluginInitializerContext",
                     "text": "PluginInitializerContext"
                   },
-                  "<Readonly<{ encryptionKey?: string | undefined; } & { enabled: boolean; index: string; capture: Readonly<{} & { browser: Readonly<{} & { type: string; chromium: Readonly<{ inspect?: boolean | undefined; disableSandbox?: boolean | undefined; } & { proxy: Readonly<{ server?: string | undefined; bypass?: string[] | undefined; } & { enabled: boolean; }>; }>; autoDownload: boolean; }>; timeouts: Readonly<{} & { openUrl: number | moment.Duration; waitForElements: number | moment.Duration; renderComplete: number | moment.Duration; }>; networkPolicy: Readonly<{} & { enabled: boolean; rules: Readonly<{ host?: string | undefined; protocol?: string | undefined; } & { allow: boolean; }>[]; }>; zoom: number; viewport: Readonly<{} & { height: number; width: number; }>; loadDelay: number | moment.Duration; maxAttempts: number; }>; roles: Readonly<{} & { enabled: boolean; allow: string[]; }>; kibanaServer: Readonly<{ port?: number | undefined; hostname?: string | undefined; protocol?: string | undefined; } & {}>; queue: Readonly<{} & { timeout: number | moment.Duration; pollInterval: number | moment.Duration; indexInterval: string; pollEnabled: boolean; pollIntervalErrorMultiplier: number; }>; csv: Readonly<{} & { scroll: Readonly<{} & { size: number; duration: string; }>; checkForFormulas: boolean; escapeFormulaValues: boolean; enablePanelActionDownload: boolean; maxSizeBytes: number | ",
+                  "<Readonly<{ encryptionKey?: string | undefined; } & { enabled: boolean; index: string; capture: Readonly<{} & { browser: Readonly<{} & { type: string; chromium: Readonly<{ inspect?: boolean | undefined; disableSandbox?: boolean | undefined; } & { proxy: Readonly<{ server?: string | undefined; bypass?: string[] | undefined; } & { enabled: boolean; }>; }>; autoDownload: boolean; }>; timeouts: Readonly<{} & { openUrl: number | moment.Duration; waitForElements: number | moment.Duration; renderComplete: number | moment.Duration; }>; networkPolicy: Readonly<{} & { enabled: boolean; rules: Readonly<{ host?: string | undefined; protocol?: string | undefined; } & { allow: boolean; }>[]; }>; zoom: number; viewport: Readonly<{} & { height: number; width: number; }>; loadDelay: number | moment.Duration; maxAttempts: number; }>; roles: Readonly<{} & { enabled: boolean; allow: string[]; }>; kibanaServer: Readonly<{ hostname?: string | undefined; port?: number | undefined; protocol?: string | undefined; } & {}>; queue: Readonly<{} & { timeout: number | moment.Duration; pollInterval: number | moment.Duration; indexInterval: string; pollEnabled: boolean; pollIntervalErrorMultiplier: number; }>; csv: Readonly<{} & { scroll: Readonly<{} & { size: number; duration: string; }>; checkForFormulas: boolean; escapeFormulaValues: boolean; enablePanelActionDownload: boolean; maxSizeBytes: number | ",
                   "ByteSizeValue",
                   "; useByteOrderMarkEncoding: boolean; }>; poll: Readonly<{} & { jobCompletionNotifier: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; jobsRefresh: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; }>; }>>"
                 ],
@@ -2127,7 +2127,7 @@
             "section": "def-server.ReportingConfig",
             "text": "ReportingConfig"
           },
-          " extends Config<Readonly<{ encryptionKey?: string | undefined; } & { enabled: boolean; index: string; capture: Readonly<{} & { browser: Readonly<{} & { type: string; chromium: Readonly<{ inspect?: boolean | undefined; disableSandbox?: boolean | undefined; } & { proxy: Readonly<{ server?: string | undefined; bypass?: string[] | undefined; } & { enabled: boolean; }>; }>; autoDownload: boolean; }>; timeouts: Readonly<{} & { openUrl: number | moment.Duration; waitForElements: number | moment.Duration; renderComplete: number | moment.Duration; }>; networkPolicy: Readonly<{} & { enabled: boolean; rules: Readonly<{ host?: string | undefined; protocol?: string | undefined; } & { allow: boolean; }>[]; }>; zoom: number; viewport: Readonly<{} & { height: number; width: number; }>; loadDelay: number | moment.Duration; maxAttempts: number; }>; roles: Readonly<{} & { enabled: boolean; allow: string[]; }>; kibanaServer: Readonly<{ port?: number | undefined; hostname?: string | undefined; protocol?: string | undefined; } & {}>; queue: Readonly<{} & { timeout: number | moment.Duration; pollInterval: number | moment.Duration; indexInterval: string; pollEnabled: boolean; pollIntervalErrorMultiplier: number; }>; csv: Readonly<{} & { scroll: Readonly<{} & { size: number; duration: string; }>; checkForFormulas: boolean; escapeFormulaValues: boolean; enablePanelActionDownload: boolean; maxSizeBytes: number | ",
+          " extends Config<Readonly<{ encryptionKey?: string | undefined; } & { enabled: boolean; index: string; capture: Readonly<{} & { browser: Readonly<{} & { type: string; chromium: Readonly<{ inspect?: boolean | undefined; disableSandbox?: boolean | undefined; } & { proxy: Readonly<{ server?: string | undefined; bypass?: string[] | undefined; } & { enabled: boolean; }>; }>; autoDownload: boolean; }>; timeouts: Readonly<{} & { openUrl: number | moment.Duration; waitForElements: number | moment.Duration; renderComplete: number | moment.Duration; }>; networkPolicy: Readonly<{} & { enabled: boolean; rules: Readonly<{ host?: string | undefined; protocol?: string | undefined; } & { allow: boolean; }>[]; }>; zoom: number; viewport: Readonly<{} & { height: number; width: number; }>; loadDelay: number | moment.Duration; maxAttempts: number; }>; roles: Readonly<{} & { enabled: boolean; allow: string[]; }>; kibanaServer: Readonly<{ hostname?: string | undefined; port?: number | undefined; protocol?: string | undefined; } & {}>; queue: Readonly<{} & { timeout: number | moment.Duration; pollInterval: number | moment.Duration; indexInterval: string; pollEnabled: boolean; pollIntervalErrorMultiplier: number; }>; csv: Readonly<{} & { scroll: Readonly<{} & { size: number; duration: string; }>; checkForFormulas: boolean; escapeFormulaValues: boolean; enablePanelActionDownload: boolean; maxSizeBytes: number | ",
           "ByteSizeValue",
           "; useByteOrderMarkEncoding: boolean; }>; poll: Readonly<{} & { jobCompletionNotifier: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; jobsRefresh: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; }>; }>>"
         ],
diff --git a/api_docs/rule_registry.json b/api_docs/rule_registry.json
index 0c67497bd1194..9d5b2997cd2e4 100644
--- a/api_docs/rule_registry.json
+++ b/api_docs/rule_registry.json
@@ -1,49 +1,48 @@
 {
   "id": "ruleRegistry",
   "client": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  },
+  "server": {
     "classes": [
       {
         "parentPluginId": "ruleRegistry",
-        "id": "def-public.RuleRegistry",
+        "id": "def-server.RuleDataClient",
         "type": "Class",
         "tags": [],
-        "label": "RuleRegistry",
+        "label": "RuleDataClient",
         "description": [],
         "signature": [
           {
             "pluginId": "ruleRegistry",
-            "scope": "public",
+            "scope": "server",
             "docId": "kibRuleRegistryPluginApi",
-            "section": "def-public.RuleRegistry",
-            "text": "RuleRegistry"
+            "section": "def-server.RuleDataClient",
+            "text": "RuleDataClient"
           },
-          "<TFieldMap, TRuleType>"
+          " implements ",
+          {
+            "pluginId": "ruleRegistry",
+            "scope": "server",
+            "docId": "kibRuleRegistryPluginApi",
+            "section": "def-server.IRuleDataClient",
+            "text": "IRuleDataClient"
+          }
         ],
         "source": {
-          "path": "x-pack/plugins/rule_registry/public/rule_registry/index.ts",
-          "lineNumber": 11
+          "path": "x-pack/plugins/rule_registry/server/rule_data_client/index.ts",
+          "lineNumber": 21
         },
         "deprecated": false,
         "children": [
           {
             "parentPluginId": "ruleRegistry",
-            "id": "def-public.RuleRegistry.types",
-            "type": "Array",
-            "tags": [],
-            "label": "types",
-            "description": [],
-            "signature": [
-              "TRuleType[]"
-            ],
-            "source": {
-              "path": "x-pack/plugins/rule_registry/public/rule_registry/index.ts",
-              "lineNumber": 12
-            },
-            "deprecated": false
-          },
-          {
-            "parentPluginId": "ruleRegistry",
-            "id": "def-public.RuleRegistry.Unnamed",
+            "id": "def-server.RuleDataClient.Unnamed",
             "type": "Function",
             "tags": [],
             "label": "Constructor",
@@ -52,25 +51,24 @@
               "any"
             ],
             "source": {
-              "path": "x-pack/plugins/rule_registry/public/rule_registry/index.ts",
-              "lineNumber": 14
+              "path": "x-pack/plugins/rule_registry/server/rule_data_client/index.ts",
+              "lineNumber": 22
             },
             "deprecated": false,
             "children": [
               {
                 "parentPluginId": "ruleRegistry",
-                "id": "def-public.RuleRegistry.Unnamed.$1",
+                "id": "def-server.RuleDataClient.Unnamed.$1",
                 "type": "Object",
                 "tags": [],
                 "label": "options",
                 "description": [],
                 "signature": [
-                  "RuleRegistryConstructorOptions",
-                  "<TFieldMap>"
+                  "RuleDataClientConstructorOptions"
                 ],
                 "source": {
-                  "path": "x-pack/plugins/rule_registry/public/rule_registry/index.ts",
-                  "lineNumber": 14
+                  "path": "x-pack/plugins/rule_registry/server/rule_data_client/index.ts",
+                  "lineNumber": 22
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -80,154 +78,152 @@
           },
           {
             "parentPluginId": "ruleRegistry",
-            "id": "def-public.RuleRegistry.getTypes",
-            "type": "Function",
-            "tags": [],
-            "label": "getTypes",
-            "description": [],
-            "signature": [
-              "() => TRuleType[]"
-            ],
-            "source": {
-              "path": "x-pack/plugins/rule_registry/public/rule_registry/index.ts",
-              "lineNumber": 16
-            },
-            "deprecated": false,
-            "children": [],
-            "returnComment": []
-          },
-          {
-            "parentPluginId": "ruleRegistry",
-            "id": "def-public.RuleRegistry.getTypeByRuleId",
+            "id": "def-server.RuleDataClient.getReader",
             "type": "Function",
             "tags": [],
-            "label": "getTypeByRuleId",
+            "label": "getReader",
             "description": [],
             "signature": [
-              "(id: string) => TRuleType | undefined"
+              "(options?: { namespace?: string | undefined; }) => ",
+              "RuleDataReader"
             ],
             "source": {
-              "path": "x-pack/plugins/rule_registry/public/rule_registry/index.ts",
-              "lineNumber": 20
+              "path": "x-pack/plugins/rule_registry/server/rule_data_client/index.ts",
+              "lineNumber": 29
             },
             "deprecated": false,
             "children": [
               {
                 "parentPluginId": "ruleRegistry",
-                "id": "def-public.RuleRegistry.getTypeByRuleId.$1",
-                "type": "string",
+                "id": "def-server.RuleDataClient.getReader.$1.options",
+                "type": "Object",
                 "tags": [],
-                "label": "id",
+                "label": "options",
                 "description": [],
-                "signature": [
-                  "string"
-                ],
                 "source": {
-                  "path": "x-pack/plugins/rule_registry/public/rule_registry/index.ts",
-                  "lineNumber": 20
+                  "path": "x-pack/plugins/rule_registry/server/rule_data_client/index.ts",
+                  "lineNumber": 29
                 },
                 "deprecated": false,
-                "isRequired": true
+                "children": [
+                  {
+                    "parentPluginId": "ruleRegistry",
+                    "id": "def-server.RuleDataClient.getReader.$1.options.namespace",
+                    "type": "string",
+                    "tags": [],
+                    "label": "namespace",
+                    "description": [],
+                    "signature": [
+                      "string | undefined"
+                    ],
+                    "source": {
+                      "path": "x-pack/plugins/rule_registry/server/rule_data_client/index.ts",
+                      "lineNumber": 29
+                    },
+                    "deprecated": false
+                  }
+                ]
               }
             ],
             "returnComment": []
           },
           {
             "parentPluginId": "ruleRegistry",
-            "id": "def-public.RuleRegistry.registerType",
+            "id": "def-server.RuleDataClient.getWriter",
             "type": "Function",
             "tags": [],
-            "label": "registerType",
+            "label": "getWriter",
             "description": [],
             "signature": [
-              "(type: TRuleType) => void"
+              "(options?: { namespace?: string | undefined; }) => ",
+              "RuleDataWriter"
             ],
             "source": {
-              "path": "x-pack/plugins/rule_registry/public/rule_registry/index.ts",
-              "lineNumber": 24
+              "path": "x-pack/plugins/rule_registry/server/rule_data_client/index.ts",
+              "lineNumber": 60
             },
             "deprecated": false,
             "children": [
               {
                 "parentPluginId": "ruleRegistry",
-                "id": "def-public.RuleRegistry.registerType.$1",
-                "type": "Uncategorized",
+                "id": "def-server.RuleDataClient.getWriter.$1.options",
+                "type": "Object",
                 "tags": [],
-                "label": "type",
+                "label": "options",
                 "description": [],
-                "signature": [
-                  "TRuleType"
-                ],
                 "source": {
-                  "path": "x-pack/plugins/rule_registry/public/rule_registry/index.ts",
-                  "lineNumber": 24
+                  "path": "x-pack/plugins/rule_registry/server/rule_data_client/index.ts",
+                  "lineNumber": 60
                 },
                 "deprecated": false,
-                "isRequired": true
+                "children": [
+                  {
+                    "parentPluginId": "ruleRegistry",
+                    "id": "def-server.RuleDataClient.getWriter.$1.options.namespace",
+                    "type": "string",
+                    "tags": [],
+                    "label": "namespace",
+                    "description": [],
+                    "signature": [
+                      "string | undefined"
+                    ],
+                    "source": {
+                      "path": "x-pack/plugins/rule_registry/server/rule_data_client/index.ts",
+                      "lineNumber": 60
+                    },
+                    "deprecated": false
+                  }
+                ]
               }
             ],
             "returnComment": []
           },
           {
             "parentPluginId": "ruleRegistry",
-            "id": "def-public.RuleRegistry.create",
+            "id": "def-server.RuleDataClient.createOrUpdateWriteTarget",
             "type": "Function",
             "tags": [],
-            "label": "create",
+            "label": "createOrUpdateWriteTarget",
             "description": [],
             "signature": [
-              "<TNextFieldMap extends ",
-              {
-                "pluginId": "ruleRegistry",
-                "scope": "common",
-                "docId": "kibRuleRegistryPluginApi",
-                "section": "def-common.FieldMap",
-                "text": "FieldMap"
-              },
-              ", TRuleRegistryInstance extends ",
-              {
-                "pluginId": "ruleRegistry",
-                "scope": "public",
-                "docId": "kibRuleRegistryPluginApi",
-                "section": "def-public.IRuleRegistry",
-                "text": "IRuleRegistry"
-              },
-              "<TFieldMap & TNextFieldMap, any, undefined> = ",
-              {
-                "pluginId": "ruleRegistry",
-                "scope": "public",
-                "docId": "kibRuleRegistryPluginApi",
-                "section": "def-public.IRuleRegistry",
-                "text": "IRuleRegistry"
-              },
-              "<TFieldMap & TNextFieldMap, TRuleType, undefined>>({ fieldMap, ctor }: { fieldMap: TNextFieldMap; ctor?: (new (options: ",
-              "RuleRegistryConstructorOptions",
-              "<TFieldMap & TNextFieldMap>) => TRuleRegistryInstance) | undefined; }) => any"
+              "({ namespace }: { namespace?: string | undefined; }) => Promise<void>"
             ],
             "source": {
-              "path": "x-pack/plugins/rule_registry/public/rule_registry/index.ts",
-              "lineNumber": 33
+              "path": "x-pack/plugins/rule_registry/server/rule_data_client/index.ts",
+              "lineNumber": 92
             },
             "deprecated": false,
             "children": [
               {
                 "parentPluginId": "ruleRegistry",
-                "id": "def-public.RuleRegistry.create.$1",
+                "id": "def-server.RuleDataClient.createOrUpdateWriteTarget.$1.namespace",
                 "type": "Object",
                 "tags": [],
-                "label": "{ fieldMap, ctor }",
+                "label": "{ namespace }",
                 "description": [],
-                "signature": [
-                  "{ fieldMap: TNextFieldMap; ctor?: (new (options: ",
-                  "RuleRegistryConstructorOptions",
-                  "<TFieldMap & TNextFieldMap>) => TRuleRegistryInstance) | undefined; }"
-                ],
                 "source": {
-                  "path": "x-pack/plugins/rule_registry/public/rule_registry/index.ts",
-                  "lineNumber": 33
+                  "path": "x-pack/plugins/rule_registry/server/rule_data_client/index.ts",
+                  "lineNumber": 92
                 },
                 "deprecated": false,
-                "isRequired": true
+                "children": [
+                  {
+                    "parentPluginId": "ruleRegistry",
+                    "id": "def-server.RuleDataClient.createOrUpdateWriteTarget.$1.namespace.namespace",
+                    "type": "string",
+                    "tags": [],
+                    "label": "namespace",
+                    "description": [],
+                    "signature": [
+                      "string | undefined"
+                    ],
+                    "source": {
+                      "path": "x-pack/plugins/rule_registry/server/rule_data_client/index.ts",
+                      "lineNumber": 92
+                    },
+                    "deprecated": false
+                  }
+                ]
               }
             ],
             "returnComment": []
@@ -236,236 +232,212 @@
         "initialIsOpen": false
       }
     ],
-    "functions": [],
-    "interfaces": [
+    "functions": [
       {
         "parentPluginId": "ruleRegistry",
-        "id": "def-public.IRuleRegistry",
-        "type": "Interface",
+        "id": "def-server.createLifecycleRuleTypeFactory",
+        "type": "Function",
         "tags": [],
-        "label": "IRuleRegistry",
+        "label": "createLifecycleRuleTypeFactory",
         "description": [],
         "signature": [
+          "({ logger, ruleDataClient, }: { ruleDataClient: ",
           {
             "pluginId": "ruleRegistry",
-            "scope": "public",
+            "scope": "server",
             "docId": "kibRuleRegistryPluginApi",
-            "section": "def-public.IRuleRegistry",
-            "text": "IRuleRegistry"
+            "section": "def-server.RuleDataClient",
+            "text": "RuleDataClient"
+          },
+          "; logger: ",
+          "Logger",
+          "; }) => <TParams extends Record<string, unknown>, TAlertInstanceContext extends { [x: string]: unknown; }, TServices extends { alertWithLifecycle: LifecycleAlertService<TAlertInstanceContext>; }>(type: ",
+          "AlertTypeWithExecutor",
+          "<TParams, TAlertInstanceContext, TServices>) => { executor: (options: ",
+          {
+            "pluginId": "alerting",
+            "scope": "server",
+            "docId": "kibAlertingPluginApi",
+            "section": "def-server.AlertExecutorOptions",
+            "text": "AlertExecutorOptions"
           },
-          "<TFieldMap, TRuleType, TInstanceType>"
+          "<TParams, Record<string, unknown>, { [x: string]: unknown; }, TAlertInstanceContext, never> & { services: any; }) => Promise<{ wrapped: any; trackedAlerts: { [k: string]: { alertId: string; alertUuid: string; started: string; }; }; }>; id: string; name: string; validate?: { params?: ",
+          "AlertTypeParamsValidator"
         ],
         "source": {
-          "path": "x-pack/plugins/rule_registry/public/rule_registry/types.ts",
-          "lineNumber": 47
+          "path": "x-pack/plugins/rule_registry/server/utils/create_lifecycle_rule_type_factory.ts",
+          "lineNumber": 62
         },
         "deprecated": false,
         "children": [
           {
             "parentPluginId": "ruleRegistry",
-            "id": "def-public.IRuleRegistry.create",
-            "type": "Function",
-            "tags": [],
-            "label": "create",
-            "description": [],
-            "signature": [
-              "CreateRuleRegistry",
-              "<TFieldMap, TRuleType, TInstanceType>"
-            ],
-            "source": {
-              "path": "x-pack/plugins/rule_registry/public/rule_registry/types.ts",
-              "lineNumber": 52
-            },
-            "deprecated": false
-          },
-          {
-            "parentPluginId": "ruleRegistry",
-            "id": "def-public.IRuleRegistry.registerType",
-            "type": "Function",
-            "tags": [],
-            "label": "registerType",
-            "description": [],
-            "signature": [
-              "(type: TRuleType) => void"
-            ],
-            "source": {
-              "path": "x-pack/plugins/rule_registry/public/rule_registry/types.ts",
-              "lineNumber": 53
-            },
-            "deprecated": false,
-            "children": [
-              {
-                "parentPluginId": "ruleRegistry",
-                "id": "def-public.IRuleRegistry.registerType.$1",
-                "type": "Uncategorized",
-                "tags": [],
-                "label": "type",
-                "description": [],
-                "signature": [
-                  "TRuleType"
-                ],
-                "source": {
-                  "path": "x-pack/plugins/rule_registry/public/rule_registry/types.ts",
-                  "lineNumber": 53
-                },
-                "deprecated": false,
-                "isRequired": true
-              }
-            ],
-            "returnComment": []
-          },
-          {
-            "parentPluginId": "ruleRegistry",
-            "id": "def-public.IRuleRegistry.getTypeByRuleId",
-            "type": "Function",
+            "id": "def-server.createLifecycleRuleTypeFactory.$1",
+            "type": "Object",
             "tags": [],
-            "label": "getTypeByRuleId",
+            "label": "{\n  logger,\n  ruleDataClient,\n}",
             "description": [],
             "signature": [
-              "(ruleId: string) => TRuleType"
-            ],
-            "source": {
-              "path": "x-pack/plugins/rule_registry/public/rule_registry/types.ts",
-              "lineNumber": 54
-            },
-            "deprecated": false,
-            "children": [
+              "{ ruleDataClient: ",
               {
-                "parentPluginId": "ruleRegistry",
-                "id": "def-public.IRuleRegistry.getTypeByRuleId.$1",
-                "type": "string",
-                "tags": [],
-                "label": "ruleId",
-                "description": [],
-                "signature": [
-                  "string"
-                ],
-                "source": {
-                  "path": "x-pack/plugins/rule_registry/public/rule_registry/types.ts",
-                  "lineNumber": 54
-                },
-                "deprecated": false,
-                "isRequired": true
-              }
-            ],
-            "returnComment": []
-          },
-          {
-            "parentPluginId": "ruleRegistry",
-            "id": "def-public.IRuleRegistry.getTypes",
-            "type": "Function",
-            "tags": [],
-            "label": "getTypes",
-            "description": [],
-            "signature": [
-              "() => TRuleType[]"
+                "pluginId": "ruleRegistry",
+                "scope": "server",
+                "docId": "kibRuleRegistryPluginApi",
+                "section": "def-server.RuleDataClient",
+                "text": "RuleDataClient"
+              },
+              "; logger: ",
+              "Logger",
+              "; }"
             ],
             "source": {
-              "path": "x-pack/plugins/rule_registry/public/rule_registry/types.ts",
-              "lineNumber": 55
+              "path": "x-pack/plugins/rule_registry/server/utils/create_lifecycle_rule_type_factory.ts",
+              "lineNumber": 62
             },
             "deprecated": false,
-            "children": [],
-            "returnComment": []
+            "isRequired": true
           }
         ],
+        "returnComment": [],
         "initialIsOpen": false
-      }
-    ],
-    "enums": [],
-    "misc": [
+      },
       {
         "parentPluginId": "ruleRegistry",
-        "id": "def-public.RuleRegistryPublicPluginSetupContract",
-        "type": "Type",
+        "id": "def-server.createPersistenceRuleTypeFactory",
+        "type": "Function",
         "tags": [],
-        "label": "RuleRegistryPublicPluginSetupContract",
+        "label": "createPersistenceRuleTypeFactory",
         "description": [],
         "signature": [
-          "{ registry: RuleRegistry<{ readonly 'kibana.rac.producer': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.uuid': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.id': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.start': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.end': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.duration.us': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.severity.level': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.severity.value': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.status': { readonly type: \"keyword\"; }; readonly '@timestamp': { readonly type: \"date\"; readonly array: false; readonly required: true; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'event.kind': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.action': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.uuid': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.category': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; }, ",
+          "({ logger, ruleDataClient, }: { ruleDataClient: ",
           {
-            "pluginId": "triggersActionsUi",
-            "scope": "public",
-            "docId": "kibTriggersActionsUiPluginApi",
-            "section": "def-public.AlertTypeModel",
-            "text": "AlertTypeModel"
+            "pluginId": "ruleRegistry",
+            "scope": "server",
+            "docId": "kibRuleRegistryPluginApi",
+            "section": "def-server.RuleDataClient",
+            "text": "RuleDataClient"
           },
-          "<Record<string, unknown>>>; }"
-        ],
-        "source": {
-          "path": "x-pack/plugins/rule_registry/public/plugin.ts",
-          "lineNumber": 35
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "ruleRegistry",
-        "id": "def-public.RuleType",
-        "type": "Type",
-        "tags": [],
-        "label": "RuleType",
-        "description": [],
-        "signature": [
+          "; logger: ",
+          "Logger",
+          "; }) => <TParams extends Record<string, unknown>, TAlertInstanceContext extends { [x: string]: unknown; }, TServices extends { alertWithPersistence: PersistenceAlertService<TAlertInstanceContext>; findAlerts: PersistenceAlertQueryService; }>(type: ",
+          "AlertTypeWithExecutor",
+          "<TParams, TAlertInstanceContext, TServices>) => { executor: (options: ",
           {
-            "pluginId": "triggersActionsUi",
-            "scope": "public",
-            "docId": "kibTriggersActionsUiPluginApi",
-            "section": "def-public.AlertTypeModel",
-            "text": "AlertTypeModel"
+            "pluginId": "alerting",
+            "scope": "server",
+            "docId": "kibAlertingPluginApi",
+            "section": "def-server.AlertExecutorOptions",
+            "text": "AlertExecutorOptions"
           },
-          "<Record<string, unknown>>"
+          "<TParams, Record<string, unknown>, { [x: string]: unknown; }, TAlertInstanceContext, never> & { services: any; }) => Promise<any>; id: string; name: string; validate?: { params?: ",
+          "AlertTypeParamsValidator"
         ],
         "source": {
-          "path": "x-pack/plugins/rule_registry/public/rule_registry/types.ts",
-          "lineNumber": 16
+          "path": "x-pack/plugins/rule_registry/server/utils/create_persistence_rule_type_factory.ts",
+          "lineNumber": 42
         },
         "deprecated": false,
-        "initialIsOpen": false
-      }
-    ],
-    "objects": []
-  },
-  "server": {
-    "classes": [],
-    "functions": [
-      {
-        "parentPluginId": "ruleRegistry",
-        "id": "def-server.createLifecycleRuleTypeFactory",
-        "type": "Function",
-        "tags": [],
-        "label": "createLifecycleRuleTypeFactory",
-        "description": [],
-        "signature": [
-          "() => TRuleRegistry extends ",
-          "RuleRegistry",
-          "<infer TFieldMap> ? CreateLifecycleRuleType<TFieldMap> : never"
+        "children": [
+          {
+            "parentPluginId": "ruleRegistry",
+            "id": "def-server.createPersistenceRuleTypeFactory.$1",
+            "type": "Object",
+            "tags": [],
+            "label": "{\n  logger,\n  ruleDataClient,\n}",
+            "description": [],
+            "signature": [
+              "{ ruleDataClient: ",
+              {
+                "pluginId": "ruleRegistry",
+                "scope": "server",
+                "docId": "kibRuleRegistryPluginApi",
+                "section": "def-server.RuleDataClient",
+                "text": "RuleDataClient"
+              },
+              "; logger: ",
+              "Logger",
+              "; }"
+            ],
+            "source": {
+              "path": "x-pack/plugins/rule_registry/server/utils/create_persistence_rule_type_factory.ts",
+              "lineNumber": 42
+            },
+            "deprecated": false,
+            "isRequired": true
+          }
         ],
-        "source": {
-          "path": "x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_lifecycle_rule_type_factory.ts",
-          "lineNumber": 54
-        },
-        "deprecated": false,
-        "children": [],
         "returnComment": [],
         "initialIsOpen": false
       },
       {
         "parentPluginId": "ruleRegistry",
-        "id": "def-server.createLifecycleRuleTypeFactory",
+        "id": "def-server.getRuleExecutorData",
         "type": "Function",
         "tags": [],
-        "label": "createLifecycleRuleTypeFactory",
+        "label": "getRuleExecutorData",
         "description": [],
         "signature": [
-          "() => CreateLifecycleRuleType<{ readonly 'kibana.rac.producer': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.uuid': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.id': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.start': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.end': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.duration.us': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.severity.level': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.severity.value': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.status': { readonly type: \"keyword\"; }; readonly '@timestamp': { readonly type: \"date\"; readonly array: false; readonly required: true; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'event.kind': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.action': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.uuid': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.category': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; }>"
+          "(type: ",
+          "AlertTypeWithExecutor",
+          "<any, any, any>, options: ",
+          {
+            "pluginId": "alerting",
+            "scope": "server",
+            "docId": "kibAlertingPluginApi",
+            "section": "def-server.AlertExecutorOptions",
+            "text": "AlertExecutorOptions"
+          },
+          "<{}, Record<string, unknown>, { [x: string]: unknown; }, {}, never> & { services: {}; }) => { \"rule.id\": string; \"rule.uuid\": string; \"rule.category\": string; \"rule.name\": string; tags: string[]; \"kibana.rac.alert.producer\": string; }"
         ],
         "source": {
-          "path": "x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_lifecycle_rule_type_factory.ts",
-          "lineNumber": 60
+          "path": "x-pack/plugins/rule_registry/server/utils/get_rule_executor_data.ts",
+          "lineNumber": 27
         },
         "deprecated": false,
-        "children": [],
+        "children": [
+          {
+            "parentPluginId": "ruleRegistry",
+            "id": "def-server.getRuleExecutorData.$1",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "type",
+            "description": [],
+            "signature": [
+              "AlertTypeWithExecutor",
+              "<any, any, any>"
+            ],
+            "source": {
+              "path": "x-pack/plugins/rule_registry/server/utils/get_rule_executor_data.ts",
+              "lineNumber": 28
+            },
+            "deprecated": false,
+            "isRequired": true
+          },
+          {
+            "parentPluginId": "ruleRegistry",
+            "id": "def-server.getRuleExecutorData.$2",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "options",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "alerting",
+                "scope": "server",
+                "docId": "kibAlertingPluginApi",
+                "section": "def-server.AlertExecutorOptions",
+                "text": "AlertExecutorOptions"
+              },
+              "<{}, Record<string, unknown>, { [x: string]: unknown; }, {}, never> & { services: {}; }"
+            ],
+            "source": {
+              "path": "x-pack/plugins/rule_registry/server/utils/get_rule_executor_data.ts",
+              "lineNumber": 29
+            },
+            "deprecated": false,
+            "isRequired": true
+          }
+        ],
         "returnComment": [],
         "initialIsOpen": false
       }
@@ -473,435 +445,263 @@
     "interfaces": [
       {
         "parentPluginId": "ruleRegistry",
-        "id": "def-server.ScopedRuleRegistryClient",
+        "id": "def-server.IRuleDataClient",
         "type": "Interface",
         "tags": [],
-        "label": "ScopedRuleRegistryClient",
+        "label": "IRuleDataClient",
         "description": [],
-        "signature": [
-          {
-            "pluginId": "ruleRegistry",
-            "scope": "server",
-            "docId": "kibRuleRegistryPluginApi",
-            "section": "def-server.ScopedRuleRegistryClient",
-            "text": "ScopedRuleRegistryClient"
-          },
-          "<TFieldMap>"
-        ],
         "source": {
-          "path": "x-pack/plugins/rule_registry/server/rule_registry/create_scoped_rule_registry_client/types.ts",
-          "lineNumber": 41
+          "path": "x-pack/plugins/rule_registry/server/rule_data_client/types.ts",
+          "lineNumber": 34
         },
         "deprecated": false,
         "children": [
           {
             "parentPluginId": "ruleRegistry",
-            "id": "def-server.ScopedRuleRegistryClient.search",
+            "id": "def-server.IRuleDataClient.getReader",
             "type": "Function",
             "tags": [],
-            "label": "search",
+            "label": "getReader",
             "description": [],
             "signature": [
-              "<TSearchRequest extends FieldsESSearchRequest<TFieldMap>>(request: TSearchRequest) => Promise<{ body: ",
-              "InferSearchResponseOf",
-              "<unknown, TSearchRequest, { restTotalHitsAsInt: false; }>; events: ",
-              "EventsOf",
-              "<TSearchRequest, TFieldMap>; }>"
+              "(options?: { namespace?: string | undefined; } | undefined) => ",
+              "RuleDataReader"
             ],
             "source": {
-              "path": "x-pack/plugins/rule_registry/server/rule_registry/create_scoped_rule_registry_client/types.ts",
-              "lineNumber": 42
+              "path": "x-pack/plugins/rule_registry/server/rule_data_client/types.ts",
+              "lineNumber": 35
             },
             "deprecated": false,
             "children": [
               {
                 "parentPluginId": "ruleRegistry",
-                "id": "def-server.ScopedRuleRegistryClient.search.$1",
-                "type": "Uncategorized",
+                "id": "def-server.IRuleDataClient.getReader.$1.options",
+                "type": "Object",
                 "tags": [],
-                "label": "request",
+                "label": "options",
                 "description": [],
-                "signature": [
-                  "TSearchRequest"
-                ],
                 "source": {
-                  "path": "x-pack/plugins/rule_registry/server/rule_registry/create_scoped_rule_registry_client/types.ts",
-                  "lineNumber": 43
+                  "path": "x-pack/plugins/rule_registry/server/rule_data_client/types.ts",
+                  "lineNumber": 35
                 },
                 "deprecated": false,
-                "isRequired": true
+                "children": [
+                  {
+                    "parentPluginId": "ruleRegistry",
+                    "id": "def-server.IRuleDataClient.getReader.$1.options.namespace",
+                    "type": "string",
+                    "tags": [],
+                    "label": "namespace",
+                    "description": [],
+                    "signature": [
+                      "string | undefined"
+                    ],
+                    "source": {
+                      "path": "x-pack/plugins/rule_registry/server/rule_data_client/types.ts",
+                      "lineNumber": 35
+                    },
+                    "deprecated": false
+                  }
+                ]
               }
             ],
             "returnComment": []
           },
           {
             "parentPluginId": "ruleRegistry",
-            "id": "def-server.ScopedRuleRegistryClient.getDynamicIndexPattern",
+            "id": "def-server.IRuleDataClient.getWriter",
             "type": "Function",
             "tags": [],
-            "label": "getDynamicIndexPattern",
+            "label": "getWriter",
             "description": [],
             "signature": [
-              "() => Promise<{ title: string; timeFieldName: string; fields: ",
-              {
-                "pluginId": "data",
-                "scope": "server",
-                "docId": "kibDataIndexPatternsPluginApi",
-                "section": "def-server.FieldDescriptor",
-                "text": "FieldDescriptor"
-              },
-              "[]; }>"
+              "(options?: { namespace?: string | undefined; } | undefined) => ",
+              "RuleDataWriter"
             ],
             "source": {
-              "path": "x-pack/plugins/rule_registry/server/rule_registry/create_scoped_rule_registry_client/types.ts",
-              "lineNumber": 48
-            },
-            "deprecated": false,
-            "children": [],
-            "returnComment": []
-          },
-          {
-            "parentPluginId": "ruleRegistry",
-            "id": "def-server.ScopedRuleRegistryClient.index",
-            "type": "Function",
-            "tags": [],
-            "label": "index",
-            "description": [],
-            "signature": [
-              "(doc: Pick<OutputOf<",
-              "Optional",
-              "<TFieldMap, { [key in keyof TFieldMap]: TFieldMap[key][\"required\"] extends true ? never : key; }[keyof TFieldMap]>>, Exclude<{ [key in keyof TFieldMap]: TFieldMap[key][\"required\"] extends true ? never : key; }[keyof TFieldMap], \"rule.uuid\" | \"rule.id\" | \"rule.name\" | \"rule.category\" | \"kibana.rac.producer\"> | Exclude<",
-              "SetDifference",
-              "<keyof TFieldMap, { [key in keyof TFieldMap]: TFieldMap[key][\"required\"] extends true ? never : key; }[keyof TFieldMap]>, \"rule.uuid\" | \"rule.id\" | \"rule.name\" | \"rule.category\" | \"kibana.rac.producer\">>) => void"
-            ],
-            "source": {
-              "path": "x-pack/plugins/rule_registry/server/rule_registry/create_scoped_rule_registry_client/types.ts",
-              "lineNumber": 53
+              "path": "x-pack/plugins/rule_registry/server/rule_data_client/types.ts",
+              "lineNumber": 36
             },
             "deprecated": false,
             "children": [
               {
                 "parentPluginId": "ruleRegistry",
-                "id": "def-server.ScopedRuleRegistryClient.index.$1",
+                "id": "def-server.IRuleDataClient.getWriter.$1.options",
                 "type": "Object",
                 "tags": [],
-                "label": "doc",
+                "label": "options",
                 "description": [],
-                "signature": [
-                  "Pick<OutputOf<",
-                  "Optional",
-                  "<TFieldMap, { [key in keyof TFieldMap]: TFieldMap[key][\"required\"] extends true ? never : key; }[keyof TFieldMap]>>, Exclude<{ [key in keyof TFieldMap]: TFieldMap[key][\"required\"] extends true ? never : key; }[keyof TFieldMap], \"rule.uuid\" | \"rule.id\" | \"rule.name\" | \"rule.category\" | \"kibana.rac.producer\"> | Exclude<",
-                  "SetDifference",
-                  "<keyof TFieldMap, { [key in keyof TFieldMap]: TFieldMap[key][\"required\"] extends true ? never : key; }[keyof TFieldMap]>, \"rule.uuid\" | \"rule.id\" | \"rule.name\" | \"rule.category\" | \"kibana.rac.producer\">>"
-                ],
                 "source": {
-                  "path": "x-pack/plugins/rule_registry/server/rule_registry/create_scoped_rule_registry_client/types.ts",
-                  "lineNumber": 53
+                  "path": "x-pack/plugins/rule_registry/server/rule_data_client/types.ts",
+                  "lineNumber": 36
                 },
                 "deprecated": false,
-                "isRequired": true
+                "children": [
+                  {
+                    "parentPluginId": "ruleRegistry",
+                    "id": "def-server.IRuleDataClient.getWriter.$1.options.namespace",
+                    "type": "string",
+                    "tags": [],
+                    "label": "namespace",
+                    "description": [],
+                    "signature": [
+                      "string | undefined"
+                    ],
+                    "source": {
+                      "path": "x-pack/plugins/rule_registry/server/rule_data_client/types.ts",
+                      "lineNumber": 36
+                    },
+                    "deprecated": false
+                  }
+                ]
               }
             ],
             "returnComment": []
           },
           {
             "parentPluginId": "ruleRegistry",
-            "id": "def-server.ScopedRuleRegistryClient.bulkIndex",
+            "id": "def-server.IRuleDataClient.createOrUpdateWriteTarget",
             "type": "Function",
             "tags": [],
-            "label": "bulkIndex",
+            "label": "createOrUpdateWriteTarget",
             "description": [],
             "signature": [
-              "(doc: Pick<OutputOf<",
-              "Optional",
-              "<TFieldMap, { [key in keyof TFieldMap]: TFieldMap[key][\"required\"] extends true ? never : key; }[keyof TFieldMap]>>, Exclude<{ [key in keyof TFieldMap]: TFieldMap[key][\"required\"] extends true ? never : key; }[keyof TFieldMap], \"rule.uuid\" | \"rule.id\" | \"rule.name\" | \"rule.category\" | \"kibana.rac.producer\"> | Exclude<",
-              "SetDifference",
-              "<keyof TFieldMap, { [key in keyof TFieldMap]: TFieldMap[key][\"required\"] extends true ? never : key; }[keyof TFieldMap]>, \"rule.uuid\" | \"rule.id\" | \"rule.name\" | \"rule.category\" | \"kibana.rac.producer\">>[]) => Promise<void>"
+              "(options: { namespace?: string | undefined; }) => Promise<void>"
             ],
             "source": {
-              "path": "x-pack/plugins/rule_registry/server/rule_registry/create_scoped_rule_registry_client/types.ts",
-              "lineNumber": 54
+              "path": "x-pack/plugins/rule_registry/server/rule_data_client/types.ts",
+              "lineNumber": 37
             },
             "deprecated": false,
             "children": [
               {
                 "parentPluginId": "ruleRegistry",
-                "id": "def-server.ScopedRuleRegistryClient.bulkIndex.$1",
-                "type": "Array",
+                "id": "def-server.IRuleDataClient.createOrUpdateWriteTarget.$1.options",
+                "type": "Object",
                 "tags": [],
-                "label": "doc",
+                "label": "options",
                 "description": [],
-                "signature": [
-                  "Pick<OutputOf<",
-                  "Optional",
-                  "<TFieldMap, { [key in keyof TFieldMap]: TFieldMap[key][\"required\"] extends true ? never : key; }[keyof TFieldMap]>>, Exclude<{ [key in keyof TFieldMap]: TFieldMap[key][\"required\"] extends true ? never : key; }[keyof TFieldMap], \"rule.uuid\" | \"rule.id\" | \"rule.name\" | \"rule.category\" | \"kibana.rac.producer\"> | Exclude<",
-                  "SetDifference",
-                  "<keyof TFieldMap, { [key in keyof TFieldMap]: TFieldMap[key][\"required\"] extends true ? never : key; }[keyof TFieldMap]>, \"rule.uuid\" | \"rule.id\" | \"rule.name\" | \"rule.category\" | \"kibana.rac.producer\">>[]"
-                ],
                 "source": {
-                  "path": "x-pack/plugins/rule_registry/server/rule_registry/create_scoped_rule_registry_client/types.ts",
-                  "lineNumber": 55
+                  "path": "x-pack/plugins/rule_registry/server/rule_data_client/types.ts",
+                  "lineNumber": 37
                 },
                 "deprecated": false,
-                "isRequired": true
+                "children": [
+                  {
+                    "parentPluginId": "ruleRegistry",
+                    "id": "def-server.IRuleDataClient.createOrUpdateWriteTarget.$1.options.namespace",
+                    "type": "string",
+                    "tags": [],
+                    "label": "namespace",
+                    "description": [],
+                    "signature": [
+                      "string | undefined"
+                    ],
+                    "source": {
+                      "path": "x-pack/plugins/rule_registry/server/rule_data_client/types.ts",
+                      "lineNumber": 37
+                    },
+                    "deprecated": false
+                  }
+                ]
               }
             ],
             "returnComment": []
           }
         ],
         "initialIsOpen": false
-      }
-    ],
-    "enums": [],
-    "misc": [
-      {
-        "parentPluginId": "ruleRegistry",
-        "id": "def-server.FieldMapOf",
-        "type": "Type",
-        "tags": [],
-        "label": "FieldMapOf",
-        "description": [],
-        "signature": [
-          "TRuleRegistry extends RuleRegistry<infer TFieldMap> ? TFieldMap : never"
-        ],
-        "source": {
-          "path": "x-pack/plugins/rule_registry/server/types.ts",
-          "lineNumber": 98
-        },
-        "deprecated": false,
-        "initialIsOpen": false
       },
       {
         "parentPluginId": "ruleRegistry",
-        "id": "def-server.RuleRegistryConfig",
-        "type": "Type",
-        "tags": [],
-        "label": "RuleRegistryConfig",
-        "description": [],
-        "signature": [
-          "{ readonly enabled: boolean; readonly unsafe: Readonly<{} & { write: Readonly<{} & { enabled: boolean; }>; }>; }"
-        ],
-        "source": {
-          "path": "x-pack/plugins/rule_registry/server/index.ts",
-          "lineNumber": 26
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      }
-    ],
-    "objects": [],
-    "setup": {
-      "parentPluginId": "ruleRegistry",
-      "id": "def-server.RuleRegistryPluginSetupContract",
-      "type": "Type",
-      "tags": [],
-      "label": "RuleRegistryPluginSetupContract",
-      "description": [],
-      "signature": [
-        "RuleRegistry<{ readonly 'kibana.rac.producer': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.uuid': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.id': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.start': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.end': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.duration.us': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.severity.level': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.severity.value': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.status': { readonly type: \"keyword\"; }; readonly '@timestamp': { readonly type: \"date\"; readonly array: false; readonly required: true; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'event.kind': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.action': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.uuid': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.category': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; }>"
-      ],
-      "source": {
-        "path": "x-pack/plugins/rule_registry/server/plugin.ts",
-        "lineNumber": 15
-      },
-      "deprecated": false,
-      "lifecycle": "setup",
-      "initialIsOpen": true
-    }
-  },
-  "common": {
-    "classes": [],
-    "functions": [
-      {
-        "parentPluginId": "ruleRegistry",
-        "id": "def-common.mergeFieldMaps",
-        "type": "Function",
+        "id": "def-server.RuleExecutorData",
+        "type": "Interface",
         "tags": [],
-        "label": "mergeFieldMaps",
+        "label": "RuleExecutorData",
         "description": [],
-        "signature": [
-          "(first: T1, second: T2) => T1 & T2"
-        ],
         "source": {
-          "path": "x-pack/plugins/rule_registry/common/field_map/merge_field_maps.ts",
-          "lineNumber": 9
+          "path": "x-pack/plugins/rule_registry/server/utils/get_rule_executor_data.ts",
+          "lineNumber": 18
         },
         "deprecated": false,
         "children": [
           {
             "parentPluginId": "ruleRegistry",
-            "id": "def-common.mergeFieldMaps.$1",
-            "type": "Uncategorized",
+            "id": "def-server.RuleExecutorData.RULE_CATEGORY",
+            "type": "string",
             "tags": [],
-            "label": "first",
+            "label": "[RULE_CATEGORY]",
             "description": [],
-            "signature": [
-              "T1"
-            ],
             "source": {
-              "path": "x-pack/plugins/rule_registry/common/field_map/merge_field_maps.ts",
-              "lineNumber": 10
+              "path": "x-pack/plugins/rule_registry/server/utils/get_rule_executor_data.ts",
+              "lineNumber": 19
             },
-            "deprecated": false,
-            "isRequired": true
+            "deprecated": false
           },
           {
             "parentPluginId": "ruleRegistry",
-            "id": "def-common.mergeFieldMaps.$2",
-            "type": "Uncategorized",
+            "id": "def-server.RuleExecutorData.RULE_ID",
+            "type": "string",
             "tags": [],
-            "label": "second",
+            "label": "[RULE_ID]",
             "description": [],
-            "signature": [
-              "T2"
-            ],
             "source": {
-              "path": "x-pack/plugins/rule_registry/common/field_map/merge_field_maps.ts",
-              "lineNumber": 11
+              "path": "x-pack/plugins/rule_registry/server/utils/get_rule_executor_data.ts",
+              "lineNumber": 20
             },
-            "deprecated": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "ruleRegistry",
-        "id": "def-common.pickWithPatterns",
-        "type": "Function",
-        "tags": [],
-        "label": "pickWithPatterns",
-        "description": [],
-        "signature": [
-          "(map: T, patterns: TPatterns) => Pick<{ [TFieldName in keyof T]: ",
-          "SetIntersection",
-          "<",
-          "ValuesType",
-          "<TPatterns>, PatternMapOf<T>[TFieldName]> extends never ? never : T[TFieldName]; }, { [Key in keyof { [TFieldName in keyof T]: ",
-          "SetIntersection",
-          "<",
-          "ValuesType",
-          "<TPatterns>, PatternMapOf<T>[TFieldName]> extends never ? never : T[TFieldName]; }]-?: [{ [TFieldName in keyof T]: ",
-          "SetIntersection"
-        ],
-        "source": {
-          "path": "x-pack/plugins/rule_registry/common/pick_with_patterns/index.ts",
-          "lineNumber": 39
-        },
-        "deprecated": false,
-        "children": [
+            "deprecated": false
+          },
           {
             "parentPluginId": "ruleRegistry",
-            "id": "def-common.pickWithPatterns.$1",
-            "type": "Uncategorized",
+            "id": "def-server.RuleExecutorData.RULE_UUID",
+            "type": "string",
             "tags": [],
-            "label": "map",
+            "label": "[RULE_UUID]",
             "description": [],
-            "signature": [
-              "T"
-            ],
             "source": {
-              "path": "x-pack/plugins/rule_registry/common/pick_with_patterns/index.ts",
-              "lineNumber": 42
+              "path": "x-pack/plugins/rule_registry/server/utils/get_rule_executor_data.ts",
+              "lineNumber": 21
             },
-            "deprecated": false,
-            "isRequired": true
+            "deprecated": false
           },
           {
             "parentPluginId": "ruleRegistry",
-            "id": "def-common.pickWithPatterns.$2",
-            "type": "Uncategorized",
+            "id": "def-server.RuleExecutorData.RULE_NAME",
+            "type": "string",
             "tags": [],
-            "label": "patterns",
+            "label": "[RULE_NAME]",
             "description": [],
-            "signature": [
-              "TPatterns"
-            ],
             "source": {
-              "path": "x-pack/plugins/rule_registry/common/pick_with_patterns/index.ts",
-              "lineNumber": 42
+              "path": "x-pack/plugins/rule_registry/server/utils/get_rule_executor_data.ts",
+              "lineNumber": 22
             },
-            "deprecated": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "ruleRegistry",
-        "id": "def-common.runtimeTypeFromFieldMap",
-        "type": "Function",
-        "tags": [],
-        "label": "runtimeTypeFromFieldMap",
-        "description": [],
-        "signature": [
-          "(fieldMap: TFieldMap) => ",
-          {
-            "pluginId": "ruleRegistry",
-            "scope": "common",
-            "docId": "kibRuleRegistryPluginApi",
-            "section": "def-common.FieldMapType",
-            "text": "FieldMapType"
+            "deprecated": false
           },
-          "<TFieldMap>"
-        ],
-        "source": {
-          "path": "x-pack/plugins/rule_registry/common/field_map/runtime_type_from_fieldmap.ts",
-          "lineNumber": 85
-        },
-        "deprecated": false,
-        "children": [
           {
             "parentPluginId": "ruleRegistry",
-            "id": "def-common.runtimeTypeFromFieldMap.$1",
-            "type": "Uncategorized",
+            "id": "def-server.RuleExecutorData.PRODUCER",
+            "type": "string",
             "tags": [],
-            "label": "fieldMap",
+            "label": "[PRODUCER]",
             "description": [],
-            "signature": [
-              "TFieldMap"
-            ],
             "source": {
-              "path": "x-pack/plugins/rule_registry/common/field_map/runtime_type_from_fieldmap.ts",
-              "lineNumber": 86
+              "path": "x-pack/plugins/rule_registry/server/utils/get_rule_executor_data.ts",
+              "lineNumber": 23
             },
-            "deprecated": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      }
-    ],
-    "interfaces": [
-      {
-        "parentPluginId": "ruleRegistry",
-        "id": "def-common.FieldMap",
-        "type": "Interface",
-        "tags": [],
-        "label": "FieldMap",
-        "description": [],
-        "source": {
-          "path": "x-pack/plugins/rule_registry/common/field_map/types.ts",
-          "lineNumber": 8
-        },
-        "deprecated": false,
-        "children": [
+            "deprecated": false
+          },
           {
             "parentPluginId": "ruleRegistry",
-            "id": "def-common.FieldMap.Unnamed",
-            "type": "Any",
+            "id": "def-server.RuleExecutorData.TAGS",
+            "type": "Array",
             "tags": [],
-            "label": "Unnamed",
+            "label": "[TAGS]",
             "description": [],
             "signature": [
-              "any"
+              "string[]"
             ],
             "source": {
-              "path": "x-pack/plugins/rule_registry/common/field_map/types.ts",
-              "lineNumber": 9
+              "path": "x-pack/plugins/rule_registry/server/utils/get_rule_executor_data.ts",
+              "lineNumber": 24
             },
             "deprecated": false
           }
@@ -913,161 +713,106 @@
     "misc": [
       {
         "parentPluginId": "ruleRegistry",
-        "id": "def-common.BaseRuleFieldMap",
-        "type": "Type",
-        "tags": [],
-        "label": "BaseRuleFieldMap",
-        "description": [],
-        "signature": [
-          "{ readonly 'kibana.rac.producer': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.uuid': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.id': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.start': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.end': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.duration.us': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.severity.level': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.severity.value': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.status': { readonly type: \"keyword\"; }; readonly '@timestamp': { readonly type: \"date\"; readonly array: false; readonly required: true; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'event.kind': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.action': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.uuid': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.category': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; }"
-        ],
-        "source": {
-          "path": "x-pack/plugins/rule_registry/common/field_map/base_rule_field_map.ts",
-          "lineNumber": 33
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "ruleRegistry",
-        "id": "def-common.EcsFieldMap",
-        "type": "Type",
-        "tags": [],
-        "label": "EcsFieldMap",
-        "description": [],
-        "signature": [
-          "{ readonly '@timestamp': { readonly type: \"date\"; readonly array: false; readonly required: true; }; readonly 'agent.build.original': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'agent.ephemeral_id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'agent.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'agent.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'agent.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'agent.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.address': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.as.number': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'client.as.organization.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.bytes': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'client.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.geo.city_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.geo.continent_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.geo.country_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.geo.country_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.geo.location': { readonly type: \"geo_point\"; readonly array: false; readonly required: false; }; readonly 'client.geo.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.geo.region_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.geo.region_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.ip': { readonly type: \"ip\"; readonly array: false; readonly required: false; }; readonly 'client.mac': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.nat.ip': { readonly type: \"ip\"; readonly array: false; readonly required: false; }; readonly 'client.nat.port': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'client.packets': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'client.port': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'client.registered_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.subdomain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.top_level_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.user.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.user.email': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.user.full_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.user.group.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.user.group.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.user.group.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.user.hash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.user.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.user.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.user.roles': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'cloud.account.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'cloud.account.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'cloud.availability_zone': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'cloud.instance.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'cloud.instance.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'cloud.machine.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'cloud.project.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'cloud.project.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'cloud.provider': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'cloud.region': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'container.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'container.image.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'container.image.tag': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'container.labels': { readonly type: \"object\"; readonly array: false; readonly required: false; }; readonly 'container.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'container.runtime': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.address': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.as.number': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'destination.as.organization.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.bytes': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'destination.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.geo.city_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.geo.continent_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.geo.country_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.geo.country_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.geo.location': { readonly type: \"geo_point\"; readonly array: false; readonly required: false; }; readonly 'destination.geo.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.geo.region_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.geo.region_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.ip': { readonly type: \"ip\"; readonly array: false; readonly required: false; }; readonly 'destination.mac': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.nat.ip': { readonly type: \"ip\"; readonly array: false; readonly required: false; }; readonly 'destination.nat.port': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'destination.packets': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'destination.port': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'destination.registered_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.subdomain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.top_level_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.user.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.user.email': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.user.full_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.user.group.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.user.group.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.user.group.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.user.hash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.user.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.user.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.user.roles': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'dll.code_signature.exists': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'dll.code_signature.status': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.code_signature.subject_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.code_signature.trusted': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'dll.code_signature.valid': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'dll.hash.md5': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.hash.sha1': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.hash.sha256': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.hash.sha512': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.path': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.pe.architecture': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.pe.company': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.pe.description': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.pe.file_version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.pe.imphash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.pe.original_file_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.pe.product': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.answers': { readonly type: \"object\"; readonly array: true; readonly required: false; }; readonly 'dns.answers.class': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.answers.data': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.answers.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.answers.ttl': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'dns.answers.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.header_flags': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'dns.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.op_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.question.class': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.question.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.question.registered_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.question.subdomain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.question.top_level_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.question.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.resolved_ip': { readonly type: \"ip\"; readonly array: true; readonly required: false; }; readonly 'dns.response_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'ecs.version': { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly 'error.code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'error.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'error.message': { readonly type: \"text\"; readonly array: false; readonly required: false; }; readonly 'error.stack_trace': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'error.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.action': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.category': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'event.code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.created': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'event.dataset': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.duration': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'event.end': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'event.hash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.ingested': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'event.kind': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.module': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.original': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.outcome': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.provider': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.reason': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.reference': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.risk_score': { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly 'event.risk_score_norm': { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly 'event.sequence': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'event.severity': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'event.start': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'event.timezone': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.type': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'event.url': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.accessed': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'file.attributes': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.code_signature.exists': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'file.code_signature.status': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.code_signature.subject_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.code_signature.trusted': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'file.code_signature.valid': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'file.created': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'file.ctime': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'file.device': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.directory': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.drive_letter': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.extension': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.gid': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.group': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.hash.md5': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.hash.sha1': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.hash.sha256': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.hash.sha512': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.inode': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.mime_type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.mode': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.mtime': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'file.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.owner': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.path': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.pe.architecture': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.pe.company': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.pe.description': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.pe.file_version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.pe.imphash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.pe.original_file_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.pe.product': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.size': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'file.target_path': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.uid': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.x509.alternative_names': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.issuer.common_name': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.issuer.country': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.issuer.distinguished_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.x509.issuer.locality': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.issuer.organization': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.issuer.organizational_unit': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.issuer.state_or_province': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.not_after': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'file.x509.not_before': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'file.x509.public_key_algorithm': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.x509.public_key_curve': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.x509.public_key_exponent': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'file.x509.public_key_size': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'file.x509.serial_number': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.x509.signature_algorithm': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.x509.subject.common_name': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.subject.country': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.subject.distinguished_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.x509.subject.locality': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.subject.organization': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.subject.organizational_unit': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.subject.state_or_province': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.version_number': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'group.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'group.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'group.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.architecture': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.geo.city_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.geo.continent_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.geo.country_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.geo.country_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.geo.location': { readonly type: \"geo_point\"; readonly array: false; readonly required: false; }; readonly 'host.geo.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.geo.region_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.geo.region_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.hostname': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.ip': { readonly type: \"ip\"; readonly array: true; readonly required: false; }; readonly 'host.mac': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'host.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.os.family': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.os.full': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.os.kernel': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.os.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.os.platform': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.os.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.os.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.uptime': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'host.user.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.user.email': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.user.full_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.user.group.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.user.group.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.user.group.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.user.hash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.user.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.user.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.user.roles': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'http.request.body.bytes': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'http.request.body.content': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'http.request.bytes': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'http.request.method': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'http.request.mime_type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'http.request.referrer': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'http.response.body.bytes': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'http.response.body.content': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'http.response.bytes': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'http.response.mime_type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'http.response.status_code': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'http.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly labels: { readonly type: \"object\"; readonly array: false; readonly required: false; }; readonly 'log.file.path': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'log.level': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'log.logger': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'log.origin.file.line': { readonly type: \"integer\"; readonly array: false; readonly required: false; }; readonly 'log.origin.file.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'log.origin.function': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'log.original': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'log.syslog': { readonly type: \"object\"; readonly array: false; readonly required: false; }; readonly 'log.syslog.facility.code': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'log.syslog.facility.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'log.syslog.priority': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'log.syslog.severity.code': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'log.syslog.severity.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly message: { readonly type: \"text\"; readonly array: false; readonly required: false; }; readonly 'network.application': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.bytes': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'network.community_id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.direction': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.forwarded_ip': { readonly type: \"ip\"; readonly array: false; readonly required: false; }; readonly 'network.iana_number': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.inner': { readonly type: \"object\"; readonly array: false; readonly required: false; }; readonly 'network.inner.vlan.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.inner.vlan.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.packets': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'network.protocol': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.transport': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.vlan.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.vlan.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.egress': { readonly type: \"object\"; readonly array: false; readonly required: false; }; readonly 'observer.egress.interface.alias': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.egress.interface.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.egress.interface.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.egress.vlan.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.egress.vlan.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.egress.zone': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.geo.city_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.geo.continent_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.geo.country_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.geo.country_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.geo.location': { readonly type: \"geo_point\"; readonly array: false; readonly required: false; }; readonly 'observer.geo.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.geo.region_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.geo.region_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.hostname': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.ingress': { readonly type: \"object\"; readonly array: false; readonly required: false; }; readonly 'observer.ingress.interface.alias': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.ingress.interface.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.ingress.interface.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.ingress.vlan.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.ingress.vlan.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.ingress.zone': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.ip': { readonly type: \"ip\"; readonly array: true; readonly required: false; }; readonly 'observer.mac': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'observer.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.os.family': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.os.full': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.os.kernel': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.os.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.os.platform': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.os.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.os.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.product': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.serial_number': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.vendor': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'organization.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'organization.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.architecture': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.build_version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.checksum': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.description': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.install_scope': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.installed': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'package.license': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.path': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.reference': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.size': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'package.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.args': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'process.args_count': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.code_signature.exists': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'process.code_signature.status': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.code_signature.subject_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.code_signature.trusted': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'process.code_signature.valid': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'process.command_line': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.entity_id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.executable': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.exit_code': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.hash.md5': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.hash.sha1': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.hash.sha256': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.hash.sha512': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.args': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'process.parent.args_count': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.parent.code_signature.exists': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'process.parent.code_signature.status': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.code_signature.subject_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.code_signature.trusted': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'process.parent.code_signature.valid': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'process.parent.command_line': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.entity_id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.executable': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.exit_code': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.parent.hash.md5': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.hash.sha1': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.hash.sha256': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.hash.sha512': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.pe.architecture': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.pe.company': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.pe.description': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.pe.file_version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.pe.imphash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.pe.original_file_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.pe.product': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.pgid': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.parent.pid': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.parent.ppid': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.parent.start': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'process.parent.thread.id': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.parent.thread.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.title': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.uptime': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.parent.working_directory': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.pe.architecture': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.pe.company': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.pe.description': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.pe.file_version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.pe.imphash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.pe.original_file_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.pe.product': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.pgid': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.pid': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.ppid': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.start': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'process.thread.id': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.thread.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.title': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.uptime': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.working_directory': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'registry.data.bytes': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'registry.data.strings': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'registry.data.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'registry.hive': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'registry.key': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'registry.path': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'registry.value': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'related.hash': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'related.hosts': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'related.ip': { readonly type: \"ip\"; readonly array: true; readonly required: false; }; readonly 'related.user': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'rule.author': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'rule.category': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.description': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.license': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.reference': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.ruleset': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.uuid': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.address': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.as.number': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'server.as.organization.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.bytes': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'server.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.geo.city_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.geo.continent_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.geo.country_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.geo.country_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.geo.location': { readonly type: \"geo_point\"; readonly array: false; readonly required: false; }; readonly 'server.geo.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.geo.region_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.geo.region_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.ip': { readonly type: \"ip\"; readonly array: false; readonly required: false; }; readonly 'server.mac': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.nat.ip': { readonly type: \"ip\"; readonly array: false; readonly required: false; }; readonly 'server.nat.port': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'server.packets': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'server.port': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'server.registered_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.subdomain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.top_level_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.user.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.user.email': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.user.full_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.user.group.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.user.group.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.user.group.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.user.hash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.user.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.user.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.user.roles': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'service.ephemeral_id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'service.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'service.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'service.node.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'service.state': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'service.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'service.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.address': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.as.number': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'source.as.organization.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.bytes': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'source.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.geo.city_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.geo.continent_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.geo.country_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.geo.country_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.geo.location': { readonly type: \"geo_point\"; readonly array: false; readonly required: false; }; readonly 'source.geo.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.geo.region_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.geo.region_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.ip': { readonly type: \"ip\"; readonly array: false; readonly required: false; }; readonly 'source.mac': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.nat.ip': { readonly type: \"ip\"; readonly array: false; readonly required: false; }; readonly 'source.nat.port': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'source.packets': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'source.port': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'source.registered_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.subdomain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.top_level_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.user.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.user.email': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.user.full_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.user.group.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.user.group.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.user.group.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.user.hash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.user.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.user.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.user.roles': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'span.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'threat.framework': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'threat.tactic.id': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'threat.tactic.name': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'threat.tactic.reference': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'threat.technique.id': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'threat.technique.name': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'threat.technique.reference': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'threat.technique.subtechnique.id': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'threat.technique.subtechnique.name': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'threat.technique.subtechnique.reference': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.cipher': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.certificate': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.certificate_chain': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.hash.md5': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.hash.sha1': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.hash.sha256': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.issuer': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.ja3': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.not_after': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'tls.client.not_before': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'tls.client.server_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.subject': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.supported_ciphers': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.alternative_names': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.issuer.common_name': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.issuer.country': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.issuer.distinguished_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.x509.issuer.locality': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.issuer.organization': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.issuer.organizational_unit': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.issuer.state_or_province': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.not_after': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'tls.client.x509.not_before': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'tls.client.x509.public_key_algorithm': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.x509.public_key_curve': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.x509.public_key_exponent': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'tls.client.x509.public_key_size': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'tls.client.x509.serial_number': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.x509.signature_algorithm': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.x509.subject.common_name': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.subject.country': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.subject.distinguished_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.x509.subject.locality': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.subject.organization': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.subject.organizational_unit': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.subject.state_or_province': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.version_number': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.curve': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.established': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'tls.next_protocol': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.resumed': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'tls.server.certificate': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.certificate_chain': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.hash.md5': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.hash.sha1': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.hash.sha256': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.issuer': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.ja3s': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.not_after': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'tls.server.not_before': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'tls.server.subject': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.alternative_names': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.issuer.common_name': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.issuer.country': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.issuer.distinguished_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.issuer.locality': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.issuer.organization': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.issuer.organizational_unit': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.issuer.state_or_province': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.not_after': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.not_before': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.public_key_algorithm': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.public_key_curve': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.public_key_exponent': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.public_key_size': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.serial_number': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.signature_algorithm': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.subject.common_name': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.subject.country': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.subject.distinguished_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.subject.locality': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.subject.organization': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.subject.organizational_unit': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.subject.state_or_province': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.version_number': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.version_protocol': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'trace.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'transaction.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.extension': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.fragment': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.full': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.original': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.password': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.path': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.port': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'url.query': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.registered_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.scheme': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.subdomain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.top_level_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.username': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.changes.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.changes.email': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.changes.full_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.changes.group.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.changes.group.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.changes.group.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.changes.hash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.changes.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.changes.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.changes.roles': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'user.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.effective.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.effective.email': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.effective.full_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.effective.group.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.effective.group.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.effective.group.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.effective.hash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.effective.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.effective.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.effective.roles': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'user.email': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.full_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.group.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.group.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.group.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.hash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.roles': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'user.target.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.target.email': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.target.full_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.target.group.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.target.group.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.target.group.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.target.hash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.target.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.target.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.target.roles': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'user_agent.device.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user_agent.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user_agent.original': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user_agent.os.family': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user_agent.os.full': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user_agent.os.kernel': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user_agent.os.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user_agent.os.platform': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user_agent.os.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user_agent.os.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user_agent.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.category': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'vulnerability.classification': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.description': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.enumeration': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.reference': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.report_id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.scanner.vendor': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.score.base': { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.score.environmental': { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.score.temporal': { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.score.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.severity': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; }"
-        ],
-        "source": {
-          "path": "x-pack/plugins/rule_registry/common/field_map/ecs_field_map.ts",
-          "lineNumber": 3380
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "ruleRegistry",
-        "id": "def-common.FieldMapType",
+        "id": "def-server.RuleRegistryPluginConfig",
         "type": "Type",
         "tags": [],
-        "label": "FieldMapType",
+        "label": "RuleRegistryPluginConfig",
         "description": [],
         "signature": [
-          "t.Type<TypeOf<Optional<T, { [key in keyof T]: T[key][\"required\"] extends true ? never : key; }[keyof T]>>, OutputOf<Optional<T, { [key in keyof T]: T[key][\"required\"] extends true ? never : key; }[keyof T]>>, unknown>"
-        ],
-        "source": {
-          "path": "x-pack/plugins/rule_registry/common/field_map/runtime_type_from_fieldmap.ts",
-          "lineNumber": 83
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "ruleRegistry",
-        "id": "def-common.OutputOfFieldMap",
-        "type": "Type",
-        "tags": [],
-        "label": "OutputOfFieldMap",
-        "description": [],
-        "signature": [
-          "{ [key in keyof Optional<T, { [key in keyof T]: T[key][\"required\"] extends true ? never : key; }[keyof T]>]: OutputOfField<Exclude<Optional<T, { [key in keyof T]: T[key][\"required\"] extends true ? never : key; }[keyof T]>[key], undefined>>; }"
+          "{ readonly enabled: boolean; readonly unsafe: Readonly<{} & { write: Readonly<{} & { enabled: boolean; }>; }>; }"
         ],
         "source": {
-          "path": "x-pack/plugins/rule_registry/common/field_map/runtime_type_from_fieldmap.ts",
-          "lineNumber": 81
+          "path": "x-pack/plugins/rule_registry/server/index.ts",
+          "lineNumber": 28
         },
         "deprecated": false,
         "initialIsOpen": false
+      }
+    ],
+    "objects": [],
+    "setup": {
+      "parentPluginId": "ruleRegistry",
+      "id": "def-server.RuleRegistryPluginSetupContract",
+      "type": "Type",
+      "tags": [],
+      "label": "RuleRegistryPluginSetupContract",
+      "description": [],
+      "signature": [
+        "RuleDataPluginService"
+      ],
+      "source": {
+        "path": "x-pack/plugins/rule_registry/server/plugin.ts",
+        "lineNumber": 12
       },
-      {
-        "parentPluginId": "ruleRegistry",
-        "id": "def-common.PatternsUnionOf",
-        "type": "Type",
-        "tags": [],
-        "label": "PatternsUnionOf",
-        "description": [],
-        "signature": [
-          "\"*\" | ",
-          "ValuesType",
-          "<PatternMapOf<T>>"
-        ],
-        "source": {
-          "path": "x-pack/plugins/rule_registry/common/pick_with_patterns/index.ts",
-          "lineNumber": 37
-        },
-        "deprecated": false,
-        "initialIsOpen": false
+      "deprecated": false,
+      "lifecycle": "setup",
+      "initialIsOpen": true
+    },
+    "start": {
+      "parentPluginId": "ruleRegistry",
+      "id": "def-server.RuleRegistryPluginStartContract",
+      "type": "Type",
+      "tags": [],
+      "label": "RuleRegistryPluginStartContract",
+      "description": [],
+      "signature": [
+        "void"
+      ],
+      "source": {
+        "path": "x-pack/plugins/rule_registry/server/plugin.ts",
+        "lineNumber": 13
       },
+      "deprecated": false,
+      "lifecycle": "start",
+      "initialIsOpen": true
+    }
+  },
+  "common": {
+    "classes": [],
+    "functions": [
       {
         "parentPluginId": "ruleRegistry",
-        "id": "def-common.PickWithPatterns",
-        "type": "Type",
+        "id": "def-common.parseTechnicalFields",
+        "type": "Function",
         "tags": [],
-        "label": "PickWithPatterns",
+        "label": "parseTechnicalFields",
         "description": [],
         "signature": [
-          "{ [P in { [Key in keyof { [TFieldName in keyof T]: SetIntersection<ValuesType<TPatterns>, PatternMapOf<T>[TFieldName]> extends never ? never : T[TFieldName]; }]-?: [{ [TFieldName in keyof T]: SetIntersection<ValuesType<TPatterns>, PatternMapOf<T>[TFieldName]> extends never ? never : T[TFieldName]; }[Key]] extends [never] ? never : Key; }[keyof T]]: { [TFieldName in keyof T]: SetIntersection<ValuesType<TPatterns>, PatternMapOf<T>[TFieldName]> extends never ? never : T[TFieldName]; }[P]; }"
+          "(input: unknown) => OutputOf<",
+          "Optional",
+          "<{ readonly \"kibana.rac.alert.producer\": { readonly type: \"keyword\"; }; readonly \"kibana.rac.alert.uuid\": { readonly type: \"keyword\"; }; readonly \"kibana.rac.alert.id\": { readonly type: \"keyword\"; }; readonly \"kibana.rac.alert.start\": { readonly type: \"date\"; }; readonly \"kibana.rac.alert.end\": { readonly type: \"date\"; }; readonly \"kibana.rac.alert.duration.us\": { readonly type: \"long\"; }; readonly \"kibana.rac.alert.severity.level\": { readonly type: \"keyword\"; }; readonly \"kibana.rac.alert.severity.value\": { readonly type: \"long\"; }; readonly \"kibana.rac.alert.status\": { readonly type: \"keyword\"; }; readonly \"kibana.rac.alert.evaluation.threshold\": { readonly type: \"scaled_float\"; readonly scaling_factor: 100; }; readonly \"kibana.rac.alert.evaluation.value\": { readonly type: \"scaled_float\"; readonly scaling_factor: 100; }; readonly '@timestamp': { readonly type: \"date\"; readonly array: false; readonly required: true; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'event.kind': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.action': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.uuid': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.category': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; }, \"tags\" | \"kibana.rac.alert.uuid\" | \"event.kind\" | \"event.action\" | \"rule.uuid\" | \"rule.id\" | \"rule.name\" | \"rule.category\" | \"kibana.rac.alert.producer\" | \"kibana.rac.alert.id\" | \"kibana.rac.alert.start\" | \"kibana.rac.alert.end\" | \"kibana.rac.alert.duration.us\" | \"kibana.rac.alert.severity.level\" | \"kibana.rac.alert.severity.value\" | \"kibana.rac.alert.status\" | \"kibana.rac.alert.evaluation.threshold\" | \"kibana.rac.alert.evaluation.value\">>"
         ],
         "source": {
-          "path": "x-pack/plugins/rule_registry/common/pick_with_patterns/index.ts",
-          "lineNumber": 22
+          "path": "x-pack/plugins/rule_registry/common/parse_technical_fields.ts",
+          "lineNumber": 15
         },
         "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "ruleRegistry",
-        "id": "def-common.TypeOfFieldMap",
-        "type": "Type",
-        "tags": [],
-        "label": "TypeOfFieldMap",
-        "description": [],
-        "signature": [
-          "{ [key in keyof Optional<T, { [key in keyof T]: T[key][\"required\"] extends true ? never : key; }[keyof T]>]: TypeOfField<Exclude<Optional<T, { [key in keyof T]: T[key][\"required\"] extends true ? never : key; }[keyof T]>[key], undefined>>; }"
+        "children": [
+          {
+            "parentPluginId": "ruleRegistry",
+            "id": "def-common.parseTechnicalFields.$1",
+            "type": "Unknown",
+            "tags": [],
+            "label": "input",
+            "description": [],
+            "signature": [
+              "unknown"
+            ],
+            "source": {
+              "path": "x-pack/plugins/rule_registry/common/parse_technical_fields.ts",
+              "lineNumber": 15
+            },
+            "deprecated": false,
+            "isRequired": true
+          }
         ],
-        "source": {
-          "path": "x-pack/plugins/rule_registry/common/field_map/runtime_type_from_fieldmap.ts",
-          "lineNumber": 80
-        },
-        "deprecated": false,
+        "returnComment": [],
         "initialIsOpen": false
       }
     ],
-    "objects": [
-      {
-        "parentPluginId": "ruleRegistry",
-        "id": "def-common.baseRuleFieldMap",
-        "type": "Object",
-        "tags": [],
-        "label": "baseRuleFieldMap",
-        "description": [],
-        "signature": [
-          "{ readonly 'kibana.rac.producer': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.uuid': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.id': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.start': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.end': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.duration.us': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.severity.level': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.severity.value': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.status': { readonly type: \"keyword\"; }; readonly '@timestamp': { readonly type: \"date\"; readonly array: false; readonly required: true; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'event.kind': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.action': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.uuid': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.category': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; }"
-        ],
-        "source": {
-          "path": "x-pack/plugins/rule_registry/common/field_map/base_rule_field_map.ts",
-          "lineNumber": 10
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "ruleRegistry",
-        "id": "def-common.ecsFieldMap",
-        "type": "Object",
-        "tags": [],
-        "label": "ecsFieldMap",
-        "description": [],
-        "signature": [
-          "{ readonly '@timestamp': { readonly type: \"date\"; readonly array: false; readonly required: true; }; readonly 'agent.build.original': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'agent.ephemeral_id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'agent.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'agent.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'agent.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'agent.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.address': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.as.number': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'client.as.organization.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.bytes': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'client.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.geo.city_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.geo.continent_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.geo.country_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.geo.country_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.geo.location': { readonly type: \"geo_point\"; readonly array: false; readonly required: false; }; readonly 'client.geo.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.geo.region_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.geo.region_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.ip': { readonly type: \"ip\"; readonly array: false; readonly required: false; }; readonly 'client.mac': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.nat.ip': { readonly type: \"ip\"; readonly array: false; readonly required: false; }; readonly 'client.nat.port': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'client.packets': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'client.port': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'client.registered_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.subdomain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.top_level_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.user.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.user.email': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.user.full_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.user.group.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.user.group.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.user.group.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.user.hash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.user.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.user.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.user.roles': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'cloud.account.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'cloud.account.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'cloud.availability_zone': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'cloud.instance.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'cloud.instance.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'cloud.machine.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'cloud.project.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'cloud.project.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'cloud.provider': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'cloud.region': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'container.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'container.image.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'container.image.tag': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'container.labels': { readonly type: \"object\"; readonly array: false; readonly required: false; }; readonly 'container.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'container.runtime': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.address': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.as.number': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'destination.as.organization.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.bytes': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'destination.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.geo.city_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.geo.continent_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.geo.country_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.geo.country_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.geo.location': { readonly type: \"geo_point\"; readonly array: false; readonly required: false; }; readonly 'destination.geo.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.geo.region_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.geo.region_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.ip': { readonly type: \"ip\"; readonly array: false; readonly required: false; }; readonly 'destination.mac': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.nat.ip': { readonly type: \"ip\"; readonly array: false; readonly required: false; }; readonly 'destination.nat.port': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'destination.packets': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'destination.port': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'destination.registered_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.subdomain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.top_level_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.user.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.user.email': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.user.full_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.user.group.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.user.group.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.user.group.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.user.hash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.user.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.user.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.user.roles': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'dll.code_signature.exists': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'dll.code_signature.status': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.code_signature.subject_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.code_signature.trusted': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'dll.code_signature.valid': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'dll.hash.md5': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.hash.sha1': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.hash.sha256': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.hash.sha512': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.path': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.pe.architecture': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.pe.company': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.pe.description': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.pe.file_version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.pe.imphash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.pe.original_file_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.pe.product': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.answers': { readonly type: \"object\"; readonly array: true; readonly required: false; }; readonly 'dns.answers.class': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.answers.data': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.answers.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.answers.ttl': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'dns.answers.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.header_flags': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'dns.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.op_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.question.class': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.question.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.question.registered_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.question.subdomain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.question.top_level_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.question.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.resolved_ip': { readonly type: \"ip\"; readonly array: true; readonly required: false; }; readonly 'dns.response_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'ecs.version': { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly 'error.code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'error.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'error.message': { readonly type: \"text\"; readonly array: false; readonly required: false; }; readonly 'error.stack_trace': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'error.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.action': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.category': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'event.code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.created': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'event.dataset': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.duration': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'event.end': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'event.hash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.ingested': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'event.kind': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.module': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.original': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.outcome': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.provider': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.reason': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.reference': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.risk_score': { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly 'event.risk_score_norm': { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly 'event.sequence': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'event.severity': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'event.start': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'event.timezone': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.type': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'event.url': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.accessed': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'file.attributes': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.code_signature.exists': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'file.code_signature.status': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.code_signature.subject_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.code_signature.trusted': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'file.code_signature.valid': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'file.created': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'file.ctime': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'file.device': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.directory': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.drive_letter': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.extension': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.gid': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.group': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.hash.md5': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.hash.sha1': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.hash.sha256': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.hash.sha512': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.inode': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.mime_type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.mode': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.mtime': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'file.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.owner': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.path': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.pe.architecture': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.pe.company': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.pe.description': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.pe.file_version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.pe.imphash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.pe.original_file_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.pe.product': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.size': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'file.target_path': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.uid': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.x509.alternative_names': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.issuer.common_name': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.issuer.country': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.issuer.distinguished_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.x509.issuer.locality': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.issuer.organization': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.issuer.organizational_unit': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.issuer.state_or_province': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.not_after': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'file.x509.not_before': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'file.x509.public_key_algorithm': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.x509.public_key_curve': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.x509.public_key_exponent': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'file.x509.public_key_size': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'file.x509.serial_number': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.x509.signature_algorithm': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.x509.subject.common_name': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.subject.country': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.subject.distinguished_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.x509.subject.locality': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.subject.organization': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.subject.organizational_unit': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.subject.state_or_province': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.version_number': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'group.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'group.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'group.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.architecture': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.geo.city_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.geo.continent_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.geo.country_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.geo.country_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.geo.location': { readonly type: \"geo_point\"; readonly array: false; readonly required: false; }; readonly 'host.geo.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.geo.region_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.geo.region_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.hostname': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.ip': { readonly type: \"ip\"; readonly array: true; readonly required: false; }; readonly 'host.mac': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'host.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.os.family': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.os.full': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.os.kernel': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.os.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.os.platform': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.os.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.os.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.uptime': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'host.user.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.user.email': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.user.full_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.user.group.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.user.group.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.user.group.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.user.hash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.user.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.user.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.user.roles': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'http.request.body.bytes': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'http.request.body.content': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'http.request.bytes': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'http.request.method': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'http.request.mime_type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'http.request.referrer': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'http.response.body.bytes': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'http.response.body.content': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'http.response.bytes': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'http.response.mime_type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'http.response.status_code': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'http.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly labels: { readonly type: \"object\"; readonly array: false; readonly required: false; }; readonly 'log.file.path': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'log.level': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'log.logger': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'log.origin.file.line': { readonly type: \"integer\"; readonly array: false; readonly required: false; }; readonly 'log.origin.file.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'log.origin.function': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'log.original': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'log.syslog': { readonly type: \"object\"; readonly array: false; readonly required: false; }; readonly 'log.syslog.facility.code': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'log.syslog.facility.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'log.syslog.priority': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'log.syslog.severity.code': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'log.syslog.severity.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly message: { readonly type: \"text\"; readonly array: false; readonly required: false; }; readonly 'network.application': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.bytes': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'network.community_id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.direction': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.forwarded_ip': { readonly type: \"ip\"; readonly array: false; readonly required: false; }; readonly 'network.iana_number': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.inner': { readonly type: \"object\"; readonly array: false; readonly required: false; }; readonly 'network.inner.vlan.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.inner.vlan.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.packets': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'network.protocol': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.transport': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.vlan.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.vlan.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.egress': { readonly type: \"object\"; readonly array: false; readonly required: false; }; readonly 'observer.egress.interface.alias': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.egress.interface.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.egress.interface.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.egress.vlan.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.egress.vlan.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.egress.zone': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.geo.city_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.geo.continent_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.geo.country_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.geo.country_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.geo.location': { readonly type: \"geo_point\"; readonly array: false; readonly required: false; }; readonly 'observer.geo.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.geo.region_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.geo.region_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.hostname': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.ingress': { readonly type: \"object\"; readonly array: false; readonly required: false; }; readonly 'observer.ingress.interface.alias': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.ingress.interface.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.ingress.interface.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.ingress.vlan.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.ingress.vlan.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.ingress.zone': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.ip': { readonly type: \"ip\"; readonly array: true; readonly required: false; }; readonly 'observer.mac': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'observer.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.os.family': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.os.full': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.os.kernel': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.os.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.os.platform': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.os.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.os.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.product': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.serial_number': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.vendor': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'organization.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'organization.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.architecture': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.build_version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.checksum': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.description': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.install_scope': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.installed': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'package.license': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.path': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.reference': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.size': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'package.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.args': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'process.args_count': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.code_signature.exists': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'process.code_signature.status': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.code_signature.subject_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.code_signature.trusted': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'process.code_signature.valid': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'process.command_line': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.entity_id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.executable': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.exit_code': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.hash.md5': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.hash.sha1': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.hash.sha256': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.hash.sha512': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.args': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'process.parent.args_count': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.parent.code_signature.exists': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'process.parent.code_signature.status': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.code_signature.subject_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.code_signature.trusted': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'process.parent.code_signature.valid': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'process.parent.command_line': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.entity_id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.executable': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.exit_code': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.parent.hash.md5': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.hash.sha1': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.hash.sha256': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.hash.sha512': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.pe.architecture': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.pe.company': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.pe.description': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.pe.file_version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.pe.imphash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.pe.original_file_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.pe.product': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.pgid': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.parent.pid': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.parent.ppid': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.parent.start': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'process.parent.thread.id': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.parent.thread.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.title': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.uptime': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.parent.working_directory': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.pe.architecture': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.pe.company': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.pe.description': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.pe.file_version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.pe.imphash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.pe.original_file_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.pe.product': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.pgid': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.pid': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.ppid': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.start': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'process.thread.id': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.thread.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.title': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.uptime': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.working_directory': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'registry.data.bytes': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'registry.data.strings': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'registry.data.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'registry.hive': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'registry.key': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'registry.path': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'registry.value': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'related.hash': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'related.hosts': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'related.ip': { readonly type: \"ip\"; readonly array: true; readonly required: false; }; readonly 'related.user': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'rule.author': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'rule.category': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.description': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.license': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.reference': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.ruleset': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.uuid': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.address': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.as.number': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'server.as.organization.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.bytes': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'server.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.geo.city_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.geo.continent_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.geo.country_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.geo.country_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.geo.location': { readonly type: \"geo_point\"; readonly array: false; readonly required: false; }; readonly 'server.geo.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.geo.region_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.geo.region_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.ip': { readonly type: \"ip\"; readonly array: false; readonly required: false; }; readonly 'server.mac': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.nat.ip': { readonly type: \"ip\"; readonly array: false; readonly required: false; }; readonly 'server.nat.port': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'server.packets': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'server.port': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'server.registered_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.subdomain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.top_level_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.user.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.user.email': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.user.full_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.user.group.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.user.group.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.user.group.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.user.hash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.user.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.user.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.user.roles': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'service.ephemeral_id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'service.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'service.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'service.node.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'service.state': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'service.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'service.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.address': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.as.number': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'source.as.organization.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.bytes': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'source.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.geo.city_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.geo.continent_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.geo.country_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.geo.country_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.geo.location': { readonly type: \"geo_point\"; readonly array: false; readonly required: false; }; readonly 'source.geo.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.geo.region_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.geo.region_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.ip': { readonly type: \"ip\"; readonly array: false; readonly required: false; }; readonly 'source.mac': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.nat.ip': { readonly type: \"ip\"; readonly array: false; readonly required: false; }; readonly 'source.nat.port': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'source.packets': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'source.port': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'source.registered_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.subdomain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.top_level_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.user.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.user.email': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.user.full_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.user.group.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.user.group.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.user.group.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.user.hash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.user.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.user.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.user.roles': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'span.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'threat.framework': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'threat.tactic.id': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'threat.tactic.name': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'threat.tactic.reference': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'threat.technique.id': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'threat.technique.name': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'threat.technique.reference': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'threat.technique.subtechnique.id': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'threat.technique.subtechnique.name': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'threat.technique.subtechnique.reference': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.cipher': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.certificate': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.certificate_chain': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.hash.md5': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.hash.sha1': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.hash.sha256': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.issuer': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.ja3': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.not_after': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'tls.client.not_before': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'tls.client.server_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.subject': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.supported_ciphers': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.alternative_names': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.issuer.common_name': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.issuer.country': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.issuer.distinguished_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.x509.issuer.locality': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.issuer.organization': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.issuer.organizational_unit': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.issuer.state_or_province': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.not_after': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'tls.client.x509.not_before': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'tls.client.x509.public_key_algorithm': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.x509.public_key_curve': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.x509.public_key_exponent': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'tls.client.x509.public_key_size': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'tls.client.x509.serial_number': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.x509.signature_algorithm': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.x509.subject.common_name': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.subject.country': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.subject.distinguished_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.x509.subject.locality': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.subject.organization': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.subject.organizational_unit': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.subject.state_or_province': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.version_number': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.curve': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.established': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'tls.next_protocol': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.resumed': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'tls.server.certificate': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.certificate_chain': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.hash.md5': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.hash.sha1': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.hash.sha256': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.issuer': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.ja3s': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.not_after': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'tls.server.not_before': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'tls.server.subject': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.alternative_names': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.issuer.common_name': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.issuer.country': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.issuer.distinguished_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.issuer.locality': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.issuer.organization': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.issuer.organizational_unit': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.issuer.state_or_province': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.not_after': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.not_before': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.public_key_algorithm': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.public_key_curve': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.public_key_exponent': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.public_key_size': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.serial_number': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.signature_algorithm': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.subject.common_name': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.subject.country': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.subject.distinguished_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.subject.locality': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.subject.organization': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.subject.organizational_unit': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.subject.state_or_province': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.version_number': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.version_protocol': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'trace.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'transaction.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.extension': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.fragment': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.full': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.original': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.password': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.path': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.port': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'url.query': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.registered_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.scheme': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.subdomain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.top_level_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.username': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.changes.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.changes.email': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.changes.full_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.changes.group.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.changes.group.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.changes.group.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.changes.hash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.changes.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.changes.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.changes.roles': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'user.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.effective.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.effective.email': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.effective.full_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.effective.group.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.effective.group.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.effective.group.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.effective.hash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.effective.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.effective.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.effective.roles': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'user.email': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.full_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.group.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.group.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.group.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.hash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.roles': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'user.target.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.target.email': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.target.full_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.target.group.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.target.group.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.target.group.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.target.hash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.target.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.target.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.target.roles': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'user_agent.device.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user_agent.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user_agent.original': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user_agent.os.family': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user_agent.os.full': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user_agent.os.kernel': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user_agent.os.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user_agent.os.platform': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user_agent.os.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user_agent.os.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user_agent.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.category': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'vulnerability.classification': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.description': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.enumeration': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.reference': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.report_id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.scanner.vendor': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.score.base': { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.score.environmental': { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.score.temporal': { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.score.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.severity': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; }"
-        ],
-        "source": {
-          "path": "x-pack/plugins/rule_registry/common/field_map/ecs_field_map.ts",
-          "lineNumber": 12
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      }
-    ]
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
   }
 }
\ No newline at end of file
diff --git a/api_docs/rule_registry.mdx b/api_docs/rule_registry.mdx
index 450b2f3ee5d61..964d29594d3c6 100644
--- a/api_docs/rule_registry.mdx
+++ b/api_docs/rule_registry.mdx
@@ -11,25 +11,20 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 
 import ruleRegistryObj from './rule_registry.json';
 
-## Client
-
-### Classes
-<DocDefinitionList data={ruleRegistryObj.client.classes}/>
-
-### Interfaces
-<DocDefinitionList data={ruleRegistryObj.client.interfaces}/>
-
-### Consts, variables and types
-<DocDefinitionList data={ruleRegistryObj.client.misc}/>
-
 ## Server
 
 ### Setup
 <DocDefinitionList data={[ruleRegistryObj.server.setup]}/>
 
+### Start
+<DocDefinitionList data={[ruleRegistryObj.server.start]}/>
+
 ### Functions
 <DocDefinitionList data={ruleRegistryObj.server.functions}/>
 
+### Classes
+<DocDefinitionList data={ruleRegistryObj.server.classes}/>
+
 ### Interfaces
 <DocDefinitionList data={ruleRegistryObj.server.interfaces}/>
 
@@ -38,15 +33,6 @@ import ruleRegistryObj from './rule_registry.json';
 
 ## Common
 
-### Objects
-<DocDefinitionList data={ruleRegistryObj.common.objects}/>
-
 ### Functions
 <DocDefinitionList data={ruleRegistryObj.common.functions}/>
 
-### Interfaces
-<DocDefinitionList data={ruleRegistryObj.common.interfaces}/>
-
-### Consts, variables and types
-<DocDefinitionList data={ruleRegistryObj.common.misc}/>
-
diff --git a/api_docs/security.json b/api_docs/security.json
index 5a89d1ee0ee40..a8fae398cbf22 100644
--- a/api_docs/security.json
+++ b/api_docs/security.json
@@ -1236,13 +1236,6 @@
                   "lineNumber": 105
                 }
               },
-              {
-                "plugin": "securitySolution",
-                "link": {
-                  "path": "x-pack/plugins/security_solution/server/lib/timeline/utils/common.ts",
-                  "lineNumber": 28
-                }
-              },
               {
                 "plugin": "securitySolution",
                 "link": {
@@ -1298,6 +1291,13 @@
                   "path": "x-pack/plugins/logstash/server/routes/pipeline/save.ts",
                   "lineNumber": 41
                 }
+              },
+              {
+                "plugin": "securitySolution",
+                "link": {
+                  "path": "x-pack/plugins/security_solution/server/lib/timeline/utils/common.ts",
+                  "lineNumber": 28
+                }
               }
             ]
           },
diff --git a/api_docs/security_solution.json b/api_docs/security_solution.json
index c2fdbb0317a3a..3ea7554e374a6 100644
--- a/api_docs/security_solution.json
+++ b/api_docs/security_solution.json
@@ -437,7 +437,7 @@
         ],
         "source": {
           "path": "x-pack/plugins/security_solution/server/plugin.ts",
-          "lineNumber": 130
+          "lineNumber": 139
         },
         "deprecated": false,
         "children": [
@@ -453,7 +453,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/security_solution/server/plugin.ts",
-              "lineNumber": 146
+              "lineNumber": 155
             },
             "deprecated": false,
             "children": [
@@ -476,7 +476,7 @@
                 ],
                 "source": {
                   "path": "x-pack/plugins/security_solution/server/plugin.ts",
-                  "lineNumber": 146
+                  "lineNumber": 155
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -516,7 +516,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/security_solution/server/plugin.ts",
-              "lineNumber": 158
+              "lineNumber": 167
             },
             "deprecated": false,
             "children": [
@@ -549,7 +549,7 @@
                 ],
                 "source": {
                   "path": "x-pack/plugins/security_solution/server/plugin.ts",
-                  "lineNumber": 158
+                  "lineNumber": 167
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -566,7 +566,7 @@
                 ],
                 "source": {
                   "path": "x-pack/plugins/security_solution/server/plugin.ts",
-                  "lineNumber": 158
+                  "lineNumber": 167
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -596,7 +596,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/security_solution/server/plugin.ts",
-              "lineNumber": 341
+              "lineNumber": 384
             },
             "deprecated": false,
             "children": [
@@ -618,7 +618,7 @@
                 ],
                 "source": {
                   "path": "x-pack/plugins/security_solution/server/plugin.ts",
-                  "lineNumber": 341
+                  "lineNumber": 384
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -635,7 +635,7 @@
                 ],
                 "source": {
                   "path": "x-pack/plugins/security_solution/server/plugin.ts",
-                  "lineNumber": 341
+                  "lineNumber": 384
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -655,7 +655,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/security_solution/server/plugin.ts",
-              "lineNumber": 415
+              "lineNumber": 458
             },
             "deprecated": false,
             "children": [],
@@ -748,7 +748,7 @@
         ],
         "source": {
           "path": "x-pack/plugins/security_solution/server/lib/detection_engine/routes/utils.ts",
-          "lineNumber": 291
+          "lineNumber": 295
         },
         "deprecated": false,
         "children": [
@@ -785,7 +785,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/security_solution/server/lib/detection_engine/routes/utils.ts",
-              "lineNumber": 291
+              "lineNumber": 295
             },
             "deprecated": false,
             "isRequired": true
@@ -1529,7 +1529,7 @@
         ],
         "source": {
           "path": "x-pack/plugins/security_solution/server/lib/detection_engine/routes/utils.ts",
-          "lineNumber": 29
+          "lineNumber": 28
         },
         "deprecated": false,
         "children": [
@@ -1547,7 +1547,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/security_solution/server/lib/detection_engine/routes/utils.ts",
-              "lineNumber": 29
+              "lineNumber": 28
             },
             "deprecated": false,
             "isRequired": true
@@ -1628,7 +1628,7 @@
       "description": [],
       "source": {
         "path": "x-pack/plugins/security_solution/server/plugin.ts",
-        "lineNumber": 106
+        "lineNumber": 115
       },
       "deprecated": false,
       "children": [],
@@ -1644,7 +1644,7 @@
       "description": [],
       "source": {
         "path": "x-pack/plugins/security_solution/server/plugin.ts",
-        "lineNumber": 109
+        "lineNumber": 118
       },
       "deprecated": false,
       "children": [],
@@ -1719,29 +1719,7 @@
           "lineNumber": 17
         },
         "deprecated": true,
-        "references": [
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/shared_imports.ts",
-              "lineNumber": 10
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.ts",
-              "lineNumber": 13
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.ts",
-              "lineNumber": 487
-            }
-          }
-        ],
+        "references": [],
         "children": [
           {
             "parentPluginId": "securitySolution",
@@ -1791,11312 +1769,193 @@
           "lineNumber": 30
         },
         "deprecated": true,
-        "references": [
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/shared_imports.ts",
-              "lineNumber": 17
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 105
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 114
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 127
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 140
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 151
-            }
-          },
+        "references": [],
+        "children": [
           {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 163
-            }
+            "parentPluginId": "securitySolution",
+            "id": "def-common.exactCheck.$1",
+            "type": "Unknown",
+            "tags": [],
+            "label": "original",
+            "description": [],
+            "signature": [
+              "unknown"
+            ],
+            "source": {
+              "path": "x-pack/plugins/security_solution/common/exact_check.ts",
+              "lineNumber": 31
+            },
+            "deprecated": false,
+            "isRequired": true
           },
           {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 172
-            }
-          },
+            "parentPluginId": "securitySolution",
+            "id": "def-common.exactCheck.$2",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "decoded",
+            "description": [],
+            "signature": [
+              "Either",
+              "<",
+              "Errors",
+              ", T>"
+            ],
+            "source": {
+              "path": "x-pack/plugins/security_solution/common/exact_check.ts",
+              "lineNumber": 32
+            },
+            "deprecated": false,
+            "isRequired": true
+          }
+        ],
+        "returnComment": [],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "securitySolution",
+        "id": "def-common.foldLeftRight",
+        "type": "Function",
+        "tags": [
+          "deprecated"
+        ],
+        "label": "foldLeftRight",
+        "description": [],
+        "signature": [
+          "<T>(ma: ",
+          "Either",
+          "<",
+          "Errors",
+          ", unknown>) => Message<unknown>"
+        ],
+        "source": {
+          "path": "x-pack/plugins/security_solution/common/test_utils.ts",
+          "lineNumber": 38
+        },
+        "deprecated": true,
+        "references": [],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "securitySolution",
+        "id": "def-common.formatErrors",
+        "type": "Function",
+        "tags": [
+          "deprecated"
+        ],
+        "label": "formatErrors",
+        "description": [],
+        "signature": [
+          "(errors: ",
+          "Errors",
+          ") => string[]"
+        ],
+        "source": {
+          "path": "x-pack/plugins/security_solution/common/format_errors.ts",
+          "lineNumber": 14
+        },
+        "deprecated": true,
+        "references": [
           {
             "plugin": "lists",
             "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 184
+              "path": "x-pack/plugins/lists/server/siem_server_deps.ts",
+              "lineNumber": 24
             }
-          },
+          }
+        ],
+        "children": [
           {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 193
-            }
-          },
+            "parentPluginId": "securitySolution",
+            "id": "def-common.formatErrors.$1",
+            "type": "Object",
+            "tags": [],
+            "label": "errors",
+            "description": [],
+            "signature": [
+              "Errors"
+            ],
+            "source": {
+              "path": "x-pack/plugins/security_solution/common/format_errors.ts",
+              "lineNumber": 14
+            },
+            "deprecated": false,
+            "isRequired": true
+          }
+        ],
+        "returnComment": [],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "securitySolution",
+        "id": "def-common.getPaths",
+        "type": "Function",
+        "tags": [
+          "deprecated"
+        ],
+        "label": "getPaths",
+        "description": [
+          "\nConvenience utility to keep the error message handling within tests to be\nvery concise."
+        ],
+        "signature": [
+          "<A>(validation: ",
+          "Either",
+          "<",
+          "Errors",
+          ", A>) => string[]"
+        ],
+        "source": {
+          "path": "x-pack/plugins/security_solution/common/test_utils.ts",
+          "lineNumber": 46
+        },
+        "deprecated": true,
+        "references": [],
+        "children": [
           {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 205
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 214
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 226
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 235
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 244
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 256
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 265
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 277
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 288
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 301
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 312
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 321
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 333
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 344
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 356
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 367
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 379
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 390
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 399
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 410
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_item_schema.test.ts",
-              "lineNumber": 20
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_item_schema.test.ts",
-              "lineNumber": 32
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_schema.test.ts",
-              "lineNumber": 20
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_schema.test.ts",
-              "lineNumber": 32
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 26
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 38
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 51
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 64
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 78
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 90
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 102
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 115
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 128
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 143
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 156
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 171
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 182
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 194
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 205
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 26
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 38
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 51
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 64
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 77
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 91
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 104
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 117
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 132
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 145
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 160
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 173
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 184
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 196
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 208
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.test.ts",
-              "lineNumber": 23
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.test.ts",
-              "lineNumber": 34
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.test.ts",
-              "lineNumber": 47
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.test.ts",
-              "lineNumber": 58
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.test.ts",
-              "lineNumber": 70
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.test.ts",
-              "lineNumber": 82
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_list_item_schema.test.ts",
-              "lineNumber": 20
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_list_item_schema.test.ts",
-              "lineNumber": 31
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_list_item_schema.test.ts",
-              "lineNumber": 42
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_list_item_schema.test.ts",
-              "lineNumber": 53
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts",
-              "lineNumber": 20
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts",
-              "lineNumber": 31
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts",
-              "lineNumber": 41
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts",
-              "lineNumber": 51
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts",
-              "lineNumber": 61
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts",
-              "lineNumber": 71
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_endpoint_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_endpoint_list_item_schema.test.ts",
-              "lineNumber": 23
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_endpoint_list_item_schema.test.ts",
-              "lineNumber": 37
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_endpoint_list_item_schema.test.ts",
-              "lineNumber": 48
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_exception_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_exception_list_item_schema.test.ts",
-              "lineNumber": 23
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_exception_list_item_schema.test.ts",
-              "lineNumber": 34
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_exception_list_item_schema.test.ts",
-              "lineNumber": 46
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_exception_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_exception_list_schema.test.ts",
-              "lineNumber": 23
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_exception_list_schema.test.ts",
-              "lineNumber": 34
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_exception_list_schema.test.ts",
-              "lineNumber": 46
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_list_item_schema.test.ts",
-              "lineNumber": 20
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_list_item_schema.test.ts",
-              "lineNumber": 32
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_list_schema.test.ts",
-              "lineNumber": 20
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_list_schema.test.ts",
-              "lineNumber": 32
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_list_schema.test.ts",
-              "lineNumber": 42
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/export_exception_list_query_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/export_exception_list_query_schema.test.ts",
-              "lineNumber": 23
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/export_exception_list_query_schema.test.ts",
-              "lineNumber": 35
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/export_exception_list_query_schema.test.ts",
-              "lineNumber": 46
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/export_exception_list_query_schema.test.ts",
-              "lineNumber": 61
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/export_exception_list_query_schema.test.ts",
-              "lineNumber": 76
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/export_list_item_query_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/export_list_item_query_schema.test.ts",
-              "lineNumber": 23
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/export_list_item_query_schema.test.ts",
-              "lineNumber": 35
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/export_list_item_query_schema.test.ts",
-              "lineNumber": 49
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts",
-              "lineNumber": 26
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts",
-              "lineNumber": 35
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts",
-              "lineNumber": 45
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts",
-              "lineNumber": 57
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts",
-              "lineNumber": 69
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts",
-              "lineNumber": 81
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts",
-              "lineNumber": 93
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts",
-              "lineNumber": 106
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts",
-              "lineNumber": 30
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts",
-              "lineNumber": 39
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts",
-              "lineNumber": 48
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts",
-              "lineNumber": 67
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts",
-              "lineNumber": 79
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts",
-              "lineNumber": 91
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts",
-              "lineNumber": 105
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts",
-              "lineNumber": 117
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts",
-              "lineNumber": 130
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts",
-              "lineNumber": 27
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts",
-              "lineNumber": 36
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts",
-              "lineNumber": 54
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts",
-              "lineNumber": 66
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts",
-              "lineNumber": 78
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts",
-              "lineNumber": 90
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts",
-              "lineNumber": 102
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts",
-              "lineNumber": 115
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts",
-              "lineNumber": 28
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts",
-              "lineNumber": 37
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts",
-              "lineNumber": 56
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts",
-              "lineNumber": 68
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts",
-              "lineNumber": 80
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts",
-              "lineNumber": 92
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts",
-              "lineNumber": 105
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts",
-              "lineNumber": 20
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts",
-              "lineNumber": 29
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts",
-              "lineNumber": 39
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts",
-              "lineNumber": 51
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts",
-              "lineNumber": 63
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts",
-              "lineNumber": 75
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts",
-              "lineNumber": 87
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts",
-              "lineNumber": 100
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts",
-              "lineNumber": 23
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts",
-              "lineNumber": 34
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts",
-              "lineNumber": 44
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts",
-              "lineNumber": 55
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts",
-              "lineNumber": 65
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts",
-              "lineNumber": 75
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts",
-              "lineNumber": 87
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/import_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/import_list_item_schema.test.ts",
-              "lineNumber": 20
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/import_list_item_schema.test.ts",
-              "lineNumber": 32
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/import_list_item_schema.test.ts",
-              "lineNumber": 46
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts",
-              "lineNumber": 20
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts",
-              "lineNumber": 32
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts",
-              "lineNumber": 43
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts",
-              "lineNumber": 54
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts",
-              "lineNumber": 66
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts",
-              "lineNumber": 77
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts",
-              "lineNumber": 20
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts",
-              "lineNumber": 32
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts",
-              "lineNumber": 43
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts",
-              "lineNumber": 54
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts",
-              "lineNumber": 65
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts",
-              "lineNumber": 78
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts",
-              "lineNumber": 90
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts",
-              "lineNumber": 102
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts",
-              "lineNumber": 114
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts",
-              "lineNumber": 125
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts",
-              "lineNumber": 23
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts",
-              "lineNumber": 34
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts",
-              "lineNumber": 45
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts",
-              "lineNumber": 59
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts",
-              "lineNumber": 71
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts",
-              "lineNumber": 84
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts",
-              "lineNumber": 23
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts",
-              "lineNumber": 34
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts",
-              "lineNumber": 45
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts",
-              "lineNumber": 56
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts",
-              "lineNumber": 72
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts",
-              "lineNumber": 84
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts",
-              "lineNumber": 98
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts",
-              "lineNumber": 112
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts",
-              "lineNumber": 125
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts",
-              "lineNumber": 20
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts",
-              "lineNumber": 31
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts",
-              "lineNumber": 42
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts",
-              "lineNumber": 53
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts",
-              "lineNumber": 69
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts",
-              "lineNumber": 81
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts",
-              "lineNumber": 95
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts",
-              "lineNumber": 109
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts",
-              "lineNumber": 122
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts",
-              "lineNumber": 20
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts",
-              "lineNumber": 31
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts",
-              "lineNumber": 42
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts",
-              "lineNumber": 53
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts",
-              "lineNumber": 66
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts",
-              "lineNumber": 78
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts",
-              "lineNumber": 90
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts",
-              "lineNumber": 102
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts",
-              "lineNumber": 113
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_schema.test.ts",
-              "lineNumber": 20
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_schema.test.ts",
-              "lineNumber": 32
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_schema.test.ts",
-              "lineNumber": 43
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts",
-              "lineNumber": 23
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts",
-              "lineNumber": 34
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts",
-              "lineNumber": 47
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts",
-              "lineNumber": 60
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts",
-              "lineNumber": 74
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts",
-              "lineNumber": 85
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts",
-              "lineNumber": 98
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts",
-              "lineNumber": 111
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts",
-              "lineNumber": 125
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts",
-              "lineNumber": 137
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts",
-              "lineNumber": 23
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts",
-              "lineNumber": 34
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts",
-              "lineNumber": 47
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts",
-              "lineNumber": 60
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts",
-              "lineNumber": 74
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts",
-              "lineNumber": 85
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts",
-              "lineNumber": 98
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts",
-              "lineNumber": 111
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts",
-              "lineNumber": 125
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts",
-              "lineNumber": 137
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts",
-              "lineNumber": 147
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts",
-              "lineNumber": 159
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts",
-              "lineNumber": 23
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts",
-              "lineNumber": 34
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts",
-              "lineNumber": 47
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts",
-              "lineNumber": 60
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts",
-              "lineNumber": 73
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts",
-              "lineNumber": 86
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts",
-              "lineNumber": 98
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts",
-              "lineNumber": 108
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts",
-              "lineNumber": 120
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_list_item_schema.test.ts",
-              "lineNumber": 20
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_list_item_schema.test.ts",
-              "lineNumber": 31
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_list_item_schema.test.ts",
-              "lineNumber": 44
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_list_schema.test.ts",
-              "lineNumber": 20
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_list_schema.test.ts",
-              "lineNumber": 31
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_list_schema.test.ts",
-              "lineNumber": 44
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/acknowledge_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/acknowledge_schema.test.ts",
-              "lineNumber": 20
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/acknowledge_schema.test.ts",
-              "lineNumber": 31
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/acknowledge_schema.test.ts",
-              "lineNumber": 44
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts",
-              "lineNumber": 20
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts",
-              "lineNumber": 30
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts",
-              "lineNumber": 42
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts",
-              "lineNumber": 56
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts",
-              "lineNumber": 69
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 20
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 32
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 44
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 58
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 72
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 86
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 100
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 114
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 126
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 139
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 151
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 165
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 179
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 193
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 207
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 221
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 236
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 20
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 32
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 44
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 58
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 72
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 84
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 97
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 109
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 123
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 137
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 151
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 165
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 179
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 194
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts",
-              "lineNumber": 25
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts",
-              "lineNumber": 44
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts",
-              "lineNumber": 58
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts",
-              "lineNumber": 70
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts",
-              "lineNumber": 82
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts",
-              "lineNumber": 94
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts",
-              "lineNumber": 108
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts",
-              "lineNumber": 122
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts",
-              "lineNumber": 136
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts",
-              "lineNumber": 151
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts",
-              "lineNumber": 22
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts",
-              "lineNumber": 41
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts",
-              "lineNumber": 55
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts",
-              "lineNumber": 67
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts",
-              "lineNumber": 79
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts",
-              "lineNumber": 91
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts",
-              "lineNumber": 105
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts",
-              "lineNumber": 119
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts",
-              "lineNumber": 133
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts",
-              "lineNumber": 148
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_index_exist_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_index_exist_schema.test.ts",
-              "lineNumber": 20
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_index_exist_schema.test.ts",
-              "lineNumber": 32
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_index_exist_schema.test.ts",
-              "lineNumber": 46
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_index_exist_schema.test.ts",
-              "lineNumber": 61
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 20
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 32
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 44
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 57
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 68
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 79
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 91
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 105
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 119
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 133
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 147
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 161
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 175
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 188
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 20
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 32
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 43
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 54
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 65
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 77
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 91
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 105
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 119
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 133
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 147
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 161
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 175
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 188
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/search_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/search_list_item_schema.test.ts",
-              "lineNumber": 20
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/search_list_item_schema.test.ts",
-              "lineNumber": 31
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/search_list_item_schema.test.ts",
-              "lineNumber": 44
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/server/services/utils/encode_decode_cursor.ts",
-              "lineNumber": 13
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/server/services/utils/encode_decode_cursor.ts",
-              "lineNumber": 77
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/server/routes/validate.ts",
-              "lineNumber": 17
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/server/routes/validate.ts",
-              "lineNumber": 70
-            }
-          }
-        ],
-        "children": [
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-common.exactCheck.$1",
-            "type": "Unknown",
-            "tags": [],
-            "label": "original",
-            "description": [],
-            "signature": [
-              "unknown"
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/common/exact_check.ts",
-              "lineNumber": 31
-            },
-            "deprecated": false,
-            "isRequired": true
-          },
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-common.exactCheck.$2",
-            "type": "CompoundType",
-            "tags": [],
-            "label": "decoded",
-            "description": [],
-            "signature": [
-              "Either",
-              "<",
-              "Errors",
-              ", T>"
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/common/exact_check.ts",
-              "lineNumber": 32
-            },
-            "deprecated": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "securitySolution",
-        "id": "def-common.foldLeftRight",
-        "type": "Function",
-        "tags": [
-          "deprecated"
-        ],
-        "label": "foldLeftRight",
-        "description": [],
-        "signature": [
-          "<T>(ma: ",
-          "Either",
-          "<",
-          "Errors",
-          ", unknown>) => Message<unknown>"
-        ],
-        "source": {
-          "path": "x-pack/plugins/security_solution/common/test_utils.ts",
-          "lineNumber": 38
-        },
-        "deprecated": true,
-        "references": [
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/shared_imports.ts",
-              "lineNumber": 19
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 41
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 50
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 73
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 82
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 106
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 115
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 128
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 141
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 152
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 164
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 173
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 185
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 194
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 206
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 215
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 227
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 236
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 245
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 257
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 266
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 278
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 289
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 302
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 313
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 322
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 334
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 345
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 357
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 368
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 380
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 391
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 400
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 411
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_item_schema.test.ts",
-              "lineNumber": 21
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_item_schema.test.ts",
-              "lineNumber": 33
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_schema.test.ts",
-              "lineNumber": 21
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_schema.test.ts",
-              "lineNumber": 33
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 27
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 39
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 52
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 65
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 79
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 91
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 103
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 116
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 129
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 144
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 157
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 172
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 183
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 195
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 206
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 27
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 39
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 52
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 65
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 78
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 92
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 105
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 118
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 133
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 146
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 161
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 174
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 185
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 197
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 209
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.test.ts",
-              "lineNumber": 24
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.test.ts",
-              "lineNumber": 35
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.test.ts",
-              "lineNumber": 48
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.test.ts",
-              "lineNumber": 59
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.test.ts",
-              "lineNumber": 71
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.test.ts",
-              "lineNumber": 83
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_list_item_schema.test.ts",
-              "lineNumber": 21
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_list_item_schema.test.ts",
-              "lineNumber": 32
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_list_item_schema.test.ts",
-              "lineNumber": 43
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_list_item_schema.test.ts",
-              "lineNumber": 54
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts",
-              "lineNumber": 21
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts",
-              "lineNumber": 32
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts",
-              "lineNumber": 42
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts",
-              "lineNumber": 52
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts",
-              "lineNumber": 62
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts",
-              "lineNumber": 72
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_endpoint_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_endpoint_list_item_schema.test.ts",
-              "lineNumber": 24
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_endpoint_list_item_schema.test.ts",
-              "lineNumber": 38
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_endpoint_list_item_schema.test.ts",
-              "lineNumber": 49
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_exception_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_exception_list_item_schema.test.ts",
-              "lineNumber": 24
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_exception_list_item_schema.test.ts",
-              "lineNumber": 35
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_exception_list_item_schema.test.ts",
-              "lineNumber": 47
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_exception_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_exception_list_schema.test.ts",
-              "lineNumber": 24
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_exception_list_schema.test.ts",
-              "lineNumber": 35
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_exception_list_schema.test.ts",
-              "lineNumber": 47
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_list_item_schema.test.ts",
-              "lineNumber": 21
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_list_item_schema.test.ts",
-              "lineNumber": 33
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_list_schema.test.ts",
-              "lineNumber": 21
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_list_schema.test.ts",
-              "lineNumber": 33
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_list_schema.test.ts",
-              "lineNumber": 43
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/export_exception_list_query_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/export_exception_list_query_schema.test.ts",
-              "lineNumber": 24
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/export_exception_list_query_schema.test.ts",
-              "lineNumber": 36
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/export_exception_list_query_schema.test.ts",
-              "lineNumber": 47
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/export_exception_list_query_schema.test.ts",
-              "lineNumber": 62
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/export_exception_list_query_schema.test.ts",
-              "lineNumber": 77
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/export_list_item_query_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/export_list_item_query_schema.test.ts",
-              "lineNumber": 24
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/export_list_item_query_schema.test.ts",
-              "lineNumber": 36
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/export_list_item_query_schema.test.ts",
-              "lineNumber": 50
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts",
-              "lineNumber": 27
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts",
-              "lineNumber": 36
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts",
-              "lineNumber": 46
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts",
-              "lineNumber": 58
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts",
-              "lineNumber": 70
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts",
-              "lineNumber": 82
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts",
-              "lineNumber": 94
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts",
-              "lineNumber": 107
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts",
-              "lineNumber": 31
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts",
-              "lineNumber": 40
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts",
-              "lineNumber": 49
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts",
-              "lineNumber": 68
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts",
-              "lineNumber": 80
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts",
-              "lineNumber": 92
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts",
-              "lineNumber": 106
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts",
-              "lineNumber": 118
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts",
-              "lineNumber": 131
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts",
-              "lineNumber": 28
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts",
-              "lineNumber": 37
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts",
-              "lineNumber": 55
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts",
-              "lineNumber": 67
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts",
-              "lineNumber": 79
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts",
-              "lineNumber": 91
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts",
-              "lineNumber": 103
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts",
-              "lineNumber": 116
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts",
-              "lineNumber": 29
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts",
-              "lineNumber": 38
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts",
-              "lineNumber": 57
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts",
-              "lineNumber": 69
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts",
-              "lineNumber": 81
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts",
-              "lineNumber": 93
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts",
-              "lineNumber": 106
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts",
-              "lineNumber": 21
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts",
-              "lineNumber": 30
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts",
-              "lineNumber": 40
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts",
-              "lineNumber": 52
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts",
-              "lineNumber": 64
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts",
-              "lineNumber": 76
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts",
-              "lineNumber": 88
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts",
-              "lineNumber": 101
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts",
-              "lineNumber": 24
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts",
-              "lineNumber": 35
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts",
-              "lineNumber": 45
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts",
-              "lineNumber": 56
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts",
-              "lineNumber": 66
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts",
-              "lineNumber": 76
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts",
-              "lineNumber": 88
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/import_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/import_list_item_schema.test.ts",
-              "lineNumber": 21
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/import_list_item_schema.test.ts",
-              "lineNumber": 33
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/import_list_item_schema.test.ts",
-              "lineNumber": 47
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts",
-              "lineNumber": 21
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts",
-              "lineNumber": 33
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts",
-              "lineNumber": 44
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts",
-              "lineNumber": 55
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts",
-              "lineNumber": 67
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts",
-              "lineNumber": 78
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts",
-              "lineNumber": 21
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts",
-              "lineNumber": 33
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts",
-              "lineNumber": 44
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts",
-              "lineNumber": 55
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts",
-              "lineNumber": 66
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts",
-              "lineNumber": 79
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts",
-              "lineNumber": 91
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts",
-              "lineNumber": 103
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts",
-              "lineNumber": 115
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts",
-              "lineNumber": 126
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts",
-              "lineNumber": 24
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts",
-              "lineNumber": 35
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts",
-              "lineNumber": 46
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts",
-              "lineNumber": 60
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts",
-              "lineNumber": 72
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts",
-              "lineNumber": 85
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts",
-              "lineNumber": 24
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts",
-              "lineNumber": 35
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts",
-              "lineNumber": 46
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts",
-              "lineNumber": 57
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts",
-              "lineNumber": 73
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts",
-              "lineNumber": 85
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts",
-              "lineNumber": 99
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts",
-              "lineNumber": 113
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts",
-              "lineNumber": 126
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts",
-              "lineNumber": 21
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts",
-              "lineNumber": 32
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts",
-              "lineNumber": 43
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts",
-              "lineNumber": 54
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts",
-              "lineNumber": 70
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts",
-              "lineNumber": 82
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts",
-              "lineNumber": 96
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts",
-              "lineNumber": 110
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts",
-              "lineNumber": 123
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts",
-              "lineNumber": 21
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts",
-              "lineNumber": 32
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts",
-              "lineNumber": 43
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts",
-              "lineNumber": 54
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts",
-              "lineNumber": 67
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts",
-              "lineNumber": 79
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts",
-              "lineNumber": 91
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts",
-              "lineNumber": 103
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts",
-              "lineNumber": 114
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_schema.test.ts",
-              "lineNumber": 21
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_schema.test.ts",
-              "lineNumber": 33
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_schema.test.ts",
-              "lineNumber": 44
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts",
-              "lineNumber": 24
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts",
-              "lineNumber": 35
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts",
-              "lineNumber": 48
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts",
-              "lineNumber": 61
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts",
-              "lineNumber": 75
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts",
-              "lineNumber": 86
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts",
-              "lineNumber": 99
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts",
-              "lineNumber": 112
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts",
-              "lineNumber": 126
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts",
-              "lineNumber": 138
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts",
-              "lineNumber": 24
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts",
-              "lineNumber": 35
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts",
-              "lineNumber": 48
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts",
-              "lineNumber": 61
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts",
-              "lineNumber": 75
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts",
-              "lineNumber": 86
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts",
-              "lineNumber": 99
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts",
-              "lineNumber": 112
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts",
-              "lineNumber": 126
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts",
-              "lineNumber": 138
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts",
-              "lineNumber": 148
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts",
-              "lineNumber": 160
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts",
-              "lineNumber": 24
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts",
-              "lineNumber": 35
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts",
-              "lineNumber": 48
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts",
-              "lineNumber": 61
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts",
-              "lineNumber": 74
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts",
-              "lineNumber": 87
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts",
-              "lineNumber": 99
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts",
-              "lineNumber": 109
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts",
-              "lineNumber": 121
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_list_item_schema.test.ts",
-              "lineNumber": 21
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_list_item_schema.test.ts",
-              "lineNumber": 32
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_list_item_schema.test.ts",
-              "lineNumber": 45
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_list_schema.test.ts",
-              "lineNumber": 21
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_list_schema.test.ts",
-              "lineNumber": 32
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_list_schema.test.ts",
-              "lineNumber": 45
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/acknowledge_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/acknowledge_schema.test.ts",
-              "lineNumber": 21
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/acknowledge_schema.test.ts",
-              "lineNumber": 32
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/acknowledge_schema.test.ts",
-              "lineNumber": 45
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts",
-              "lineNumber": 21
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts",
-              "lineNumber": 31
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts",
-              "lineNumber": 43
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts",
-              "lineNumber": 57
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts",
-              "lineNumber": 70
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 21
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 33
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 45
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 59
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 73
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 87
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 101
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 115
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 127
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 140
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 152
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 166
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 180
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 194
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 208
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 222
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 237
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 21
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 33
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 45
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 59
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 73
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 85
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 98
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 110
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 124
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 138
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 152
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 166
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 180
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 195
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts",
-              "lineNumber": 26
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts",
-              "lineNumber": 45
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts",
-              "lineNumber": 59
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts",
-              "lineNumber": 71
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts",
-              "lineNumber": 83
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts",
-              "lineNumber": 95
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts",
-              "lineNumber": 109
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts",
-              "lineNumber": 123
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts",
-              "lineNumber": 137
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts",
-              "lineNumber": 152
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts",
-              "lineNumber": 23
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts",
-              "lineNumber": 42
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts",
-              "lineNumber": 56
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts",
-              "lineNumber": 68
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts",
-              "lineNumber": 80
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts",
-              "lineNumber": 92
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts",
-              "lineNumber": 106
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts",
-              "lineNumber": 120
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts",
-              "lineNumber": 134
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts",
-              "lineNumber": 149
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_index_exist_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_index_exist_schema.test.ts",
-              "lineNumber": 21
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_index_exist_schema.test.ts",
-              "lineNumber": 33
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_index_exist_schema.test.ts",
-              "lineNumber": 47
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_index_exist_schema.test.ts",
-              "lineNumber": 62
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 21
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 33
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 45
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 58
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 69
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 80
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 92
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 106
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 120
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 134
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 148
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 162
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 176
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 189
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 21
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 33
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 44
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 55
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 66
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 78
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 92
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 106
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 120
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 134
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 148
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 162
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 176
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 189
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/search_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/search_list_item_schema.test.ts",
-              "lineNumber": 21
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/search_list_item_schema.test.ts",
-              "lineNumber": 32
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/search_list_item_schema.test.ts",
-              "lineNumber": 45
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/comment.test.ts",
-              "lineNumber": 12
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/comment.test.ts",
-              "lineNumber": 29
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/comment.test.ts",
-              "lineNumber": 40
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/comment.test.ts",
-              "lineNumber": 51
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/comment.test.ts",
-              "lineNumber": 60
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/comment.test.ts",
-              "lineNumber": 74
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/comment.test.ts",
-              "lineNumber": 86
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/comment.test.ts",
-              "lineNumber": 100
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/comment.test.ts",
-              "lineNumber": 114
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/comment.test.ts",
-              "lineNumber": 128
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/comment.test.ts",
-              "lineNumber": 142
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/comment.test.ts",
-              "lineNumber": 156
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/comment.test.ts",
-              "lineNumber": 167
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/comment.test.ts",
-              "lineNumber": 179
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/comment.test.ts",
-              "lineNumber": 188
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/comment.test.ts",
-              "lineNumber": 199
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/comment.test.ts",
-              "lineNumber": 212
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/comment.test.ts",
-              "lineNumber": 221
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/comment.test.ts",
-              "lineNumber": 230
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/create_comment.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/create_comment.test.ts",
-              "lineNumber": 28
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/create_comment.test.ts",
-              "lineNumber": 37
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/create_comment.test.ts",
-              "lineNumber": 51
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/create_comment.test.ts",
-              "lineNumber": 65
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/create_comment.test.ts",
-              "lineNumber": 76
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/create_comment.test.ts",
-              "lineNumber": 85
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/create_comment.test.ts",
-              "lineNumber": 96
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/create_comment.test.ts",
-              "lineNumber": 109
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/create_comment.test.ts",
-              "lineNumber": 118
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/create_comment.test.ts",
-              "lineNumber": 127
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_comments_array.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_comments_array.test.ts",
-              "lineNumber": 21
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_comments_array.test.ts",
-              "lineNumber": 30
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_comments_array.test.ts",
-              "lineNumber": 39
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_comments_array.test.ts",
-              "lineNumber": 50
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_comments_array.test.ts",
-              "lineNumber": 61
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_create_comments_array.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_create_comments_array.test.ts",
-              "lineNumber": 22
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_create_comments_array.test.ts",
-              "lineNumber": 31
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_create_comments_array.test.ts",
-              "lineNumber": 40
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_create_comments_array.test.ts",
-              "lineNumber": 53
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_create_comments_array.test.ts",
-              "lineNumber": 65
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_create_comments_array.test.ts",
-              "lineNumber": 76
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_namespace.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_namespace.test.ts",
-              "lineNumber": 19
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_namespace.test.ts",
-              "lineNumber": 28
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_namespace.test.ts",
-              "lineNumber": 37
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_namespace.test.ts",
-              "lineNumber": 46
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_namespace.test.ts",
-              "lineNumber": 55
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_namespace_array.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_namespace_array.test.ts",
-              "lineNumber": 19
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_namespace_array.test.ts",
-              "lineNumber": 28
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_namespace_array.test.ts",
-              "lineNumber": 39
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_namespace_array.test.ts",
-              "lineNumber": 48
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_namespace_array.test.ts",
-              "lineNumber": 57
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_namespace_array.test.ts",
-              "lineNumber": 66
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_namespace_array.test.ts",
-              "lineNumber": 75
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_namespace_array.test.ts",
-              "lineNumber": 84
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_namespace_array.test.ts",
-              "lineNumber": 93
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_update_comments_array.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_update_comments_array.test.ts",
-              "lineNumber": 21
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_update_comments_array.test.ts",
-              "lineNumber": 30
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_update_comments_array.test.ts",
-              "lineNumber": 39
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_update_comments_array.test.ts",
-              "lineNumber": 50
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_update_comments_array.test.ts",
-              "lineNumber": 61
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/empty_string_array.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/empty_string_array.test.ts",
-              "lineNumber": 19
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/empty_string_array.test.ts",
-              "lineNumber": 28
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/empty_string_array.test.ts",
-              "lineNumber": 37
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/empty_string_array.test.ts",
-              "lineNumber": 46
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/empty_string_array.test.ts",
-              "lineNumber": 55
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/empty_string_array.test.ts",
-              "lineNumber": 64
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/empty_string_array.test.ts",
-              "lineNumber": 75
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entries.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entries.test.ts",
-              "lineNumber": 26
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entries.test.ts",
-              "lineNumber": 35
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entries.test.ts",
-              "lineNumber": 44
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entries.test.ts",
-              "lineNumber": 53
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entries.test.ts",
-              "lineNumber": 62
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entries.test.ts",
-              "lineNumber": 78
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entries.test.ts",
-              "lineNumber": 87
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entries.test.ts",
-              "lineNumber": 96
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entries.test.ts",
-              "lineNumber": 105
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entries.test.ts",
-              "lineNumber": 114
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entries.test.ts",
-              "lineNumber": 123
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entries.test.ts",
-              "lineNumber": 134
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entries.test.ts",
-              "lineNumber": 143
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_exists.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_exists.test.ts",
-              "lineNumber": 20
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_exists.test.ts",
-              "lineNumber": 29
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_exists.test.ts",
-              "lineNumber": 39
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_exists.test.ts",
-              "lineNumber": 51
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_exists.test.ts",
-              "lineNumber": 63
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_exists.test.ts",
-              "lineNumber": 75
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_list.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_list.test.ts",
-              "lineNumber": 20
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_list.test.ts",
-              "lineNumber": 29
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_list.test.ts",
-              "lineNumber": 39
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_list.test.ts",
-              "lineNumber": 51
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_list.test.ts",
-              "lineNumber": 65
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_list.test.ts",
-              "lineNumber": 77
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_list.test.ts",
-              "lineNumber": 91
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match.test.ts",
-              "lineNumber": 20
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match.test.ts",
-              "lineNumber": 29
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match.test.ts",
-              "lineNumber": 39
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match.test.ts",
-              "lineNumber": 51
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match.test.ts",
-              "lineNumber": 63
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match.test.ts",
-              "lineNumber": 77
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match.test.ts",
-              "lineNumber": 89
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match.test.ts",
-              "lineNumber": 103
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match_any.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match_any.test.ts",
-              "lineNumber": 20
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match_any.test.ts",
-              "lineNumber": 29
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match_any.test.ts",
-              "lineNumber": 39
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match_any.test.ts",
-              "lineNumber": 51
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match_any.test.ts",
-              "lineNumber": 63
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match_any.test.ts",
-              "lineNumber": 75
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match_any.test.ts",
-              "lineNumber": 89
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match_any.test.ts",
-              "lineNumber": 101
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.test.ts",
-              "lineNumber": 20
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.test.ts",
-              "lineNumber": 29
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.test.ts",
-              "lineNumber": 39
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.test.ts",
-              "lineNumber": 51
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.test.ts",
-              "lineNumber": 63
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.test.ts",
-              "lineNumber": 77
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.test.ts",
-              "lineNumber": 89
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.test.ts",
-              "lineNumber": 101
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_nested.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_nested.test.ts",
-              "lineNumber": 22
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_nested.test.ts",
-              "lineNumber": 34
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_nested.test.ts",
-              "lineNumber": 45
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_nested.test.ts",
-              "lineNumber": 56
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_nested.test.ts",
-              "lineNumber": 67
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_nested.test.ts",
-              "lineNumber": 78
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_nested.test.ts",
-              "lineNumber": 98
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_nested.test.ts",
-              "lineNumber": 120
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts",
-              "lineNumber": 29
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts",
-              "lineNumber": 40
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts",
-              "lineNumber": 51
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts",
-              "lineNumber": 62
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts",
-              "lineNumber": 71
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts",
-              "lineNumber": 80
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts",
-              "lineNumber": 89
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts",
-              "lineNumber": 98
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts",
-              "lineNumber": 107
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts",
-              "lineNumber": 116
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts",
-              "lineNumber": 125
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts",
-              "lineNumber": 24
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts",
-              "lineNumber": 35
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts",
-              "lineNumber": 46
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts",
-              "lineNumber": 57
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts",
-              "lineNumber": 66
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts",
-              "lineNumber": 75
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts",
-              "lineNumber": 84
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts",
-              "lineNumber": 101
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts",
-              "lineNumber": 110
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_or_nullable_string_array.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_or_nullable_string_array.test.ts",
-              "lineNumber": 19
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_or_nullable_string_array.test.ts",
-              "lineNumber": 30
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_or_nullable_string_array.test.ts",
-              "lineNumber": 41
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_or_nullable_string_array.test.ts",
-              "lineNumber": 52
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_or_nullable_string_array.test.ts",
-              "lineNumber": 63
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_string_array.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_string_array.test.ts",
-              "lineNumber": 19
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_string_array.test.ts",
-              "lineNumber": 30
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_string_array.test.ts",
-              "lineNumber": 41
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_string_array.test.ts",
-              "lineNumber": 52
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_string_array.test.ts",
-              "lineNumber": 61
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_string_array.test.ts",
-              "lineNumber": 70
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_string_array.test.ts",
-              "lineNumber": 79
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_string_array.test.ts",
-              "lineNumber": 90
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/update_comment.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/update_comment.test.ts",
-              "lineNumber": 28
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/update_comment.test.ts",
-              "lineNumber": 39
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/update_comment.test.ts",
-              "lineNumber": 50
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/update_comment.test.ts",
-              "lineNumber": 60
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/update_comment.test.ts",
-              "lineNumber": 69
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/update_comment.test.ts",
-              "lineNumber": 80
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/update_comment.test.ts",
-              "lineNumber": 91
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/update_comment.test.ts",
-              "lineNumber": 100
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/update_comment.test.ts",
-              "lineNumber": 111
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/update_comment.test.ts",
-              "lineNumber": 124
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/update_comment.test.ts",
-              "lineNumber": 133
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/update_comment.test.ts",
-              "lineNumber": 142
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entries.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entries.test.ts",
-              "lineNumber": 30
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entries.test.ts",
-              "lineNumber": 39
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entries.test.ts",
-              "lineNumber": 48
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entries.test.ts",
-              "lineNumber": 71
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entries.test.ts",
-              "lineNumber": 84
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entries.test.ts",
-              "lineNumber": 97
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entries.test.ts",
-              "lineNumber": 106
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_match.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_match.test.ts",
-              "lineNumber": 21
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_match.test.ts",
-              "lineNumber": 32
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_match.test.ts",
-              "lineNumber": 46
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_match.test.ts",
-              "lineNumber": 58
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_match.test.ts",
-              "lineNumber": 72
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_match.test.ts",
-              "lineNumber": 84
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_match.test.ts",
-              "lineNumber": 98
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_any.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_any.test.ts",
-              "lineNumber": 21
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_any.test.ts",
-              "lineNumber": 32
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_any.test.ts",
-              "lineNumber": 46
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_any.test.ts",
-              "lineNumber": 58
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_any.test.ts",
-              "lineNumber": 70
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_any.test.ts",
-              "lineNumber": 84
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_any.test.ts",
-              "lineNumber": 96
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_nested.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_nested.test.ts",
-              "lineNumber": 27
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_nested.test.ts",
-              "lineNumber": 39
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_nested.test.ts",
-              "lineNumber": 50
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_nested.test.ts",
-              "lineNumber": 61
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_nested.test.ts",
-              "lineNumber": 72
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_nested.test.ts",
-              "lineNumber": 83
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_nested.test.ts",
-              "lineNumber": 103
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_nested.test.ts",
-              "lineNumber": 118
-            }
-          }
-        ],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "securitySolution",
-        "id": "def-common.formatErrors",
-        "type": "Function",
-        "tags": [
-          "deprecated"
-        ],
-        "label": "formatErrors",
-        "description": [],
-        "signature": [
-          "(errors: ",
-          "Errors",
-          ") => string[]"
-        ],
-        "source": {
-          "path": "x-pack/plugins/security_solution/common/format_errors.ts",
-          "lineNumber": 14
-        },
-        "deprecated": true,
-        "references": [
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/shared_imports.ts",
-              "lineNumber": 22
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/server/siem_server_deps.ts",
-              "lineNumber": 24
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/server/routes/validate.ts",
-              "lineNumber": 18
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/server/routes/validate.ts",
-              "lineNumber": 74
-            }
-          }
-        ],
-        "children": [
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-common.formatErrors.$1",
-            "type": "Object",
-            "tags": [],
-            "label": "errors",
-            "description": [],
-            "signature": [
-              "Errors"
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/common/format_errors.ts",
-              "lineNumber": 14
-            },
-            "deprecated": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "securitySolution",
-        "id": "def-common.getPaths",
-        "type": "Function",
-        "tags": [
-          "deprecated"
-        ],
-        "label": "getPaths",
-        "description": [
-          "\nConvenience utility to keep the error message handling within tests to be\nvery concise."
-        ],
-        "signature": [
-          "<A>(validation: ",
-          "Either",
-          "<",
-          "Errors",
-          ", A>) => string[]"
-        ],
-        "source": {
-          "path": "x-pack/plugins/security_solution/common/test_utils.ts",
-          "lineNumber": 46
-        },
-        "deprecated": true,
-        "references": [
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/shared_imports.ts",
-              "lineNumber": 18
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 43
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 52
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 75
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 84
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 107
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 116
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 129
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 142
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 153
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 165
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 174
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 186
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 195
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 207
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 216
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 228
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 237
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 246
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 258
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 267
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 279
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 290
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 303
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 314
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 323
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 335
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 346
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 358
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 369
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 381
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 392
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 401
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.test.ts",
-              "lineNumber": 412
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_item_schema.test.ts",
-              "lineNumber": 22
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_item_schema.test.ts",
-              "lineNumber": 34
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_schema.test.ts",
-              "lineNumber": 22
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_schema.test.ts",
-              "lineNumber": 34
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 29
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 40
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 53
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 66
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 80
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 92
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 105
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 118
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 131
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 145
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 159
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 174
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 184
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts",
-              "lineNumber": 207
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 29
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 40
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 53
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 66
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 79
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 94
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 107
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 120
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 134
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 148
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 163
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 176
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 186
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts",
-              "lineNumber": 210
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.test.ts",
-              "lineNumber": 26
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.test.ts",
-              "lineNumber": 37
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.test.ts",
-              "lineNumber": 50
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.test.ts",
-              "lineNumber": 60
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.test.ts",
-              "lineNumber": 84
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_list_item_schema.test.ts",
-              "lineNumber": 23
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_list_item_schema.test.ts",
-              "lineNumber": 34
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_list_item_schema.test.ts",
-              "lineNumber": 45
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_list_item_schema.test.ts",
-              "lineNumber": 55
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts",
-              "lineNumber": 23
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts",
-              "lineNumber": 33
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts",
-              "lineNumber": 43
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts",
-              "lineNumber": 53
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts",
-              "lineNumber": 63
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_list_schema.test.ts",
-              "lineNumber": 73
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_endpoint_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_endpoint_list_item_schema.test.ts",
-              "lineNumber": 26
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_endpoint_list_item_schema.test.ts",
-              "lineNumber": 39
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_endpoint_list_item_schema.test.ts",
-              "lineNumber": 50
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_exception_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_exception_list_item_schema.test.ts",
-              "lineNumber": 26
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_exception_list_item_schema.test.ts",
-              "lineNumber": 36
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_exception_list_item_schema.test.ts",
-              "lineNumber": 48
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_exception_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_exception_list_schema.test.ts",
-              "lineNumber": 26
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_exception_list_schema.test.ts",
-              "lineNumber": 36
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_exception_list_schema.test.ts",
-              "lineNumber": 48
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_list_item_schema.test.ts",
-              "lineNumber": 23
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_list_item_schema.test.ts",
-              "lineNumber": 34
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_list_schema.test.ts",
-              "lineNumber": 23
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_list_schema.test.ts",
-              "lineNumber": 34
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/delete_list_schema.test.ts",
-              "lineNumber": 44
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/export_exception_list_query_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/export_exception_list_query_schema.test.ts",
-              "lineNumber": 26
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/export_exception_list_query_schema.test.ts",
-              "lineNumber": 38
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/export_exception_list_query_schema.test.ts",
-              "lineNumber": 64
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/export_exception_list_query_schema.test.ts",
-              "lineNumber": 78
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/export_list_item_query_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/export_list_item_query_schema.test.ts",
-              "lineNumber": 26
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/export_list_item_query_schema.test.ts",
-              "lineNumber": 37
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/export_list_item_query_schema.test.ts",
-              "lineNumber": 51
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts",
-              "lineNumber": 28
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts",
-              "lineNumber": 37
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts",
-              "lineNumber": 47
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts",
-              "lineNumber": 59
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts",
-              "lineNumber": 71
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts",
-              "lineNumber": 83
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts",
-              "lineNumber": 95
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_endpoint_list_item_schema.test.ts",
-              "lineNumber": 108
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts",
-              "lineNumber": 32
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts",
-              "lineNumber": 41
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts",
-              "lineNumber": 50
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts",
-              "lineNumber": 69
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts",
-              "lineNumber": 81
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts",
-              "lineNumber": 93
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts",
-              "lineNumber": 107
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts",
-              "lineNumber": 119
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_item_schema.test.ts",
-              "lineNumber": 132
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts",
-              "lineNumber": 29
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts",
-              "lineNumber": 38
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts",
-              "lineNumber": 56
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts",
-              "lineNumber": 68
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts",
-              "lineNumber": 80
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts",
-              "lineNumber": 92
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts",
-              "lineNumber": 104
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_exception_list_schema.test.ts",
-              "lineNumber": 117
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts",
-              "lineNumber": 30
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts",
-              "lineNumber": 39
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts",
-              "lineNumber": 58
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts",
-              "lineNumber": 70
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts",
-              "lineNumber": 82
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts",
-              "lineNumber": 94
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_item_schema.test.ts",
-              "lineNumber": 107
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts",
-              "lineNumber": 22
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts",
-              "lineNumber": 31
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts",
-              "lineNumber": 41
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts",
-              "lineNumber": 53
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts",
-              "lineNumber": 65
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts",
-              "lineNumber": 77
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts",
-              "lineNumber": 89
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/find_list_schema.test.ts",
-              "lineNumber": 102
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts",
-              "lineNumber": 26
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts",
-              "lineNumber": 36
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts",
-              "lineNumber": 46
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts",
-              "lineNumber": 57
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts",
-              "lineNumber": 67
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts",
-              "lineNumber": 77
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/import_list_item_query_schema.test.ts",
-              "lineNumber": 89
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/import_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/import_list_item_schema.test.ts",
-              "lineNumber": 23
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/import_list_item_schema.test.ts",
-              "lineNumber": 34
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/import_list_item_schema.test.ts",
-              "lineNumber": 48
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts",
-              "lineNumber": 23
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts",
-              "lineNumber": 35
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts",
-              "lineNumber": 46
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts",
-              "lineNumber": 57
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts",
-              "lineNumber": 69
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_item_schema.test.ts",
-              "lineNumber": 79
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts",
-              "lineNumber": 23
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts",
-              "lineNumber": 35
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts",
-              "lineNumber": 46
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts",
-              "lineNumber": 57
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts",
-              "lineNumber": 68
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts",
-              "lineNumber": 81
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts",
-              "lineNumber": 93
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts",
-              "lineNumber": 105
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts",
-              "lineNumber": 117
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/patch_list_schema.test.ts",
-              "lineNumber": 127
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts",
-              "lineNumber": 26
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts",
-              "lineNumber": 37
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts",
-              "lineNumber": 48
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts",
-              "lineNumber": 62
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts",
-              "lineNumber": 74
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_endpoint_list_item_schema.test.ts",
-              "lineNumber": 86
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts",
-              "lineNumber": 26
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts",
-              "lineNumber": 37
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts",
-              "lineNumber": 48
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts",
-              "lineNumber": 59
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts",
-              "lineNumber": 75
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts",
-              "lineNumber": 87
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts",
-              "lineNumber": 101
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts",
-              "lineNumber": 115
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_item_schema.test.ts",
-              "lineNumber": 127
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts",
-              "lineNumber": 23
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts",
-              "lineNumber": 34
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts",
-              "lineNumber": 45
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts",
-              "lineNumber": 56
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts",
-              "lineNumber": 72
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts",
-              "lineNumber": 84
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts",
-              "lineNumber": 98
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts",
-              "lineNumber": 112
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_exception_list_schema.test.ts",
-              "lineNumber": 124
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts",
-              "lineNumber": 23
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts",
-              "lineNumber": 34
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts",
-              "lineNumber": 45
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts",
-              "lineNumber": 56
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts",
-              "lineNumber": 69
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts",
-              "lineNumber": 81
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts",
-              "lineNumber": 93
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts",
-              "lineNumber": 105
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_item_schema.test.ts",
-              "lineNumber": 115
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_schema.test.ts",
-              "lineNumber": 23
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_schema.test.ts",
-              "lineNumber": 35
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/read_list_schema.test.ts",
-              "lineNumber": 45
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts",
-              "lineNumber": 25
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts",
-              "lineNumber": 36
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts",
-              "lineNumber": 49
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts",
-              "lineNumber": 62
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts",
-              "lineNumber": 76
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts",
-              "lineNumber": 88
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts",
-              "lineNumber": 100
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts",
-              "lineNumber": 113
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts",
-              "lineNumber": 127
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts",
-              "lineNumber": 139
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts",
-              "lineNumber": 25
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts",
-              "lineNumber": 36
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts",
-              "lineNumber": 49
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts",
-              "lineNumber": 62
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts",
-              "lineNumber": 76
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts",
-              "lineNumber": 88
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts",
-              "lineNumber": 100
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts",
-              "lineNumber": 113
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts",
-              "lineNumber": 127
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts",
-              "lineNumber": 139
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts",
-              "lineNumber": 161
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts",
-              "lineNumber": 25
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts",
-              "lineNumber": 36
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts",
-              "lineNumber": 49
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts",
-              "lineNumber": 62
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts",
-              "lineNumber": 76
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts",
-              "lineNumber": 88
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts",
-              "lineNumber": 100
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.test.ts",
-              "lineNumber": 122
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_list_item_schema.test.ts",
-              "lineNumber": 22
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_list_item_schema.test.ts",
-              "lineNumber": 34
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_list_item_schema.test.ts",
-              "lineNumber": 46
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_list_schema.test.ts",
-              "lineNumber": 22
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_list_schema.test.ts",
-              "lineNumber": 34
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/update_list_schema.test.ts",
-              "lineNumber": 46
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/acknowledge_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/acknowledge_schema.test.ts",
-              "lineNumber": 23
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/acknowledge_schema.test.ts",
-              "lineNumber": 34
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/acknowledge_schema.test.ts",
-              "lineNumber": 46
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts",
-              "lineNumber": 23
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts",
-              "lineNumber": 33
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts",
-              "lineNumber": 45
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts",
-              "lineNumber": 59
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts",
-              "lineNumber": 71
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 23
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 35
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 47
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 61
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 75
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 89
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 103
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 117
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 129
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 142
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 154
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 168
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 182
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 196
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 210
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 224
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.test.ts",
-              "lineNumber": 238
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 23
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 35
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 47
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 61
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 75
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 87
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 100
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 112
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 126
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 140
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 154
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 168
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 182
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.test.ts",
-              "lineNumber": 196
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts",
-              "lineNumber": 28
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts",
-              "lineNumber": 47
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts",
-              "lineNumber": 61
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts",
-              "lineNumber": 73
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts",
-              "lineNumber": 85
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts",
-              "lineNumber": 97
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts",
-              "lineNumber": 111
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts",
-              "lineNumber": 125
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts",
-              "lineNumber": 139
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_item_schema.test.ts",
-              "lineNumber": 153
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts",
-              "lineNumber": 25
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts",
-              "lineNumber": 44
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts",
-              "lineNumber": 58
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts",
-              "lineNumber": 70
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts",
-              "lineNumber": 82
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts",
-              "lineNumber": 94
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts",
-              "lineNumber": 108
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts",
-              "lineNumber": 122
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts",
-              "lineNumber": 136
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/found_exception_list_schema.test.ts",
-              "lineNumber": 150
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_index_exist_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_index_exist_schema.test.ts",
-              "lineNumber": 23
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_index_exist_schema.test.ts",
-              "lineNumber": 35
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_index_exist_schema.test.ts",
-              "lineNumber": 49
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_index_exist_schema.test.ts",
-              "lineNumber": 63
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 23
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 35
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 47
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 60
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 71
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 82
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 94
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 108
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 122
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 136
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 150
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 164
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 178
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_item_schema.test.ts",
-              "lineNumber": 190
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 23
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 35
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 46
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 57
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 68
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 80
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 94
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 108
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 122
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 136
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 150
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 164
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 178
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/list_schema.test.ts",
-              "lineNumber": 190
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/search_list_item_schema.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/search_list_item_schema.test.ts",
-              "lineNumber": 23
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/search_list_item_schema.test.ts",
-              "lineNumber": 34
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/response/search_list_item_schema.test.ts",
-              "lineNumber": 46
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/comment.test.ts",
-              "lineNumber": 12
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/comment.test.ts",
-              "lineNumber": 31
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/comment.test.ts",
-              "lineNumber": 42
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/comment.test.ts",
-              "lineNumber": 53
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/comment.test.ts",
-              "lineNumber": 62
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/comment.test.ts",
-              "lineNumber": 76
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/comment.test.ts",
-              "lineNumber": 88
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/comment.test.ts",
-              "lineNumber": 102
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/comment.test.ts",
-              "lineNumber": 116
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/comment.test.ts",
-              "lineNumber": 130
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/comment.test.ts",
-              "lineNumber": 144
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/comment.test.ts",
-              "lineNumber": 158
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/comment.test.ts",
-              "lineNumber": 169
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/comment.test.ts",
-              "lineNumber": 181
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/comment.test.ts",
-              "lineNumber": 190
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/comment.test.ts",
-              "lineNumber": 201
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/comment.test.ts",
-              "lineNumber": 214
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/comment.test.ts",
-              "lineNumber": 223
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/comment.test.ts",
-              "lineNumber": 232
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/create_comment.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/create_comment.test.ts",
-              "lineNumber": 30
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/create_comment.test.ts",
-              "lineNumber": 39
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/create_comment.test.ts",
-              "lineNumber": 53
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/create_comment.test.ts",
-              "lineNumber": 67
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/create_comment.test.ts",
-              "lineNumber": 78
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/create_comment.test.ts",
-              "lineNumber": 87
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/create_comment.test.ts",
-              "lineNumber": 98
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/create_comment.test.ts",
-              "lineNumber": 111
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/create_comment.test.ts",
-              "lineNumber": 120
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/create_comment.test.ts",
-              "lineNumber": 129
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_comments_array.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_comments_array.test.ts",
-              "lineNumber": 23
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_comments_array.test.ts",
-              "lineNumber": 32
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_comments_array.test.ts",
-              "lineNumber": 41
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_comments_array.test.ts",
-              "lineNumber": 52
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_comments_array.test.ts",
-              "lineNumber": 63
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_create_comments_array.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_create_comments_array.test.ts",
-              "lineNumber": 24
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_create_comments_array.test.ts",
-              "lineNumber": 33
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_create_comments_array.test.ts",
-              "lineNumber": 43
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_create_comments_array.test.ts",
-              "lineNumber": 56
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_create_comments_array.test.ts",
-              "lineNumber": 67
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_create_comments_array.test.ts",
-              "lineNumber": 78
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_namespace.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_namespace.test.ts",
-              "lineNumber": 21
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_namespace.test.ts",
-              "lineNumber": 30
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_namespace.test.ts",
-              "lineNumber": 39
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_namespace.test.ts",
-              "lineNumber": 48
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_namespace.test.ts",
-              "lineNumber": 57
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_namespace_array.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_namespace_array.test.ts",
-              "lineNumber": 21
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_namespace_array.test.ts",
-              "lineNumber": 30
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_namespace_array.test.ts",
-              "lineNumber": 41
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_namespace_array.test.ts",
-              "lineNumber": 50
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_namespace_array.test.ts",
-              "lineNumber": 59
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_namespace_array.test.ts",
-              "lineNumber": 68
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_namespace_array.test.ts",
-              "lineNumber": 77
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_namespace_array.test.ts",
-              "lineNumber": 86
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_namespace_array.test.ts",
-              "lineNumber": 95
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_update_comments_array.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_update_comments_array.test.ts",
-              "lineNumber": 23
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_update_comments_array.test.ts",
-              "lineNumber": 32
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_update_comments_array.test.ts",
-              "lineNumber": 41
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_update_comments_array.test.ts",
-              "lineNumber": 52
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/default_update_comments_array.test.ts",
-              "lineNumber": 63
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/empty_string_array.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/empty_string_array.test.ts",
-              "lineNumber": 21
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/empty_string_array.test.ts",
-              "lineNumber": 30
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/empty_string_array.test.ts",
-              "lineNumber": 39
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/empty_string_array.test.ts",
-              "lineNumber": 48
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/empty_string_array.test.ts",
-              "lineNumber": 57
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/empty_string_array.test.ts",
-              "lineNumber": 66
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/empty_string_array.test.ts",
-              "lineNumber": 77
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entries.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entries.test.ts",
-              "lineNumber": 28
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entries.test.ts",
-              "lineNumber": 37
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entries.test.ts",
-              "lineNumber": 46
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entries.test.ts",
-              "lineNumber": 55
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entries.test.ts",
-              "lineNumber": 64
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entries.test.ts",
-              "lineNumber": 80
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entries.test.ts",
-              "lineNumber": 89
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entries.test.ts",
-              "lineNumber": 98
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entries.test.ts",
-              "lineNumber": 107
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entries.test.ts",
-              "lineNumber": 116
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entries.test.ts",
-              "lineNumber": 125
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entries.test.ts",
-              "lineNumber": 136
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entries.test.ts",
-              "lineNumber": 145
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_exists.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_exists.test.ts",
-              "lineNumber": 22
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_exists.test.ts",
-              "lineNumber": 31
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_exists.test.ts",
-              "lineNumber": 41
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_exists.test.ts",
-              "lineNumber": 53
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_exists.test.ts",
-              "lineNumber": 65
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_exists.test.ts",
-              "lineNumber": 77
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_list.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_list.test.ts",
-              "lineNumber": 22
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_list.test.ts",
-              "lineNumber": 31
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_list.test.ts",
-              "lineNumber": 41
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_list.test.ts",
-              "lineNumber": 53
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_list.test.ts",
-              "lineNumber": 67
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_list.test.ts",
-              "lineNumber": 79
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_list.test.ts",
-              "lineNumber": 93
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match.test.ts",
-              "lineNumber": 22
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match.test.ts",
-              "lineNumber": 31
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match.test.ts",
-              "lineNumber": 41
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match.test.ts",
-              "lineNumber": 53
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match.test.ts",
-              "lineNumber": 65
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match.test.ts",
-              "lineNumber": 79
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match.test.ts",
-              "lineNumber": 91
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match.test.ts",
-              "lineNumber": 105
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match_any.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match_any.test.ts",
-              "lineNumber": 22
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match_any.test.ts",
-              "lineNumber": 31
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match_any.test.ts",
-              "lineNumber": 41
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match_any.test.ts",
-              "lineNumber": 53
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match_any.test.ts",
-              "lineNumber": 65
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match_any.test.ts",
-              "lineNumber": 77
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match_any.test.ts",
-              "lineNumber": 91
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match_any.test.ts",
-              "lineNumber": 103
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.test.ts",
-              "lineNumber": 22
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.test.ts",
-              "lineNumber": 31
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.test.ts",
-              "lineNumber": 41
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.test.ts",
-              "lineNumber": 53
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.test.ts",
-              "lineNumber": 65
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.test.ts",
-              "lineNumber": 79
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.test.ts",
-              "lineNumber": 91
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.test.ts",
-              "lineNumber": 103
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_nested.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_nested.test.ts",
-              "lineNumber": 24
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_nested.test.ts",
-              "lineNumber": 36
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_nested.test.ts",
-              "lineNumber": 47
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_nested.test.ts",
-              "lineNumber": 58
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_nested.test.ts",
-              "lineNumber": 69
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_nested.test.ts",
-              "lineNumber": 80
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_nested.test.ts",
-              "lineNumber": 100
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_nested.test.ts",
-              "lineNumber": 122
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts",
-              "lineNumber": 31
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts",
-              "lineNumber": 42
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts",
-              "lineNumber": 53
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts",
-              "lineNumber": 64
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts",
-              "lineNumber": 73
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts",
-              "lineNumber": 82
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts",
-              "lineNumber": 91
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts",
-              "lineNumber": 100
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts",
-              "lineNumber": 109
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts",
-              "lineNumber": 118
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts",
-              "lineNumber": 127
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts",
-              "lineNumber": 26
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts",
-              "lineNumber": 37
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts",
-              "lineNumber": 48
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts",
-              "lineNumber": 59
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts",
-              "lineNumber": 68
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts",
-              "lineNumber": 77
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts",
-              "lineNumber": 86
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts",
-              "lineNumber": 103
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts",
-              "lineNumber": 112
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_or_nullable_string_array.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_or_nullable_string_array.test.ts",
-              "lineNumber": 21
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_or_nullable_string_array.test.ts",
-              "lineNumber": 32
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_or_nullable_string_array.test.ts",
-              "lineNumber": 43
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_or_nullable_string_array.test.ts",
-              "lineNumber": 54
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_or_nullable_string_array.test.ts",
-              "lineNumber": 65
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_string_array.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_string_array.test.ts",
-              "lineNumber": 21
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_string_array.test.ts",
-              "lineNumber": 32
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_string_array.test.ts",
-              "lineNumber": 43
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_string_array.test.ts",
-              "lineNumber": 54
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_string_array.test.ts",
-              "lineNumber": 63
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_string_array.test.ts",
-              "lineNumber": 72
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_string_array.test.ts",
-              "lineNumber": 81
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/non_empty_string_array.test.ts",
-              "lineNumber": 92
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/update_comment.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/update_comment.test.ts",
-              "lineNumber": 30
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/update_comment.test.ts",
-              "lineNumber": 41
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/update_comment.test.ts",
-              "lineNumber": 52
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/update_comment.test.ts",
-              "lineNumber": 62
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/update_comment.test.ts",
-              "lineNumber": 71
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/update_comment.test.ts",
-              "lineNumber": 82
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/update_comment.test.ts",
-              "lineNumber": 93
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/update_comment.test.ts",
-              "lineNumber": 102
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/update_comment.test.ts",
-              "lineNumber": 113
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/update_comment.test.ts",
-              "lineNumber": 126
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/update_comment.test.ts",
-              "lineNumber": 135
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/update_comment.test.ts",
-              "lineNumber": 144
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entries.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entries.test.ts",
-              "lineNumber": 32
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entries.test.ts",
-              "lineNumber": 41
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entries.test.ts",
-              "lineNumber": 50
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entries.test.ts",
-              "lineNumber": 73
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entries.test.ts",
-              "lineNumber": 86
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entries.test.ts",
-              "lineNumber": 99
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entries.test.ts",
-              "lineNumber": 108
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_match.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_match.test.ts",
-              "lineNumber": 23
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_match.test.ts",
-              "lineNumber": 34
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_match.test.ts",
-              "lineNumber": 48
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_match.test.ts",
-              "lineNumber": 60
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_match.test.ts",
-              "lineNumber": 74
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_match.test.ts",
-              "lineNumber": 86
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_match.test.ts",
-              "lineNumber": 100
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_any.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_any.test.ts",
-              "lineNumber": 23
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_any.test.ts",
-              "lineNumber": 34
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_any.test.ts",
-              "lineNumber": 48
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_any.test.ts",
-              "lineNumber": 60
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_any.test.ts",
-              "lineNumber": 72
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_any.test.ts",
-              "lineNumber": 86
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_any.test.ts",
-              "lineNumber": 98
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_nested.test.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_nested.test.ts",
-              "lineNumber": 29
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_nested.test.ts",
-              "lineNumber": 41
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_nested.test.ts",
-              "lineNumber": 52
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_nested.test.ts",
-              "lineNumber": 63
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_nested.test.ts",
-              "lineNumber": 74
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_nested.test.ts",
-              "lineNumber": 85
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_nested.test.ts",
-              "lineNumber": 105
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_nested.test.ts",
-              "lineNumber": 120
-            }
-          }
-        ],
-        "children": [
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-common.getPaths.$1",
-            "type": "CompoundType",
-            "tags": [],
-            "label": "validation",
-            "description": [],
-            "signature": [
-              "Either",
-              "<",
-              "Errors",
-              ", A>"
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/common/test_utils.ts",
-              "lineNumber": 46
-            },
-            "deprecated": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "securitySolution",
-        "id": "def-common.removeExternalLinkText",
-        "type": "Function",
-        "tags": [
-          "deprecated"
-        ],
-        "label": "removeExternalLinkText",
-        "description": [
-          "\nConvenience utility to remove text appended to links by EUI"
-        ],
-        "signature": [
-          "(str: string) => string"
-        ],
-        "source": {
-          "path": "x-pack/plugins/security_solution/common/test_utils.ts",
-          "lineNumber": 60
-        },
-        "deprecated": true,
-        "references": [],
-        "children": [
+            "parentPluginId": "securitySolution",
+            "id": "def-common.getPaths.$1",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "validation",
+            "description": [],
+            "signature": [
+              "Either",
+              "<",
+              "Errors",
+              ", A>"
+            ],
+            "source": {
+              "path": "x-pack/plugins/security_solution/common/test_utils.ts",
+              "lineNumber": 46
+            },
+            "deprecated": false,
+            "isRequired": true
+          }
+        ],
+        "returnComment": [],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "securitySolution",
+        "id": "def-common.removeExternalLinkText",
+        "type": "Function",
+        "tags": [
+          "deprecated"
+        ],
+        "label": "removeExternalLinkText",
+        "description": [
+          "\nConvenience utility to remove text appended to links by EUI"
+        ],
+        "signature": [
+          "(str: string) => string"
+        ],
+        "source": {
+          "path": "x-pack/plugins/security_solution/common/test_utils.ts",
+          "lineNumber": 60
+        },
+        "deprecated": true,
+        "references": [],
+        "children": [
           {
             "parentPluginId": "securitySolution",
             "id": "def-common.removeExternalLinkText.$1",
@@ -13316,29 +2175,7 @@
           "lineNumber": 17
         },
         "deprecated": true,
-        "references": [
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/shared_imports.ts",
-              "lineNumber": 12
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.ts",
-              "lineNumber": 13
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.ts",
-              "lineNumber": 293
-            }
-          }
-        ],
+        "references": [],
         "initialIsOpen": false
       },
       {
@@ -13348,70 +2185,20 @@
         "tags": [
           "deprecated"
         ],
-        "label": "DefaultUuid",
-        "description": [
-          "\nTypes the DefaultUuid as:\n  - If null or undefined, then a default string uuid.v4() will be\n    created otherwise it will be checked just against an empty string"
-        ],
-        "signature": [
-          "Type",
-          "<string, string | undefined, unknown>"
-        ],
-        "source": {
-          "path": "x-pack/plugins/security_solution/common/detection_engine/schemas/types/default_uuid.ts",
-          "lineNumber": 20
-        },
-        "deprecated": true,
-        "references": [
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/shared_imports.ts",
-              "lineNumber": 11
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.ts",
-              "lineNumber": 25
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.ts",
-              "lineNumber": 39
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.ts",
-              "lineNumber": 31
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.ts",
-              "lineNumber": 46
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.ts",
-              "lineNumber": 24
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.ts",
-              "lineNumber": 40
-            }
-          }
-        ],
+        "label": "DefaultUuid",
+        "description": [
+          "\nTypes the DefaultUuid as:\n  - If null or undefined, then a default string uuid.v4() will be\n    created otherwise it will be checked just against an empty string"
+        ],
+        "signature": [
+          "Type",
+          "<string, string | undefined, unknown>"
+        ],
+        "source": {
+          "path": "x-pack/plugins/security_solution/common/detection_engine/schemas/types/default_uuid.ts",
+          "lineNumber": 20
+        },
+        "deprecated": true,
+        "references": [],
         "initialIsOpen": false
       },
       {
@@ -13434,43 +2221,7 @@
           "lineNumber": 17
         },
         "deprecated": true,
-        "references": [
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/shared_imports.ts",
-              "lineNumber": 13
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.ts",
-              "lineNumber": 25
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.ts",
-              "lineNumber": 45
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_list_schema.ts",
-              "lineNumber": 12
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/request/create_list_schema.ts",
-              "lineNumber": 28
-            }
-          }
-        ],
+        "references": [],
         "initialIsOpen": false
       },
       {
@@ -13493,260 +2244,7 @@
           "lineNumber": 16
         },
         "deprecated": true,
-        "references": [
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/shared_imports.ts",
-              "lineNumber": 9
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.ts",
-              "lineNumber": 13
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.ts",
-              "lineNumber": 55
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.ts",
-              "lineNumber": 87
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/common/schemas.ts",
-              "lineNumber": 366
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/comment.ts",
-              "lineNumber": 10
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/comment.ts",
-              "lineNumber": 19
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/create_comment.ts",
-              "lineNumber": 10
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/create_comment.ts",
-              "lineNumber": 17
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/update_comment.ts",
-              "lineNumber": 10
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/update_comment.ts",
-              "lineNumber": 19
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match_any.ts",
-              "lineNumber": 10
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match_any.ts",
-              "lineNumber": 20
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match.ts",
-              "lineNumber": 10
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match.ts",
-              "lineNumber": 18
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match.ts",
-              "lineNumber": 21
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_exists.ts",
-              "lineNumber": 10
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_exists.ts",
-              "lineNumber": 18
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_list.ts",
-              "lineNumber": 10
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_list.ts",
-              "lineNumber": 18
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_list.ts",
-              "lineNumber": 19
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_nested.ts",
-              "lineNumber": 10
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_nested.ts",
-              "lineNumber": 20
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.ts",
-              "lineNumber": 10
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.ts",
-              "lineNumber": 18
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.ts",
-              "lineNumber": 21
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_any.ts",
-              "lineNumber": 10
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_any.ts",
-              "lineNumber": 19
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_match.ts",
-              "lineNumber": 10
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_match.ts",
-              "lineNumber": 18
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_match.ts",
-              "lineNumber": 21
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_nested.ts",
-              "lineNumber": 10
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_nested.ts",
-              "lineNumber": 20
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_wildcard.ts",
-              "lineNumber": 10
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_wildcard.ts",
-              "lineNumber": 18
-            }
-          },
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_wildcard.ts",
-              "lineNumber": 21
-            }
-          }
-        ],
+        "references": [],
         "initialIsOpen": false
       }
     ]
diff --git a/api_docs/spaces.json b/api_docs/spaces.json
index d53b69d5bd6b5..8a3be35bd0717 100644
--- a/api_docs/spaces.json
+++ b/api_docs/spaces.json
@@ -1211,7 +1211,7 @@
                 "plugin": "securitySolution",
                 "link": {
                   "path": "x-pack/plugins/security_solution/server/plugin.ts",
-                  "lineNumber": 193
+                  "lineNumber": 202
                 }
               },
               {
@@ -2017,7 +2017,7 @@
               "plugin": "securitySolution",
               "link": {
                 "path": "x-pack/plugins/security_solution/server/plugin.ts",
-                "lineNumber": 193
+                "lineNumber": 202
               }
             },
             {
diff --git a/api_docs/spaces_oss.json b/api_docs/spaces_oss.json
index a0ed4297ddc39..76ebab516b91c 100644
--- a/api_docs/spaces_oss.json
+++ b/api_docs/spaces_oss.json
@@ -577,9 +577,14 @@
         "deprecated": false,
         "children": [
           {
+            "parentPluginId": "spacesOss",
             "id": "def-public.SpacesApi.getActiveSpace$",
             "type": "Function",
+            "tags": [],
             "label": "getActiveSpace$",
+            "description": [
+              "\nObservable representing the currently active space.\nThe details of the space can change without a full page reload (such as display name, color, etc.)"
+            ],
             "signature": [
               "() => ",
               "Observable",
@@ -593,16 +598,13 @@
               },
               ">"
             ],
-            "description": [
-              "\nObservable representing the currently active space.\nThe details of the space can change without a full page reload (such as display name, color, etc.)"
-            ],
-            "children": [],
-            "tags": [],
-            "returnComment": [],
             "source": {
               "path": "src/plugins/spaces_oss/public/api.ts",
               "lineNumber": 22
-            }
+            },
+            "deprecated": false,
+            "children": [],
+            "returnComment": []
           },
           {
             "parentPluginId": "spacesOss",

From f1a13f44608dd038aa9e5ed5cb9feff0099a342b Mon Sep 17 00:00:00 2001
From: Madison Caldwell <madison.caldwell@elastic.co>
Date: Tue, 11 May 2021 14:32:13 -0400
Subject: [PATCH 36/54] remove observability formatter

---
 x-pack/plugins/observability/public/index.ts | 2 --
 1 file changed, 2 deletions(-)

diff --git a/x-pack/plugins/observability/public/index.ts b/x-pack/plugins/observability/public/index.ts
index 1561cf515a58e..8dd2f6a57eefe 100644
--- a/x-pack/plugins/observability/public/index.ts
+++ b/x-pack/plugins/observability/public/index.ts
@@ -62,7 +62,5 @@ export { getApmTraceUrl } from './utils/get_apm_trace_url';
 export { createExploratoryViewUrl } from './components/shared/exploratory_view/configurations/utils';
 export type { SeriesUrl } from './components/shared/exploratory_view/types';
 
-export { FormatterRuleRegistry } from './rules/formatter_rule_registry';
-
 export type { ObservabilityRuleTypeRegistry } from './rules/create_observability_rule_type_registry';
 export { createObservabilityRuleTypeRegistryMock } from './rules/observability_rule_type_registry_mock';

From 37c071167cf9ae8906c46793bb87a7fc648aecf7 Mon Sep 17 00:00:00 2001
From: Madison Caldwell <madison.caldwell@elastic.co>
Date: Tue, 11 May 2021 14:44:03 -0400
Subject: [PATCH 37/54] Fix default_config

---
 .../alerts_table/default_config.tsx           | 23 +++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/default_config.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/default_config.tsx
index a9b2b21051f3b..42a3901a3a54d 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/default_config.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/default_config.tsx
@@ -5,11 +5,12 @@
  * 2.0.
  */
 
+import { defaultColumnHeaderType } from '../../../timelines/components/timeline/body/column_headers/default_headers';
 import { RowRendererId } from '../../../../common/types/timeline';
 import { Status } from '../../../../common/detection_engine/schemas/common/schemas';
 import { Filter } from '../../../../../../../src/plugins/data/common/es_query';
 
-import { SubsetTimelineModel } from '../../../timelines/store/timeline/model';
+import { ColumnHeaderOptions, SubsetTimelineModel } from '../../../timelines/store/timeline/model';
 import { timelineDefaults } from '../../../timelines/store/timeline/defaults';
 import { columns } from '../../configurations/security_solution_detections/columns';
 
@@ -72,7 +73,25 @@ export const buildShowBuildingBlockFilter = (showBuildingBlockAlerts: boolean):
         //   // @ts-expect-error TODO: Rework parent typings to support ExistsFilter[]
         //   exists: { field: 'signal.rule.building_block_type' },
         // },
-];
+      ];
+
+export const buildThreatMatchFilter = (showOnlyThreatIndicatorAlerts: boolean): Filter[] =>
+  showOnlyThreatIndicatorAlerts
+    ? [
+        {
+          meta: {
+            alias: null,
+            disabled: false,
+            negate: false,
+            key: 'signal.rule.threat_mapping',
+            type: 'exists',
+            value: 'exists',
+          },
+          // @ts-expect-error TODO: Rework parent typings to support ExistsFilter[]
+          exists: { field: 'signal.rule.threat_mapping' },
+        },
+      ]
+    : [];
 
 export const alertsDefaultModel: SubsetTimelineModel = {
   ...timelineDefaults,

From 2c491cb77307cc4de08d1695c5f64fe5c45eba78 Mon Sep 17 00:00:00 2001
From: Dario Gieselaar <dario.gieselaar@elastic.co>
Date: Thu, 6 May 2021 14:54:49 +0200
Subject: [PATCH 38/54] remove console.log statements

---
 x-pack/test/apm_api_integration/tests/alerts/rule_registry.ts | 2 --
 1 file changed, 2 deletions(-)

diff --git a/x-pack/test/apm_api_integration/tests/alerts/rule_registry.ts b/x-pack/test/apm_api_integration/tests/alerts/rule_registry.ts
index 7e9db3743b0a7..f7b8b34d88c01 100644
--- a/x-pack/test/apm_api_integration/tests/alerts/rule_registry.ts
+++ b/x-pack/test/apm_api_integration/tests/alerts/rule_registry.ts
@@ -73,7 +73,6 @@ export default function ApiTest({ getService }: FtrProviderContext) {
     intervalInSeconds: number = 1,
     count: number = 0
   ): Promise<Alert> {
-    console.log('waitUntilNextExecution');
     await new Promise((resolve) => {
       setTimeout(resolve, intervalInSeconds * 1000);
     });
@@ -91,7 +90,6 @@ export default function ApiTest({ getService }: FtrProviderContext) {
     const nextAlert = body as Alert;
 
     if (nextAlert.executionStatus.lastExecutionDate !== alert.executionStatus.lastExecutionDate) {
-      console.log('next execution completed');
       await new Promise((resolve) => {
         setTimeout(resolve, BULK_INDEX_DELAY);
       });

From 6b34ed54aa13991dcaf19a7e4ad1c2e4f30b0b43 Mon Sep 17 00:00:00 2001
From: Madison Caldwell <madison.caldwell@elastic.co>
Date: Tue, 11 May 2021 18:14:39 -0400
Subject: [PATCH 39/54] Remove extraneous file

---
 .../assets/lifecycle_policies/field_map.ts    | 37 -------------------
 1 file changed, 37 deletions(-)
 delete mode 100644 x-pack/plugins/rule_registry/server/assets/lifecycle_policies/field_map.ts

diff --git a/x-pack/plugins/rule_registry/server/assets/lifecycle_policies/field_map.ts b/x-pack/plugins/rule_registry/server/assets/lifecycle_policies/field_map.ts
deleted file mode 100644
index 82c62ae93fc6e..0000000000000
--- a/x-pack/plugins/rule_registry/server/assets/lifecycle_policies/field_map.ts
+++ /dev/null
@@ -1,37 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { ecsFieldMap } from '../../generated/ecs_field_map';
-import { pickWithPatterns } from '../field_map/pick_with_patterns';
-
-export const defaultFieldMap = {
-  ...pickWithPatterns(
-    ecsFieldMap,
-    '@timestamp',
-    'event.kind',
-    'event.action',
-    'rule.uuid',
-    'rule.id',
-    'rule.name',
-    'rule.category',
-    'tags'
-  ),
-  'kibana.rac.producer': { type: 'keyword' },
-  'kibana.rac.alert.uuid': { type: 'keyword' },
-  'kibana.rac.alert.id': { type: 'keyword' },
-  'kibana.rac.alert.start': { type: 'date' },
-  'kibana.rac.alert.end': { type: 'date' },
-  'kibana.rac.alert.duration.us': { type: 'long' },
-  'kibana.rac.alert.severity.level': { type: 'keyword' },
-  'kibana.rac.alert.severity.value': { type: 'long' },
-  'kibana.rac.alert.status': { type: 'keyword' },
-  'kibana.rac.alert.ancestors': { array: true, type: 'keyword' },
-  'kibana.rac.alert.depth': { type: 'long' },
-  'kibana.rac.alert.building_block_type': { type: 'keyword' },
-} as const;
-
-export type DefaultFieldMap = typeof defaultFieldMap;

From dc0c494ea1f4bf37323741d60d1e129cb40dfcdf Mon Sep 17 00:00:00 2001
From: Dario Gieselaar <dario.gieselaar@elastic.co>
Date: Wed, 12 May 2021 09:23:29 +0200
Subject: [PATCH 40/54] Prevent race condition when creating/updating the write
 target

---
 .../server/rule_data_client/index.ts          | 23 ++++++++++++-------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/x-pack/plugins/rule_registry/server/rule_data_client/index.ts b/x-pack/plugins/rule_registry/server/rule_data_client/index.ts
index 9de1c9a882289..135c870f20727 100644
--- a/x-pack/plugins/rule_registry/server/rule_data_client/index.ts
+++ b/x-pack/plugins/rule_registry/server/rule_data_client/index.ts
@@ -101,16 +101,23 @@ export class RuleDataClient implements IRuleDataClient {
     const concreteIndexName = `${alias}-000001`;
 
     if (!aliasExists) {
-      await clusterClient.indices.create({
-        index: concreteIndexName,
-        body: {
-          aliases: {
-            [alias]: {
-              is_write_index: true,
+      try {
+        await clusterClient.indices.create({
+          index: concreteIndexName,
+          body: {
+            aliases: {
+              [alias]: {
+                is_write_index: true,
+              },
             },
           },
-        },
-      });
+        });
+      } catch (err) {
+        // something might have created the index already, that sounds OK
+        if (err?.meta?.body?.type !== 'resource_already_exists_exception') {
+          throw err;
+        }
+      }
     }
 
     const { body: simulateResponse } = await clusterClient.transport.request({

From 21ece9bfef34a709e70e6efed62d63247376b68d Mon Sep 17 00:00:00 2001
From: Dario Gieselaar <dario.gieselaar@elastic.co>
Date: Wed, 12 May 2021 10:07:50 +0200
Subject: [PATCH 41/54] Remove ruleRegistry from limits.yml

---
 packages/kbn-optimizer/limits.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/packages/kbn-optimizer/limits.yml b/packages/kbn-optimizer/limits.yml
index 08e90ed829d4a..448b5ad650da5 100644
--- a/packages/kbn-optimizer/limits.yml
+++ b/packages/kbn-optimizer/limits.yml
@@ -61,7 +61,6 @@ pageLoadAssetSize:
   remoteClusters: 51327
   reporting: 183418
   rollup: 97204
-  ruleRegistry: 100000
   savedObjects: 108518
   savedObjectsManagement: 101836
   savedObjectsTagging: 59482

From c71e575debe705cc6d93bf75dc7dfccdd6463fcb Mon Sep 17 00:00:00 2001
From: Dario Gieselaar <dario.gieselaar@elastic.co>
Date: Wed, 12 May 2021 10:25:35 +0200
Subject: [PATCH 42/54] Move rule field names to package to limit bundle size
 impact

---
 package.json                                  |  3 +-
 packages/kbn-rule-data-utils/jest.config.js   | 13 ++++
 packages/kbn-rule-data-utils/package.json     | 13 ++++
 packages/kbn-rule-data-utils/src/index.ts     |  9 +++
 .../src/technical_field_names.ts              | 77 +++++++++++++++++++
 packages/kbn-rule-data-utils/tsconfig.json    | 19 +++++
 .../alerting/register_apm_alerts.ts           |  2 +-
 .../ErrorGroupDetails/Distribution/index.tsx  |  2 +-
 .../service_icons/alert_details.tsx           |  4 +-
 .../charts/helper/get_alert_annotations.tsx   |  2 +-
 .../shared/charts/latency_chart/index.tsx     |  2 +-
 .../alerts/register_error_count_alert_type.ts |  2 +-
 ...egister_transaction_duration_alert_type.ts |  2 +-
 ...transaction_duration_anomaly_alert_type.ts | 12 +--
 ...ister_transaction_error_rate_alert_type.ts |  2 +-
 .../server/lib/services/get_service_alerts.ts |  2 +-
 .../pages/alerts/alerts_flyout/index.tsx      |  4 +-
 .../public/pages/alerts/alerts_table.tsx      |  2 +-
 .../public/pages/alerts/index.tsx             | 12 +--
 .../server/lib/rules/get_top_alerts.ts        |  5 +-
 .../common/technical_rule_data_field_names.ts | 70 +----------------
 yarn.lock                                     |  4 +
 22 files changed, 164 insertions(+), 99 deletions(-)
 create mode 100644 packages/kbn-rule-data-utils/jest.config.js
 create mode 100644 packages/kbn-rule-data-utils/package.json
 create mode 100644 packages/kbn-rule-data-utils/src/index.ts
 create mode 100644 packages/kbn-rule-data-utils/src/technical_field_names.ts
 create mode 100644 packages/kbn-rule-data-utils/tsconfig.json

diff --git a/package.json b/package.json
index 81ffe913f0192..dbdec976665fa 100644
--- a/package.json
+++ b/package.json
@@ -136,8 +136,8 @@
     "@kbn/logging": "link:bazel-bin/packages/kbn-logging/npm_module",
     "@kbn/monaco": "link:packages/kbn-monaco",
     "@kbn/securitysolution-constants": "link:bazel-bin/packages/kbn-securitysolution-constants/npm_module",
-    "@kbn/securitysolution-utils": "link:bazel-bin/packages/kbn-securitysolution-utils/npm_module",
     "@kbn/securitysolution-io-ts-utils": "link:bazel-bin/packages/kbn-securitysolution-io-ts-utils/npm_module",
+    "@kbn/securitysolution-utils": "link:bazel-bin/packages/kbn-securitysolution-utils/npm_module",
     "@kbn/server-http-tools": "link:packages/kbn-server-http-tools",
     "@kbn/server-route-repository": "link:packages/kbn-server-route-repository",
     "@kbn/std": "link:bazel-bin/packages/kbn-std/npm_module",
@@ -264,6 +264,7 @@
     "json-stringify-safe": "5.0.1",
     "jsonwebtoken": "^8.5.1",
     "jsts": "^1.6.2",
+    "@kbn/rule-data-utils": "link:packages/kbn-rule-data-utils",
     "kea": "^2.3.0",
     "leaflet": "1.5.1",
     "leaflet-draw": "0.4.14",
diff --git a/packages/kbn-rule-data-utils/jest.config.js b/packages/kbn-rule-data-utils/jest.config.js
new file mode 100644
index 0000000000000..26cb39fe8b55a
--- /dev/null
+++ b/packages/kbn-rule-data-utils/jest.config.js
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+module.exports = {
+  preset: '@kbn/test',
+  rootDir: '../..',
+  roots: ['<rootDir>/packages/kbn-rule-data-utils'],
+};
diff --git a/packages/kbn-rule-data-utils/package.json b/packages/kbn-rule-data-utils/package.json
new file mode 100644
index 0000000000000..6f0b8439ec891
--- /dev/null
+++ b/packages/kbn-rule-data-utils/package.json
@@ -0,0 +1,13 @@
+{
+  "name": "@kbn/rule-data-utils",
+  "main": "./target/index.js",
+  "types": "./target/index.d.ts",
+  "version": "1.0.0",
+  "license": "SSPL-1.0 OR Elastic License 2.0",
+  "private": true,
+  "scripts": {
+    "build": "../../node_modules/.bin/tsc",
+    "kbn:bootstrap": "yarn build",
+    "kbn:watch": "yarn build --watch"
+  }
+}
diff --git a/packages/kbn-rule-data-utils/src/index.ts b/packages/kbn-rule-data-utils/src/index.ts
new file mode 100644
index 0000000000000..93a2538c7aa2c
--- /dev/null
+++ b/packages/kbn-rule-data-utils/src/index.ts
@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export * from './technical_field_names';
diff --git a/packages/kbn-rule-data-utils/src/technical_field_names.ts b/packages/kbn-rule-data-utils/src/technical_field_names.ts
new file mode 100644
index 0000000000000..31779c9f08e81
--- /dev/null
+++ b/packages/kbn-rule-data-utils/src/technical_field_names.ts
@@ -0,0 +1,77 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { ValuesType } from 'utility-types';
+
+const ALERT_NAMESPACE = 'kibana.rac.alert';
+
+const TIMESTAMP = '@timestamp' as const;
+const EVENT_KIND = 'event.kind' as const;
+const EVENT_ACTION = 'event.action' as const;
+const RULE_UUID = 'rule.uuid' as const;
+const RULE_ID = 'rule.id' as const;
+const RULE_NAME = 'rule.name' as const;
+const RULE_CATEGORY = 'rule.category' as const;
+const TAGS = 'tags' as const;
+const PRODUCER = `${ALERT_NAMESPACE}.producer` as const;
+const ALERT_ID = `${ALERT_NAMESPACE}.id` as const;
+const ALERT_UUID = `${ALERT_NAMESPACE}.uuid` as const;
+const ALERT_START = `${ALERT_NAMESPACE}.start` as const;
+const ALERT_END = `${ALERT_NAMESPACE}.end` as const;
+const ALERT_DURATION = `${ALERT_NAMESPACE}.duration.us` as const;
+const ALERT_SEVERITY_LEVEL = `${ALERT_NAMESPACE}.severity.level` as const;
+const ALERT_SEVERITY_VALUE = `${ALERT_NAMESPACE}.severity.value` as const;
+const ALERT_STATUS = `${ALERT_NAMESPACE}.status` as const;
+const ALERT_EVALUATION_THRESHOLD = `${ALERT_NAMESPACE}.evaluation.threshold` as const;
+const ALERT_EVALUATION_VALUE = `${ALERT_NAMESPACE}.evaluation.value` as const;
+
+const fields = {
+  TIMESTAMP,
+  EVENT_KIND,
+  EVENT_ACTION,
+  RULE_UUID,
+  RULE_ID,
+  RULE_NAME,
+  RULE_CATEGORY,
+  TAGS,
+  PRODUCER,
+  ALERT_ID,
+  ALERT_UUID,
+  ALERT_START,
+  ALERT_END,
+  ALERT_DURATION,
+  ALERT_SEVERITY_LEVEL,
+  ALERT_SEVERITY_VALUE,
+  ALERT_STATUS,
+  ALERT_EVALUATION_THRESHOLD,
+  ALERT_EVALUATION_VALUE,
+};
+
+export {
+  TIMESTAMP,
+  EVENT_KIND,
+  EVENT_ACTION,
+  RULE_UUID,
+  RULE_ID,
+  RULE_NAME,
+  RULE_CATEGORY,
+  TAGS,
+  PRODUCER,
+  ALERT_ID,
+  ALERT_UUID,
+  ALERT_START,
+  ALERT_END,
+  ALERT_DURATION,
+  ALERT_SEVERITY_LEVEL,
+  ALERT_SEVERITY_VALUE,
+  ALERT_STATUS,
+  ALERT_EVALUATION_THRESHOLD,
+  ALERT_EVALUATION_VALUE,
+};
+
+export type TechnicalRuleDataFieldName = ValuesType<typeof fields>;
diff --git a/packages/kbn-rule-data-utils/tsconfig.json b/packages/kbn-rule-data-utils/tsconfig.json
new file mode 100644
index 0000000000000..4b1262d11f3af
--- /dev/null
+++ b/packages/kbn-rule-data-utils/tsconfig.json
@@ -0,0 +1,19 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "incremental": false,
+    "outDir": "./target",
+    "stripInternal": false,
+    "declaration": true,
+    "declarationMap": true,
+    "sourceMap": true,
+    "sourceRoot": "../../../../packages/kbn-rule-data-utils/src",
+    "types": [
+      "jest",
+      "node"
+    ]
+  },
+  "include": [
+    "./src/**/*.ts"
+  ]
+}
diff --git a/x-pack/plugins/apm/public/components/alerting/register_apm_alerts.ts b/x-pack/plugins/apm/public/components/alerting/register_apm_alerts.ts
index 6467d4c3ee61c..35dbca0df1ec4 100644
--- a/x-pack/plugins/apm/public/components/alerting/register_apm_alerts.ts
+++ b/x-pack/plugins/apm/public/components/alerting/register_apm_alerts.ts
@@ -12,7 +12,7 @@ import {
   ALERT_EVALUATION_THRESHOLD,
   ALERT_EVALUATION_VALUE,
   ALERT_SEVERITY_LEVEL,
-} from '../../../../rule_registry/common/technical_rule_data_field_names';
+} from '@kbn/rule-data-utils/target/technical_field_names';
 import type { ObservabilityRuleTypeRegistry } from '../../../../observability/public';
 import { ENVIRONMENT_ALL } from '../../../common/environment_filter_values';
 import { AlertType } from '../../../common/alert_types';
diff --git a/x-pack/plugins/apm/public/components/app/ErrorGroupDetails/Distribution/index.tsx b/x-pack/plugins/apm/public/components/app/ErrorGroupDetails/Distribution/index.tsx
index aa11eb06d853f..16ac1a35666d2 100644
--- a/x-pack/plugins/apm/public/components/app/ErrorGroupDetails/Distribution/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/ErrorGroupDetails/Distribution/index.tsx
@@ -19,7 +19,7 @@ import {
 import { EuiTitle } from '@elastic/eui';
 import d3 from 'd3';
 import React from 'react';
-import { RULE_ID } from '../../../../../../rule_registry/common/technical_rule_data_field_names';
+import { RULE_ID } from '@kbn/rule-data-utils/target/technical_field_names';
 import { useApmServiceContext } from '../../../../context/apm_service/use_apm_service_context';
 import { APIReturnType } from '../../../../services/rest/createCallApmApi';
 import { asRelativeDateTimeRange } from '../../../../../common/utils/formatters';
diff --git a/x-pack/plugins/apm/public/components/app/service_details/service_icons/alert_details.tsx b/x-pack/plugins/apm/public/components/app/service_details/service_icons/alert_details.tsx
index 47dfb64a8b7ef..0066480230c6b 100644
--- a/x-pack/plugins/apm/public/components/app/service_details/service_icons/alert_details.tsx
+++ b/x-pack/plugins/apm/public/components/app/service_details/service_icons/alert_details.tsx
@@ -8,13 +8,13 @@ import React from 'react';
 import { EuiFlexGroup, EuiFlexItem, EuiLink } from '@elastic/eui';
 import { parse, format } from 'url';
 import { uniqBy } from 'lodash';
-import { parseTechnicalFields } from '../../../../../../rule_registry/common';
 import {
   ALERT_ID,
   ALERT_START,
   RULE_ID,
   RULE_NAME,
-} from '../../../../../../rule_registry/common/technical_rule_data_field_names';
+} from '@kbn/rule-data-utils/target/technical_field_names';
+import { parseTechnicalFields } from '../../../../../../rule_registry/common';
 import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
 import { useApmPluginContext } from '../../../../context/apm_plugin/use_apm_plugin_context';
 import { APIReturnType } from '../../../../services/rest/createCallApmApi';
diff --git a/x-pack/plugins/apm/public/components/shared/charts/helper/get_alert_annotations.tsx b/x-pack/plugins/apm/public/components/shared/charts/helper/get_alert_annotations.tsx
index 310f5a165a5c8..e906707730baa 100644
--- a/x-pack/plugins/apm/public/components/shared/charts/helper/get_alert_annotations.tsx
+++ b/x-pack/plugins/apm/public/components/shared/charts/helper/get_alert_annotations.tsx
@@ -14,7 +14,7 @@ import {
   RULE_ID,
   ALERT_START,
   ALERT_UUID,
-} from '../../../../../../rule_registry/common/technical_rule_data_field_names';
+} from '@kbn/rule-data-utils/target/technical_field_names';
 import { parseTechnicalFields } from '../../../../../../rule_registry/common';
 import { APIReturnType } from '../../../../services/rest/createCallApmApi';
 
diff --git a/x-pack/plugins/apm/public/components/shared/charts/latency_chart/index.tsx b/x-pack/plugins/apm/public/components/shared/charts/latency_chart/index.tsx
index 81965080240bf..1a89f070bb5cd 100644
--- a/x-pack/plugins/apm/public/components/shared/charts/latency_chart/index.tsx
+++ b/x-pack/plugins/apm/public/components/shared/charts/latency_chart/index.tsx
@@ -9,7 +9,7 @@ import { EuiFlexGroup, EuiFlexItem, EuiSelect, EuiTitle } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import React from 'react';
 import { useHistory } from 'react-router-dom';
-import { RULE_ID } from '../../../../../../rule_registry/common/technical_rule_data_field_names';
+import { RULE_ID } from '@kbn/rule-data-utils/target/technical_field_names';
 import { AlertType } from '../../../../../common/alert_types';
 import { useApmServiceContext } from '../../../../context/apm_service/use_apm_service_context';
 import { LatencyAggregationType } from '../../../../../common/latency_aggregation_types';
diff --git a/x-pack/plugins/apm/server/lib/alerts/register_error_count_alert_type.ts b/x-pack/plugins/apm/server/lib/alerts/register_error_count_alert_type.ts
index 992393f36631c..885b22ae343d8 100644
--- a/x-pack/plugins/apm/server/lib/alerts/register_error_count_alert_type.ts
+++ b/x-pack/plugins/apm/server/lib/alerts/register_error_count_alert_type.ts
@@ -10,7 +10,7 @@ import { take } from 'rxjs/operators';
 import {
   ALERT_EVALUATION_THRESHOLD,
   ALERT_EVALUATION_VALUE,
-} from '../../../../rule_registry/common/technical_rule_data_field_names';
+} from '@kbn/rule-data-utils/target/technical_field_names';
 import { createLifecycleRuleTypeFactory } from '../../../../rule_registry/server';
 import { ENVIRONMENT_NOT_DEFINED } from '../../../common/environment_filter_values';
 import { asMutableArray } from '../../../common/utils/as_mutable_array';
diff --git a/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_alert_type.ts b/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_alert_type.ts
index ec60ef7916e04..f77cc3ee930b1 100644
--- a/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_alert_type.ts
+++ b/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_alert_type.ts
@@ -11,7 +11,7 @@ import { QueryContainer } from '@elastic/elasticsearch/api/types';
 import {
   ALERT_EVALUATION_THRESHOLD,
   ALERT_EVALUATION_VALUE,
-} from '../../../../rule_registry/common/technical_rule_data_field_names';
+} from '@kbn/rule-data-utils/target/technical_field_names';
 import { createLifecycleRuleTypeFactory } from '../../../../rule_registry/server';
 import { parseEnvironmentUrlParam } from '../../../common/environment_filter_values';
 import { AlertType, ALERT_TYPES_CONFIG } from '../../../common/alert_types';
diff --git a/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_anomaly_alert_type.ts b/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_anomaly_alert_type.ts
index 5b093671f70f5..399fb9a216ef5 100644
--- a/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_anomaly_alert_type.ts
+++ b/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_anomaly_alert_type.ts
@@ -9,6 +9,12 @@ import { schema } from '@kbn/config-schema';
 import { compact } from 'lodash';
 import { ESSearchResponse } from 'typings/elasticsearch';
 import { QueryContainer } from '@elastic/elasticsearch/api/types';
+import {
+  ALERT_EVALUATION_THRESHOLD,
+  ALERT_EVALUATION_VALUE,
+  ALERT_SEVERITY_LEVEL,
+  ALERT_SEVERITY_VALUE,
+} from '@kbn/rule-data-utils/target/technical_field_names';
 import { createLifecycleRuleTypeFactory } from '../../../../rule_registry/server';
 import { ProcessorEvent } from '../../../common/processor_event';
 import { getSeverity } from '../../../common/anomaly_detection';
@@ -30,12 +36,6 @@ import { getMLJobs } from '../service_map/get_service_anomalies';
 import { apmActionVariables } from './action_variables';
 import { RegisterRuleDependencies } from './register_apm_alerts';
 import { parseEnvironmentUrlParam } from '../../../common/environment_filter_values';
-import {
-  ALERT_EVALUATION_THRESHOLD,
-  ALERT_EVALUATION_VALUE,
-  ALERT_SEVERITY_LEVEL,
-  ALERT_SEVERITY_VALUE,
-} from '../../../../rule_registry/common/technical_rule_data_field_names';
 
 const paramsSchema = schema.object({
   serviceName: schema.maybe(schema.string()),
diff --git a/x-pack/plugins/apm/server/lib/alerts/register_transaction_error_rate_alert_type.ts b/x-pack/plugins/apm/server/lib/alerts/register_transaction_error_rate_alert_type.ts
index 3c6197c8a02a1..4d6a0685fd379 100644
--- a/x-pack/plugins/apm/server/lib/alerts/register_transaction_error_rate_alert_type.ts
+++ b/x-pack/plugins/apm/server/lib/alerts/register_transaction_error_rate_alert_type.ts
@@ -10,7 +10,7 @@ import { take } from 'rxjs/operators';
 import {
   ALERT_EVALUATION_THRESHOLD,
   ALERT_EVALUATION_VALUE,
-} from '../../../../rule_registry/common/technical_rule_data_field_names';
+} from '@kbn/rule-data-utils/target/technical_field_names';
 import { createLifecycleRuleTypeFactory } from '../../../../rule_registry/server';
 import { AlertType, ALERT_TYPES_CONFIG } from '../../../common/alert_types';
 import {
diff --git a/x-pack/plugins/apm/server/lib/services/get_service_alerts.ts b/x-pack/plugins/apm/server/lib/services/get_service_alerts.ts
index 42a95afc65ad3..f58452ce4d916 100644
--- a/x-pack/plugins/apm/server/lib/services/get_service_alerts.ts
+++ b/x-pack/plugins/apm/server/lib/services/get_service_alerts.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { ALERT_UUID } from '../../../../rule_registry/common/technical_rule_data_field_names';
+import { ALERT_UUID } from '@kbn/rule-data-utils/target/technical_field_names';
 import { RuleDataClient } from '../../../../rule_registry/server';
 import {
   SERVICE_NAME,
diff --git a/x-pack/plugins/observability/public/pages/alerts/alerts_flyout/index.tsx b/x-pack/plugins/observability/public/pages/alerts/alerts_flyout/index.tsx
index 4856686f0495e..b4bf96bcc6905 100644
--- a/x-pack/plugins/observability/public/pages/alerts/alerts_flyout/index.tsx
+++ b/x-pack/plugins/observability/public/pages/alerts/alerts_flyout/index.tsx
@@ -22,7 +22,6 @@ import {
 import { i18n } from '@kbn/i18n';
 import moment from 'moment-timezone';
 import React from 'react';
-import { TopAlert } from '../';
 import {
   ALERT_DURATION,
   ALERT_EVALUATION_THRESHOLD,
@@ -30,7 +29,8 @@ import {
   ALERT_SEVERITY_LEVEL,
   RULE_CATEGORY,
   RULE_NAME,
-} from '../../../../../rule_registry/common/technical_rule_data_field_names';
+} from '@kbn/rule-data-utils/target/technical_field_names';
+import { TopAlert } from '../';
 import { useUiSetting } from '../../../../../../../src/plugins/kibana_react/public';
 import { asDuration } from '../../../../common/utils/formatters';
 import { usePluginContext } from '../../../hooks/use_plugin_context';
diff --git a/x-pack/plugins/observability/public/pages/alerts/alerts_table.tsx b/x-pack/plugins/observability/public/pages/alerts/alerts_table.tsx
index 5a7317da95f88..f377186623a03 100644
--- a/x-pack/plugins/observability/public/pages/alerts/alerts_table.tsx
+++ b/x-pack/plugins/observability/public/pages/alerts/alerts_table.tsx
@@ -19,7 +19,7 @@ import React, { useState } from 'react';
 import {
   ALERT_DURATION,
   ALERT_SEVERITY_LEVEL,
-} from '../../../../rule_registry/common/technical_rule_data_field_names';
+} from '@kbn/rule-data-utils/target/technical_field_names';
 import { asDuration } from '../../../common/utils/formatters';
 import { TimestampTooltip } from '../../components/shared/timestamp_tooltip';
 import { usePluginContext } from '../../hooks/use_plugin_context';
diff --git a/x-pack/plugins/observability/public/pages/alerts/index.tsx b/x-pack/plugins/observability/public/pages/alerts/index.tsx
index dac39fa3d3175..1f468a70d0976 100644
--- a/x-pack/plugins/observability/public/pages/alerts/index.tsx
+++ b/x-pack/plugins/observability/public/pages/alerts/index.tsx
@@ -17,17 +17,17 @@ import { i18n } from '@kbn/i18n';
 import React from 'react';
 import { useHistory } from 'react-router-dom';
 import { format, parse } from 'url';
-import { asDuration, asPercent } from '../../../common/utils/formatters';
-import {
-  ParsedTechnicalFields,
-  parseTechnicalFields,
-} from '../../../../rule_registry/common/parse_technical_fields';
 import {
   ALERT_START,
   EVENT_ACTION,
   RULE_ID,
   RULE_NAME,
-} from '../../../../rule_registry/common/technical_rule_data_field_names';
+} from '@kbn/rule-data-utils/target/technical_field_names';
+import {
+  ParsedTechnicalFields,
+  parseTechnicalFields,
+} from '../../../../rule_registry/common/parse_technical_fields';
+import { asDuration, asPercent } from '../../../common/utils/formatters';
 import { ExperimentalBadge } from '../../components/shared/experimental_badge';
 import { useFetcher } from '../../hooks/use_fetcher';
 import { usePluginContext } from '../../hooks/use_plugin_context';
diff --git a/x-pack/plugins/observability/server/lib/rules/get_top_alerts.ts b/x-pack/plugins/observability/server/lib/rules/get_top_alerts.ts
index 52043efc506e8..ddfc112ab1452 100644
--- a/x-pack/plugins/observability/server/lib/rules/get_top_alerts.ts
+++ b/x-pack/plugins/observability/server/lib/rules/get_top_alerts.ts
@@ -4,10 +4,7 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-import {
-  ALERT_UUID,
-  TIMESTAMP,
-} from '../../../../rule_registry/common/technical_rule_data_field_names';
+import { ALERT_UUID, TIMESTAMP } from '@kbn/rule-data-utils/target/technical_field_names';
 import { RuleDataClient } from '../../../../rule_registry/server';
 import { kqlQuery, rangeQuery } from '../../utils/queries';
 
diff --git a/x-pack/plugins/rule_registry/common/technical_rule_data_field_names.ts b/x-pack/plugins/rule_registry/common/technical_rule_data_field_names.ts
index e6ee7d1ea5376..5c954a31e79ac 100644
--- a/x-pack/plugins/rule_registry/common/technical_rule_data_field_names.ts
+++ b/x-pack/plugins/rule_registry/common/technical_rule_data_field_names.ts
@@ -5,72 +5,4 @@
  * 2.0.
  */
 
-import { ValuesType } from 'utility-types';
-
-const ALERT_NAMESPACE = 'kibana.rac.alert';
-
-const TIMESTAMP = '@timestamp' as const;
-const EVENT_KIND = 'event.kind' as const;
-const EVENT_ACTION = 'event.action' as const;
-const RULE_UUID = 'rule.uuid' as const;
-const RULE_ID = 'rule.id' as const;
-const RULE_NAME = 'rule.name' as const;
-const RULE_CATEGORY = 'rule.category' as const;
-const TAGS = 'tags' as const;
-const PRODUCER = `${ALERT_NAMESPACE}.producer` as const;
-const ALERT_ID = `${ALERT_NAMESPACE}.id` as const;
-const ALERT_UUID = `${ALERT_NAMESPACE}.uuid` as const;
-const ALERT_START = `${ALERT_NAMESPACE}.start` as const;
-const ALERT_END = `${ALERT_NAMESPACE}.end` as const;
-const ALERT_DURATION = `${ALERT_NAMESPACE}.duration.us` as const;
-const ALERT_SEVERITY_LEVEL = `${ALERT_NAMESPACE}.severity.level` as const;
-const ALERT_SEVERITY_VALUE = `${ALERT_NAMESPACE}.severity.value` as const;
-const ALERT_STATUS = `${ALERT_NAMESPACE}.status` as const;
-const ALERT_EVALUATION_THRESHOLD = `${ALERT_NAMESPACE}.evaluation.threshold` as const;
-const ALERT_EVALUATION_VALUE = `${ALERT_NAMESPACE}.evaluation.value` as const;
-
-const fields = {
-  TIMESTAMP,
-  EVENT_KIND,
-  EVENT_ACTION,
-  RULE_UUID,
-  RULE_ID,
-  RULE_NAME,
-  RULE_CATEGORY,
-  TAGS,
-  PRODUCER,
-  ALERT_ID,
-  ALERT_UUID,
-  ALERT_START,
-  ALERT_END,
-  ALERT_DURATION,
-  ALERT_SEVERITY_LEVEL,
-  ALERT_SEVERITY_VALUE,
-  ALERT_STATUS,
-  ALERT_EVALUATION_THRESHOLD,
-  ALERT_EVALUATION_VALUE,
-};
-
-export {
-  TIMESTAMP,
-  EVENT_KIND,
-  EVENT_ACTION,
-  RULE_UUID,
-  RULE_ID,
-  RULE_NAME,
-  RULE_CATEGORY,
-  TAGS,
-  PRODUCER,
-  ALERT_ID,
-  ALERT_UUID,
-  ALERT_START,
-  ALERT_END,
-  ALERT_DURATION,
-  ALERT_SEVERITY_LEVEL,
-  ALERT_SEVERITY_VALUE,
-  ALERT_STATUS,
-  ALERT_EVALUATION_THRESHOLD,
-  ALERT_EVALUATION_VALUE,
-};
-
-export type TechnicalRuleDataFieldName = ValuesType<typeof fields>;
+export * from '@kbn/rule-data-utils/target/technical_field_names';
diff --git a/yarn.lock b/yarn.lock
index ccf722c7728f4..e25139ba696d7 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2698,6 +2698,10 @@
   version "0.0.0"
   uid ""
 
+"@kbn/rule-data-utils@link:packages/kbn-rule-data-utils":
+  version "0.0.0"
+  uid ""
+
 "@kbn/securitysolution-constants@link:bazel-bin/packages/kbn-securitysolution-constants/npm_module":
   version "0.0.0"
   uid ""

From de8e3dbde1689a54d7ff22b95c90e42e76b7cfe7 Mon Sep 17 00:00:00 2001
From: Dario Gieselaar <dario.gieselaar@elastic.co>
Date: Wed, 12 May 2021 10:35:01 +0200
Subject: [PATCH 43/54] Undo change to TM, fix ES type

---
 typings/elasticsearch/search.d.ts                         | 2 +-
 x-pack/plugins/alerting/server/task_runner/task_runner.ts | 1 -
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/typings/elasticsearch/search.d.ts b/typings/elasticsearch/search.d.ts
index 6f427348a5286..d75f31d388176 100644
--- a/typings/elasticsearch/search.d.ts
+++ b/typings/elasticsearch/search.d.ts
@@ -49,7 +49,7 @@ type ValueTypeOfField<T> = T extends Record<string, string | number>
 
 type MaybeArray<T> = T | T[];
 
-type Fields = Required<estypes.SearchRequest>['body']['fields'];
+type Fields = Exclude<Required<estypes.SearchRequest>['body']['fields'], undefined>;
 type DocValueFields = MaybeArray<string | estypes.DocValueField>;
 
 export type SearchHit<
diff --git a/x-pack/plugins/alerting/server/task_runner/task_runner.ts b/x-pack/plugins/alerting/server/task_runner/task_runner.ts
index d3b0231f5cd55..8c3d22eeb2e7f 100644
--- a/x-pack/plugins/alerting/server/task_runner/task_runner.ts
+++ b/x-pack/plugins/alerting/server/task_runner/task_runner.ts
@@ -547,7 +547,6 @@ export class TaskRunner<
           if (isAlertSavedObjectNotFoundError(err, alertId)) {
             this.logger.debug(message);
           } else {
-            this.logger.error(require('util').inspect(err, { depth: null }));
             this.logger.error(message);
           }
           return originalState;

From 5f3ae69ee2a1b7cee9d8b7102f0fa0fa3ecfec28 Mon Sep 17 00:00:00 2001
From: Dario Gieselaar <dario.gieselaar@elastic.co>
Date: Wed, 12 May 2021 11:23:45 +0200
Subject: [PATCH 44/54] Update readme

---
 x-pack/plugins/rule_registry/README.md        | 141 +++++++++++++-----
 x-pack/plugins/rule_registry/common/assets.ts |   2 -
 x-pack/plugins/rule_registry/server/index.ts  |   5 +-
 x-pack/plugins/rule_registry/server/plugin.ts |   5 +-
 .../server/rule_data_plugin_service/index.ts  |   5 +-
 .../test/apm_api_integration/configs/index.ts |   3 -
 6 files changed, 111 insertions(+), 50 deletions(-)

diff --git a/x-pack/plugins/rule_registry/README.md b/x-pack/plugins/rule_registry/README.md
index 26f5c780c10aa..e12c2b29ed373 100644
--- a/x-pack/plugins/rule_registry/README.md
+++ b/x-pack/plugins/rule_registry/README.md
@@ -2,62 +2,129 @@
 
 The rule registry plugin aims to make it easy for rule type producers to have their rules produce the data that they need to build rich experiences on top of a unified experience, without the risk of mapping conflicts.
 
-A rule registry creates a template, an ILM policy, and an alias. The template mappings can be configured. It also injects a client scoped to these indices.
+The plugin installs default component templates and a default lifecycle policy that rule type producers can use to create index templates.
 
-It also supports inheritance, which means that producers can create a registry specific to their solution or rule type, and specify additional mappings to be used.
+It also exposes a rule data client that will create or update the index stream that rules will write data to. It will not do so on plugin setup or start, but only when data is written.
 
-The rule registry plugin creates a root rule registry, with the mappings defined needed to create a unified experience. Rule type producers can use the plugin to access the root rule registry, and create their own registry that branches off of the root rule registry. The rule registry client sees data from its own registry, and all registries that branches off of it. It does not see data from its parents.
+## Configuration
 
-## Enabling writing
-
-Set
+By default, these indices will be prefixed with `.alerts`. To change this, for instance to support legacy multitenancy, set the following configuration option:
 
 ```yaml
-xpack.ruleRegistry.unsafe.write.enabled: true
+xpack.ruleRegistry.index: '.kibana-alerts'
 ```
 
-in your Kibana configuration to allow the Rule Registry to write events to the alert indices.
+To disable writing entirely:
+
+```yaml
+xpack.ruleRegistry.write.enabled: false
+```
 
-## Creating a rule registry
+## Setting up the index template
 
-To create a rule registry, producers should add the `ruleRegistry` plugin to their dependencies. They can then use the `ruleRegistry.create` method to create a child registry, with the additional mappings that should be used by specifying `fieldMap`:
+On plugin setup, rule type producers can create the index template as follows:
 
 ```ts
-const observabilityRegistry = plugins.ruleRegistry.create({
-  name: 'observability',
-  fieldMap: {
-    ...pickWithPatterns(ecsFieldMap, 'host.name', 'service.name'),
-  },
-});
-```
+// get the FQN of the component template. All assets are prefixed with the configured `index` value, which is `.alerts` by default.
 
-`fieldMap` is a key-value map of field names and mapping options:
+const componentTemplateName = plugins.ruleRegistry.getFullAssetName(
+  'apm-mappings'
+);
 
-```ts
-{
-  '@timestamp': {
-    type: 'date',
-    array: false,
-    required: true,
-  }
+// if write is disabled, don't install these templates
+if (!plugins.ruleRegistry.isWriteEnabled()) {
+  return;
 }
-```
 
-ECS mappings are generated via a script in the rule registry plugin directory. These mappings are available in x-pack/plugins/rule_registry/server/generated/ecs_field_map.ts.
-
-To pick many fields, you can use `pickWithPatterns`, which supports wildcards with full type support.
+// create or update the component template that should be used
+await plugins.ruleRegistry.createOrUpdateComponentTemplate({
+  name: componentTemplateName,
+  body: {
+    template: {
+      settings: {
+        number_of_shards: 1,
+      },
+      // mappingFromFieldMap is a utility function that will generate an
+      // ES mapping from a field map object. You can also define a literal
+      // mapping.
+      mappings: mappingFromFieldMap({
+        [SERVICE_NAME]: {
+          type: 'keyword',
+        },
+        [SERVICE_ENVIRONMENT]: {
+          type: 'keyword',
+        },
+        [TRANSACTION_TYPE]: {
+          type: 'keyword',
+        },
+        [PROCESSOR_EVENT]: {
+          type: 'keyword',
+        },
+      }),
+    },
+  },
+});
 
-If a registry is created, it will initialise as soon as the core services needed become available. It will create a (versioned) template, alias, and ILM policy, but only if these do not exist yet.
+// Install the index template, that is composed of the component template
+// defined above, and others. It is important that the technical component
+// template is included. This will ensure functional compatibility across
+// rule types, for a future scenario where a user will want to "point" the
+// data from a rule to a different index.
+await plugins.ruleRegistry.createOrUpdateIndexTemplate({
+  name: plugins.ruleRegistry.getFullAssetName('apm-index-template'),
+  body: {
+    index_patterns: [
+      plugins.ruleRegistry.getFullAssetName('observability-apm*'),
+    ],
+    composed_of: [
+      // Technical component template, required
+      plugins.ruleRegistry.getFullAssetName(
+        TECHNICAL_COMPONENT_TEMPLATE_NAME
+      ),
+      componentTemplateName,
+    ],
+  },
+});
 
-## Rule registry client
+// Finally, create the rule data client that can be injected into rule type
+// executors and API endpoints
+const ruleDataClient = new RuleDataClient({
+  alias: plugins.ruleRegistry.getFullAssetName('observability-apm'),
+  getClusterClient: async () => {
+    const coreStart = await getCoreStart();
+    return coreStart.elasticsearch.client.asInternalUser;
+  },
+  ready,
+});
 
-The rule registry client can either be injected in the executor, or created in the scope of a request. It exposes a `search` method and a `bulkIndex` method. When `search` is called, it first gets all the rules the current user has access to, and adds these ids to the search request that it executes. This means that the user can only see data from rules they have access to.
+// to start writing data, call `getWriter().bulk()`. It supports a `namespace`
+// property as well, that for instance can be used to write data to a space-specific
+// index.
+await ruleDataClient.getWriter().bulk({
+  body: eventsToIndex.flatMap((event) => [{ index: {} }, event]),
+});
 
-Both `search` and `bulkIndex` are fully typed, in the sense that they reflect the mappings defined for the registry.
+// to read data, simply call ruleDataClient.getReader().search:
+const response = await ruleDataClient.getReader().search({
+  body: {
+    query: {
+    },
+    size: 100,
+    fields: ['*'],
+    collapse: {
+      field: ALERT_UUID,
+    },
+    sort: {
+      '@timestamp': 'desc',
+    },
+  },
+  allow_no_indices: true,
+});
+```
 
 ## Schema
 
-The following fields are available in the root rule registry:
+The following fields are defined in the technical field component template and should always be used:
 
 - `@timestamp`: the ISO timestamp of the alert event. For the lifecycle rule type helper, it is always the value of `startedAt` that is injected by the Kibana alerting framework.
 - `event.kind`: signal (for the changeable alert document), state (for the state changes of the alert, e.g. when it opens, recovers, or changes in severity), or metric (individual evaluations that might be related to an alert).
@@ -67,7 +134,7 @@ The following fields are available in the root rule registry:
 - `rule.uuid`: the saved objects id of the rule.
 - `rule.name`: the name of the rule (as specified by the user).
 - `rule.category`: the name of the rule type (as defined by the rule type producer)
-- `kibana.rac.producer`: the producer of the rule type. Usually a Kibana plugin. e.g., `APM`.
+- `kibana.rac.alert.producer`: the producer of the rule type. Usually a Kibana plugin. e.g., `APM`.
 - `kibana.rac.alert.id`: the id of the alert, that is unique within the context of the rule execution it was created in. E.g., for a rule that monitors latency for all services in all environments, this might be `opbeans-java:production`.
 - `kibana.rac.alert.uuid`: the unique identifier for the alert during its lifespan. If an alert recovers (or closes), this identifier is re-generated when it is opened again.
 - `kibana.rac.alert.status`: the status of the alert. Can be `open` or `closed`.
@@ -76,8 +143,8 @@ The following fields are available in the root rule registry:
 - `kibana.rac.alert.duration.us`: the duration of the alert, in microseconds. This is always the difference between either the current time, or the time when the alert recovered.
 - `kibana.rac.alert.severity.level`: the severity of the alert, as a keyword (e.g. critical).
 - `kibana.rac.alert.severity.value`: the severity of the alert, as a numerical value, which allows sorting.
+- `kibana.rac.alert.evaluation.value`: The measured (numerical value).
+- `kibana.rac.alert.threshold.value`: The threshold that was defined (or, in case of multiple thresholds, the one that was exceeded).
 - `kibana.rac.alert.ancestors`: the array of ancestors (if any) for the alert.
 - `kibana.rac.alert.depth`: the depth of the alert in the ancestral tree (default 0).
 - `kibana.rac.alert.building_block_type`: the building block type of the alert (default undefined).
-
-This list is not final - just a start. Field names might change or moved to a scoped registry. If we implement log and sequence based rule types the list of fields will grow. If a rule type needs additional fields, the recommendation would be to have the field in its own registry first (or in its producer’s registry), and if usage is more broadly adopted, it can be moved to the root registry.
diff --git a/x-pack/plugins/rule_registry/common/assets.ts b/x-pack/plugins/rule_registry/common/assets.ts
index ddc425f068c5a..1a5b14c605ea5 100644
--- a/x-pack/plugins/rule_registry/common/assets.ts
+++ b/x-pack/plugins/rule_registry/common/assets.ts
@@ -5,8 +5,6 @@
  * 2.0.
  */
 
-export const DEFAULT_ASSET_NAMESPACE = 'alerts';
-
 export const TECHNICAL_COMPONENT_TEMPLATE_NAME = `technical-mappings`;
 export const ECS_COMPONENT_TEMPLATE_NAME = `ecs-mappings`;
 export const DEFAULT_ILM_POLICY_ID = 'ilm-policy';
diff --git a/x-pack/plugins/rule_registry/server/index.ts b/x-pack/plugins/rule_registry/server/index.ts
index 70493fcff6671..ca0fe4a06716a 100644
--- a/x-pack/plugins/rule_registry/server/index.ts
+++ b/x-pack/plugins/rule_registry/server/index.ts
@@ -19,9 +19,10 @@ export { createPersistenceRuleTypeFactory } from './utils/create_persistence_rul
 export const config = {
   schema: schema.object({
     enabled: schema.boolean({ defaultValue: true }),
-    unsafe: schema.object({
-      write: schema.object({ enabled: schema.boolean({ defaultValue: false }) }),
+    write: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
     }),
+    index: schema.string({ defaultValue: '.alerts' }),
   }),
 };
 
diff --git a/x-pack/plugins/rule_registry/server/plugin.ts b/x-pack/plugins/rule_registry/server/plugin.ts
index 86eaa1661a884..3c645f98f5c71 100644
--- a/x-pack/plugins/rule_registry/server/plugin.ts
+++ b/x-pack/plugins/rule_registry/server/plugin.ts
@@ -18,15 +18,14 @@ export class RuleRegistryPlugin implements Plugin<RuleRegistryPluginSetupContrac
   }
 
   public setup(core: CoreSetup): RuleRegistryPluginSetupContract {
-    const globalConfig = this.initContext.config.legacy.get();
     const config = this.initContext.config.get<RuleRegistryPluginConfig>();
 
     const logger = this.initContext.logger.get();
 
     const service = new RuleDataPluginService({
       logger,
-      isWriteEnabled: config.unsafe.write.enabled,
-      kibanaIndex: globalConfig.kibana.index,
+      isWriteEnabled: config.write.enabled,
+      index: config.index,
       getClusterClient: async () => {
         const [coreStart] = await core.getStartServices();
 
diff --git a/x-pack/plugins/rule_registry/server/rule_data_plugin_service/index.ts b/x-pack/plugins/rule_registry/server/rule_data_plugin_service/index.ts
index f8a3ae6d4d8c2..159e9b8152597 100644
--- a/x-pack/plugins/rule_registry/server/rule_data_plugin_service/index.ts
+++ b/x-pack/plugins/rule_registry/server/rule_data_plugin_service/index.ts
@@ -7,7 +7,6 @@
 import { ClusterPutComponentTemplate } from '@elastic/elasticsearch/api/requestParams';
 import { estypes } from '@elastic/elasticsearch';
 import { ElasticsearchClient, Logger } from 'kibana/server';
-import { DEFAULT_ASSET_NAMESPACE } from '../../common/assets';
 import { technicalComponentTemplate } from '../../common/assets/component_templates/technical_component_template';
 import {
   DEFAULT_ILM_POLICY_ID,
@@ -24,7 +23,7 @@ interface RuleDataPluginServiceConstructorOptions {
   getClusterClient: () => Promise<ElasticsearchClient>;
   logger: Logger;
   isWriteEnabled: boolean;
-  kibanaIndex: string;
+  index: string;
 }
 
 function createSignal() {
@@ -154,6 +153,6 @@ export class RuleDataPluginService {
   }
 
   getFullAssetName(assetName?: string) {
-    return [this.options.kibanaIndex, DEFAULT_ASSET_NAMESPACE, assetName].filter(Boolean).join('-');
+    return [this.options.index, assetName].filter(Boolean).join('-');
   }
 }
diff --git a/x-pack/test/apm_api_integration/configs/index.ts b/x-pack/test/apm_api_integration/configs/index.ts
index 97d18c2419840..0d28e69170300 100644
--- a/x-pack/test/apm_api_integration/configs/index.ts
+++ b/x-pack/test/apm_api_integration/configs/index.ts
@@ -17,9 +17,6 @@ const apmFtrConfigs = {
   },
   rules: {
     license: 'trial' as const,
-    kibanaConfig: {
-      'xpack.ruleRegistry.unsafe.write.enabled': 'true',
-    },
   },
 };
 

From a59092df5c729c5ac619b5ac040e9ec55fb5827a Mon Sep 17 00:00:00 2001
From: Dario Gieselaar <dario.gieselaar@elastic.co>
Date: Wed, 12 May 2021 12:17:32 +0200
Subject: [PATCH 45/54] Use .kibana-alerts in tests

---
 x-pack/test/apm_api_integration/configs/index.ts              | 3 +++
 x-pack/test/apm_api_integration/tests/alerts/rule_registry.ts | 1 -
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/x-pack/test/apm_api_integration/configs/index.ts b/x-pack/test/apm_api_integration/configs/index.ts
index 0d28e69170300..3393580153215 100644
--- a/x-pack/test/apm_api_integration/configs/index.ts
+++ b/x-pack/test/apm_api_integration/configs/index.ts
@@ -17,6 +17,9 @@ const apmFtrConfigs = {
   },
   rules: {
     license: 'trial' as const,
+    kibanaConfig: {
+      'xpack.ruleRegistry.index': '.kibana-alerts',
+    },
   },
 };
 
diff --git a/x-pack/test/apm_api_integration/tests/alerts/rule_registry.ts b/x-pack/test/apm_api_integration/tests/alerts/rule_registry.ts
index f7b8b34d88c01..e0a3e4d3a3f8b 100644
--- a/x-pack/test/apm_api_integration/tests/alerts/rule_registry.ts
+++ b/x-pack/test/apm_api_integration/tests/alerts/rule_registry.ts
@@ -266,7 +266,6 @@ export default function ApiTest({ getService }: FtrProviderContext) {
               '@timestamp': 'desc',
             },
           },
-          allow_no_indices: true,
         });
 
         expect(beforeDataResponse.body.hits.hits.length).to.be(0);

From 4ebe61fbf3f98e4c04bff3780ee8cf62418e9d32 Mon Sep 17 00:00:00 2001
From: Madison Caldwell <madison.caldwell@elastic.co>
Date: Wed, 12 May 2021 13:08:03 -0400
Subject: [PATCH 46/54] Fix tests

---
 .../security_solution/public/common/mock/test_providers.tsx | 5 ++++-
 .../detection_engine/alerts/use_signal_index.test.tsx       | 6 ------
 2 files changed, 4 insertions(+), 7 deletions(-)

diff --git a/x-pack/plugins/security_solution/public/common/mock/test_providers.tsx b/x-pack/plugins/security_solution/public/common/mock/test_providers.tsx
index c18eb8dc704a9..8f89e53449293 100644
--- a/x-pack/plugins/security_solution/public/common/mock/test_providers.tsx
+++ b/x-pack/plugins/security_solution/public/common/mock/test_providers.tsx
@@ -24,6 +24,7 @@ import {
 import { FieldHook } from '../../shared_imports';
 import { SUB_PLUGINS_REDUCER } from './utils';
 import { createSecuritySolutionStorageMock, localStorageMock } from './mock_local_storage';
+import { UserPrivilegesProvider } from '../../detections/components/user_privileges';
 
 const state: State = mockGlobalState;
 
@@ -52,7 +53,9 @@ const TestProvidersComponent: React.FC<Props> = ({
     <MockKibanaContextProvider>
       <ReduxStoreProvider store={store}>
         <ThemeProvider theme={() => ({ eui: euiDarkVars, darkMode: true })}>
-          <DragDropContext onDragEnd={onDragEnd}>{children}</DragDropContext>
+          <UserPrivilegesProvider>
+            <DragDropContext onDragEnd={onDragEnd}>{children}</DragDropContext>
+          </UserPrivilegesProvider>
         </ThemeProvider>
       </ReduxStoreProvider>
     </MockKibanaContextProvider>
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_signal_index.test.tsx b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_signal_index.test.tsx
index 7bf0abda7da1b..76811cecce8b8 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_signal_index.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_signal_index.test.tsx
@@ -4,22 +4,16 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-import React from 'react';
 import { renderHook, act } from '@testing-library/react-hooks';
 import { TestProviders } from '../../../../common/mock';
 import { useSignalIndex, ReturnSignalIndex } from './use_signal_index';
 import * as api from './api';
 import { useAppToastsMock } from '../../../../common/hooks/use_app_toasts.mock';
 import { useAppToasts } from '../../../../common/hooks/use_app_toasts';
-import { UserPrivilegesProvider } from '../../../components/user_privileges';
 
 jest.mock('./api');
 jest.mock('../../../../common/hooks/use_app_toasts');
 
-const Wrapper = ({ children }: { children?: React.ReactNode }) => (
-  <UserPrivilegesProvider>{children}</UserPrivilegesProvider>
-);
-
 describe('useSignalIndex', () => {
   let appToastsMock: jest.Mocked<ReturnType<typeof useAppToastsMock.create>>;
 

From 5ec338b66cf401a8586ee7e7298460fda83d8baf Mon Sep 17 00:00:00 2001
From: Madison Caldwell <madison.caldwell@elastic.co>
Date: Wed, 12 May 2021 16:38:56 -0400
Subject: [PATCH 47/54] Fix tests

---
 .../public/common/mock/test_providers.tsx     | 21 +++++++++++++++++++
 .../alerts/use_signal_index.test.tsx          | 14 ++++++-------
 .../routes/rules/create_rules_route.ts        |  2 +-
 .../routes/rules/delete_rules_route.ts        |  2 +-
 .../routes/rules/find_rules_route.ts          |  2 +-
 .../routes/rules/patch_rules_route.ts         |  2 +-
 .../routes/rules/read_rules_route.ts          |  2 +-
 .../routes/rules/update_rules_route.ts        |  2 +-
 8 files changed, 34 insertions(+), 13 deletions(-)

diff --git a/x-pack/plugins/security_solution/public/common/mock/test_providers.tsx b/x-pack/plugins/security_solution/public/common/mock/test_providers.tsx
index 8f89e53449293..9ac7ae0f24322 100644
--- a/x-pack/plugins/security_solution/public/common/mock/test_providers.tsx
+++ b/x-pack/plugins/security_solution/public/common/mock/test_providers.tsx
@@ -48,6 +48,26 @@ const TestProvidersComponent: React.FC<Props> = ({
   children,
   store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage),
   onDragEnd = jest.fn(),
+}) => (
+  <I18nProvider>
+    <MockKibanaContextProvider>
+      <ReduxStoreProvider store={store}>
+        <ThemeProvider theme={() => ({ eui: euiDarkVars, darkMode: true })}>
+          <DragDropContext onDragEnd={onDragEnd}>{children}</DragDropContext>
+        </ThemeProvider>
+      </ReduxStoreProvider>
+    </MockKibanaContextProvider>
+  </I18nProvider>
+);
+
+/**
+ * A utility for wrapping children in the providers required to run most tests
+ * WITH user privileges provider.
+ */
+const TestProvidersWithPrivilegesComponent: React.FC<Props> = ({
+  children,
+  store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage),
+  onDragEnd = jest.fn(),
 }) => (
   <I18nProvider>
     <MockKibanaContextProvider>
@@ -63,6 +83,7 @@ const TestProvidersComponent: React.FC<Props> = ({
 );
 
 export const TestProviders = React.memo(TestProvidersComponent);
+export const TestProvidersWithPrivileges = React.memo(TestProvidersWithPrivilegesComponent);
 
 export const useFormFieldMock = <T,>(options?: Partial<FieldHook<T>>): FieldHook<T> => {
   return {
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_signal_index.test.tsx b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_signal_index.test.tsx
index 76811cecce8b8..ce262ce4f9a2e 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_signal_index.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_signal_index.test.tsx
@@ -5,7 +5,7 @@
  * 2.0.
  */
 import { renderHook, act } from '@testing-library/react-hooks';
-import { TestProviders } from '../../../../common/mock';
+import { TestProvidersWithPrivileges } from '../../../../common/mock';
 import { useSignalIndex, ReturnSignalIndex } from './use_signal_index';
 import * as api from './api';
 import { useAppToastsMock } from '../../../../common/hooks/use_app_toasts.mock';
@@ -29,7 +29,7 @@ describe('useSignalIndex', () => {
       const { result, waitForNextUpdate } = renderHook<void, ReturnSignalIndex>(
         () => useSignalIndex(),
         {
-          wrapper: TestProviders,
+          wrapper: TestProvidersWithPrivileges,
         }
       );
       await waitForNextUpdate();
@@ -48,7 +48,7 @@ describe('useSignalIndex', () => {
       const { result, waitForNextUpdate } = renderHook<void, ReturnSignalIndex>(
         () => useSignalIndex(),
         {
-          wrapper: TestProviders,
+          wrapper: TestProvidersWithPrivileges,
         }
       );
       await waitForNextUpdate();
@@ -69,7 +69,7 @@ describe('useSignalIndex', () => {
       const { result, waitForNextUpdate } = renderHook<void, ReturnSignalIndex>(
         () => useSignalIndex(),
         {
-          wrapper: TestProviders,
+          wrapper: TestProvidersWithPrivileges,
         }
       );
       await waitForNextUpdate();
@@ -95,7 +95,7 @@ describe('useSignalIndex', () => {
       const { result, waitForNextUpdate } = renderHook<void, ReturnSignalIndex>(
         () => useSignalIndex(),
         {
-          wrapper: TestProviders,
+          wrapper: TestProvidersWithPrivileges,
         }
       );
       await waitForNextUpdate();
@@ -118,7 +118,7 @@ describe('useSignalIndex', () => {
       const { result, waitForNextUpdate } = renderHook<void, ReturnSignalIndex>(
         () => useSignalIndex(),
         {
-          wrapper: TestProviders,
+          wrapper: TestProvidersWithPrivileges,
         }
       );
       await waitForNextUpdate();
@@ -146,7 +146,7 @@ describe('useSignalIndex', () => {
       const { result, waitForNextUpdate } = renderHook<void, ReturnSignalIndex>(
         () => useSignalIndex(),
         {
-          wrapper: TestProviders,
+          wrapper: TestProvidersWithPrivileges,
         }
       );
       await waitForNextUpdate();
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/create_rules_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/create_rules_route.ts
index cdd344ecfb111..1a207c075a1e9 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/create_rules_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/create_rules_route.ts
@@ -25,7 +25,7 @@ import { convertCreateAPIToInternalSchema } from '../../schemas/rule_converters'
 export const createRulesRoute = (
   router: SecuritySolutionPluginRouter,
   ml: SetupPlugins['ml'],
-  ruleDataClient: RuleDataClient | null
+  ruleDataClient?: RuleDataClient | null
 ): void => {
   router.post(
     {
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/delete_rules_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/delete_rules_route.ts
index bb8699fa024fd..9498a6df16f7a 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/delete_rules_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/delete_rules_route.ts
@@ -23,7 +23,7 @@ import { ruleStatusSavedObjectsClientFactory } from '../../signals/rule_status_s
 
 export const deleteRulesRoute = (
   router: SecuritySolutionPluginRouter,
-  ruleDataClient: RuleDataClient | null
+  ruleDataClient?: RuleDataClient | null
 ) => {
   router.delete(
     {
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/find_rules_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/find_rules_route.ts
index ad5661ceb0f67..3958e3613fe8e 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/find_rules_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/find_rules_route.ts
@@ -22,7 +22,7 @@ import { transformFindAlerts } from './utils';
 
 export const findRulesRoute = (
   router: SecuritySolutionPluginRouter,
-  ruleDataClient: RuleDataClient | null
+  ruleDataClient?: RuleDataClient | null
 ) => {
   router.get(
     {
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/patch_rules_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/patch_rules_route.ts
index f14840fedd4e0..1c031e9fd46e8 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/patch_rules_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/patch_rules_route.ts
@@ -30,7 +30,7 @@ import { PartialFilter } from '../../types';
 export const patchRulesRoute = (
   router: SecuritySolutionPluginRouter,
   ml: SetupPlugins['ml'],
-  ruleDataClient: RuleDataClient | null
+  ruleDataClient?: RuleDataClient | null
 ) => {
   router.patch(
     {
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/read_rules_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/read_rules_route.ts
index dd4170c01991d..dd80f34e5de18 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/read_rules_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/read_rules_route.ts
@@ -22,7 +22,7 @@ import { ruleStatusSavedObjectsClientFactory } from '../../signals/rule_status_s
 
 export const readRulesRoute = (
   router: SecuritySolutionPluginRouter,
-  ruleDataClient: RuleDataClient | null
+  ruleDataClient?: RuleDataClient | null
 ) => {
   router.get(
     {
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_route.ts
index 25d925b7772bb..257738dd7d4f9 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_route.ts
@@ -24,7 +24,7 @@ import { buildRouteValidation } from '../../../../utils/build_validation/route_v
 export const updateRulesRoute = (
   router: SecuritySolutionPluginRouter,
   ml: SetupPlugins['ml'],
-  ruleDataClient: RuleDataClient | null
+  ruleDataClient?: RuleDataClient | null
 ) => {
   router.put(
     {

From ae897538e00ec5804b0c4138da859fbf6ee374c8 Mon Sep 17 00:00:00 2001
From: Madison Caldwell <madison.caldwell@elastic.co>
Date: Wed, 12 May 2021 17:16:52 -0400
Subject: [PATCH 48/54] Fix test

---
 .../security_solution/factory/hosts/details/index.test.tsx       | 1 +
 1 file changed, 1 insertion(+)

diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/index.test.tsx b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/index.test.tsx
index 4474b9f288570..8b4500a54feaa 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/index.test.tsx
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/index.test.tsx
@@ -34,6 +34,7 @@ const mockDeps = {
       metricsEntitiesEnabled: false,
       eventFilteringEnabled: false,
       hostIsolationEnabled: false,
+      ruleRegistryEnabled: false,
     },
     service: {} as EndpointAppContextService,
   } as EndpointAppContext,

From 833b2731f5149d2cd03ddf639c30d98e0d2947b3 Mon Sep 17 00:00:00 2001
From: Madison Caldwell <madison.caldwell@elastic.co>
Date: Thu, 13 May 2021 16:22:07 -0400
Subject: [PATCH 49/54] Missed a conflict

---
 x-pack/plugins/rule_registry/common/assets.ts | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/x-pack/plugins/rule_registry/common/assets.ts b/x-pack/plugins/rule_registry/common/assets.ts
index 7704102e4de22..1a5b14c605ea5 100644
--- a/x-pack/plugins/rule_registry/common/assets.ts
+++ b/x-pack/plugins/rule_registry/common/assets.ts
@@ -5,18 +5,6 @@
  * 2.0.
  */
 
-<<<<<<< HEAD
-<<<<<<< HEAD:x-pack/plugins/rule_registry/common/assets.ts
 export const TECHNICAL_COMPONENT_TEMPLATE_NAME = `technical-mappings`;
 export const ECS_COMPONENT_TEMPLATE_NAME = `ecs-mappings`;
 export const DEFAULT_ILM_POLICY_ID = 'ilm-policy';
-=======
-export { SchemaCallouts } from './schema_callouts';
-export { SchemaTable } from './schema_table';
-export { EmptyState } from './empty_state';
->>>>>>> 548765770522f1a60bd378269957eb4bebd0fd49:x-pack/plugins/enterprise_search/public/applications/app_search/components/schema/components/index.ts
-=======
-export const TECHNICAL_COMPONENT_TEMPLATE_NAME = `technical-mappings`;
-export const ECS_COMPONENT_TEMPLATE_NAME = `ecs-mappings`;
-export const DEFAULT_ILM_POLICY_ID = 'ilm-policy';
->>>>>>> 548765770522f1a60bd378269957eb4bebd0fd49

From 1850bba1f210145d139cf3cccc65e74df58d6d7b Mon Sep 17 00:00:00 2001
From: Madison Caldwell <madison.caldwell@elastic.co>
Date: Thu, 13 May 2021 16:23:34 -0400
Subject: [PATCH 50/54] And another one

---
 .../app_search/components/schema/components/index.ts        | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/schema/components/index.ts b/x-pack/plugins/enterprise_search/public/applications/app_search/components/schema/components/index.ts
index 6a2d1d1dee76f..7da44849b5bc0 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/schema/components/index.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/schema/components/index.ts
@@ -5,12 +5,6 @@
  * 2.0.
  */
 
-<<<<<<< HEAD:x-pack/plugins/rule_registry/common/assets.ts
-export const TECHNICAL_COMPONENT_TEMPLATE_NAME = `technical-mappings`;
-export const ECS_COMPONENT_TEMPLATE_NAME = `ecs-mappings`;
-export const DEFAULT_ILM_POLICY_ID = 'ilm-policy';
-=======
 export { SchemaCallouts } from './schema_callouts';
 export { SchemaTable } from './schema_table';
 export { EmptyState } from './empty_state';
->>>>>>> 548765770522f1a60bd378269957eb4bebd0fd49:x-pack/plugins/enterprise_search/public/applications/app_search/components/schema/components/index.ts

From 9e213fb7a5a0337591a50a0567924ebe950b9791 Mon Sep 17 00:00:00 2001
From: Garrett Spong <garrett.spong@elastic.co>
Date: Fri, 14 May 2021 17:16:08 -0600
Subject: [PATCH 51/54] Fixes cypress tests, rule create scripts, updates docs,
 and replaces DEFAULT_ALERT_INDEX on plugin start

---
 api_docs/alerting.json                        |   10 +-
 api_docs/cases.json                           |  881 ++++++++-
 api_docs/core.json                            |  367 +++-
 api_docs/core_application.json                |    6 +-
 api_docs/core_saved_objects.json              | 1715 ++++++++++-------
 api_docs/dashboard.json                       |    4 +-
 api_docs/data.json                            |   28 +-
 api_docs/data_index_patterns.json             |    2 +-
 api_docs/data_search.json                     |   85 +-
 api_docs/deprecations.mdx                     |    5 +-
 api_docs/fleet.json                           |   42 +-
 api_docs/global_search.json                   |    2 +-
 api_docs/kibana_react.json                    |   29 +-
 api_docs/lens.json                            |   12 +-
 api_docs/licensing.json                       |    4 +-
 api_docs/lists.json                           | 1073 ++---------
 api_docs/lists.mdx                            |    3 -
 api_docs/observability.json                   |   12 +-
 api_docs/reporting.json                       |    4 +-
 api_docs/rule_registry.json                   |    4 +-
 api_docs/security.json                        |   61 +-
 api_docs/security_solution.json               |  927 +--------
 api_docs/security_solution.mdx                |    3 -
 api_docs/spaces.json                          |    8 +-
 api_docs/spaces_oss.json                      |    2 +-
 api_docs/telemetry_collection_manager.json    |    2 +-
 .../alerting/register_apm_alerts.ts           |   10 +-
 .../security_solution/common/constants.ts     |    2 +-
 .../exceptions/use_add_exception.tsx          |   20 +-
 .../alerts_table/default_config.tsx           |   98 +-
 .../components/alerts_table/index.tsx         |   19 +-
 .../detection_engine/detection_engine.tsx     |   16 +-
 .../detection_engine/rules/details/index.tsx  |   11 +-
 .../security_solution/public/plugin.tsx       |   18 +-
 .../scripts/create_reference_rule_eql.sh      |    0
 .../scripts/create_reference_rule_query.sh    |    0
 .../create_reference_rule_threshold.sh        |    4 +-
 .../security_solution/server/plugin.ts        |    6 +-
 38 files changed, 2698 insertions(+), 2797 deletions(-)
 mode change 100644 => 100755 x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_eql.sh
 mode change 100644 => 100755 x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_query.sh
 mode change 100644 => 100755 x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_threshold.sh

diff --git a/api_docs/alerting.json b/api_docs/alerting.json
index cbe045a4981a0..0e6bbbb7d1ad2 100644
--- a/api_docs/alerting.json
+++ b/api_docs/alerting.json
@@ -909,7 +909,7 @@
         ],
         "source": {
           "path": "x-pack/plugins/alerting/server/alerts_client/alerts_client.ts",
-          "lineNumber": 132
+          "lineNumber": 133
         },
         "deprecated": false,
         "children": [
@@ -922,7 +922,7 @@
             "description": [],
             "source": {
               "path": "x-pack/plugins/alerting/server/alerts_client/alerts_client.ts",
-              "lineNumber": 133
+              "lineNumber": 134
             },
             "deprecated": false
           },
@@ -935,7 +935,7 @@
             "description": [],
             "source": {
               "path": "x-pack/plugins/alerting/server/alerts_client/alerts_client.ts",
-              "lineNumber": 134
+              "lineNumber": 135
             },
             "deprecated": false
           },
@@ -948,7 +948,7 @@
             "description": [],
             "source": {
               "path": "x-pack/plugins/alerting/server/alerts_client/alerts_client.ts",
-              "lineNumber": 135
+              "lineNumber": 136
             },
             "deprecated": false
           },
@@ -972,7 +972,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/alerting/server/alerts_client/alerts_client.ts",
-              "lineNumber": 136
+              "lineNumber": 137
             },
             "deprecated": false
           }
diff --git a/api_docs/cases.json b/api_docs/cases.json
index 190fbfe95fc6d..e1b2409a93c61 100644
--- a/api_docs/cases.json
+++ b/api_docs/cases.json
@@ -317,7 +317,7 @@
               "{ authc: ",
               "AuthenticationServiceSetup",
               "; sessionTimeout: ",
-              "ISessionTimeout",
+              "SessionTimeout",
               "; license: Readonly<{ isLicenseAvailable: () => boolean; isEnabled: () => boolean; getType: () => \"basic\" | \"standard\" | \"gold\" | \"platinum\" | \"enterprise\" | \"trial\" | undefined; getFeatures: () => ",
               "SecurityLicenseFeatures",
               "; features$: ",
@@ -582,13 +582,807 @@
             "description": [],
             "signature": [
               "() => ",
-              "CasesClient"
+              {
+                "pluginId": "cases",
+                "scope": "server",
+                "docId": "kibCasesPluginApi",
+                "section": "def-server.CasesClient",
+                "text": "CasesClient"
+              }
+            ],
+            "source": {
+              "path": "x-pack/plugins/cases/server/types.ts",
+              "lineNumber": 13
+            },
+            "deprecated": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "cases",
+        "id": "def-server.CasesClient",
+        "type": "Interface",
+        "tags": [],
+        "label": "CasesClient",
+        "description": [
+          "\nThis represents the interface that other plugins can access."
+        ],
+        "source": {
+          "path": "x-pack/plugins/cases/server/client/types.ts",
+          "lineNumber": 102
+        },
+        "deprecated": false,
+        "children": [
+          {
+            "parentPluginId": "cases",
+            "id": "def-server.CasesClient.addComment",
+            "type": "Function",
+            "tags": [],
+            "label": "addComment",
+            "description": [],
+            "signature": [
+              "(args: ",
+              "CasesClientAddComment",
+              ") => Promise<{ description: string; status: ",
+              {
+                "pluginId": "cases",
+                "scope": "common",
+                "docId": "kibCasesPluginApi",
+                "section": "def-common.CaseStatuses",
+                "text": "CaseStatuses"
+              },
+              "; tags: string[]; title: string; type: ",
+              {
+                "pluginId": "cases",
+                "scope": "common",
+                "docId": "kibCasesPluginApi",
+                "section": "def-common.CaseType",
+                "text": "CaseType"
+              },
+              "; connector: ({ id: string; name: string; } & { type: ",
+              {
+                "pluginId": "cases",
+                "scope": "common",
+                "docId": "kibCasesPluginApi",
+                "section": "def-common.ConnectorTypes",
+                "text": "ConnectorTypes"
+              },
+              ".jira; fields: { issueType: string | null; priority: string | null; parent: string | null; } | null; }) | ({ id: string; name: string; } & { type: ",
+              {
+                "pluginId": "cases",
+                "scope": "common",
+                "docId": "kibCasesPluginApi",
+                "section": "def-common.ConnectorTypes",
+                "text": "ConnectorTypes"
+              }
+            ],
+            "source": {
+              "path": "x-pack/plugins/cases/server/client/types.ts",
+              "lineNumber": 103
+            },
+            "deprecated": false,
+            "children": [
+              {
+                "parentPluginId": "cases",
+                "id": "def-server.CasesClient.addComment.$1",
+                "type": "Object",
+                "tags": [],
+                "label": "args",
+                "description": [],
+                "signature": [
+                  "CasesClientAddComment"
+                ],
+                "source": {
+                  "path": "x-pack/plugins/cases/server/client/types.ts",
+                  "lineNumber": 103
+                },
+                "deprecated": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "cases",
+            "id": "def-server.CasesClient.create",
+            "type": "Function",
+            "tags": [],
+            "label": "create",
+            "description": [],
+            "signature": [
+              "(theCase: { type?: ",
+              {
+                "pluginId": "cases",
+                "scope": "common",
+                "docId": "kibCasesPluginApi",
+                "section": "def-common.CaseType",
+                "text": "CaseType"
+              },
+              " | undefined; } & { description: string; tags: string[]; title: string; connector: ({ id: string; name: string; } & { type: ",
+              {
+                "pluginId": "cases",
+                "scope": "common",
+                "docId": "kibCasesPluginApi",
+                "section": "def-common.ConnectorTypes",
+                "text": "ConnectorTypes"
+              },
+              ".jira; fields: { issueType: string | null; priority: string | null; parent: string | null; } | null; }) | ({ id: string; name: string; } & { type: ",
+              {
+                "pluginId": "cases",
+                "scope": "common",
+                "docId": "kibCasesPluginApi",
+                "section": "def-common.ConnectorTypes",
+                "text": "ConnectorTypes"
+              },
+              ".resilient; fields: { incidentTypes: string[] | null; severityCode: string | null; } | null; }) | ({ id: string; name: string; } & { type: ",
+              {
+                "pluginId": "cases",
+                "scope": "common",
+                "docId": "kibCasesPluginApi",
+                "section": "def-common.ConnectorTypes",
+                "text": "ConnectorTypes"
+              },
+              ".serviceNowITSM; fields: { impact: string | null; severity: string | null; urgency: string | null; category: string | null; subcategory: string | null; } | null; }) | ({ id: string; name: string; } & { type: ",
+              {
+                "pluginId": "cases",
+                "scope": "common",
+                "docId": "kibCasesPluginApi",
+                "section": "def-common.ConnectorTypes",
+                "text": "ConnectorTypes"
+              }
+            ],
+            "source": {
+              "path": "x-pack/plugins/cases/server/client/types.ts",
+              "lineNumber": 104
+            },
+            "deprecated": false,
+            "children": [
+              {
+                "parentPluginId": "cases",
+                "id": "def-server.CasesClient.create.$1",
+                "type": "CompoundType",
+                "tags": [],
+                "label": "theCase",
+                "description": [],
+                "signature": [
+                  "{ type?: ",
+                  {
+                    "pluginId": "cases",
+                    "scope": "common",
+                    "docId": "kibCasesPluginApi",
+                    "section": "def-common.CaseType",
+                    "text": "CaseType"
+                  },
+                  " | undefined; } & { description: string; tags: string[]; title: string; connector: ({ id: string; name: string; } & { type: ",
+                  {
+                    "pluginId": "cases",
+                    "scope": "common",
+                    "docId": "kibCasesPluginApi",
+                    "section": "def-common.ConnectorTypes",
+                    "text": "ConnectorTypes"
+                  },
+                  ".jira; fields: { issueType: string | null; priority: string | null; parent: string | null; } | null; }) | ({ id: string; name: string; } & { type: ",
+                  {
+                    "pluginId": "cases",
+                    "scope": "common",
+                    "docId": "kibCasesPluginApi",
+                    "section": "def-common.ConnectorTypes",
+                    "text": "ConnectorTypes"
+                  },
+                  ".resilient; fields: { incidentTypes: string[] | null; severityCode: string | null; } | null; }) | ({ id: string; name: string; } & { type: ",
+                  {
+                    "pluginId": "cases",
+                    "scope": "common",
+                    "docId": "kibCasesPluginApi",
+                    "section": "def-common.ConnectorTypes",
+                    "text": "ConnectorTypes"
+                  },
+                  ".serviceNowITSM; fields: { impact: string | null; severity: string | null; urgency: string | null; category: string | null; subcategory: string | null; } | null; }) | ({ id: string; name: string; } & { type: ",
+                  {
+                    "pluginId": "cases",
+                    "scope": "common",
+                    "docId": "kibCasesPluginApi",
+                    "section": "def-common.ConnectorTypes",
+                    "text": "ConnectorTypes"
+                  }
+                ],
+                "source": {
+                  "path": "x-pack/plugins/cases/server/client/types.ts",
+                  "lineNumber": 104
+                },
+                "deprecated": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "cases",
+            "id": "def-server.CasesClient.get",
+            "type": "Function",
+            "tags": [],
+            "label": "get",
+            "description": [],
+            "signature": [
+              "(args: ",
+              "CasesClientGet",
+              ") => Promise<{ description: string; status: ",
+              {
+                "pluginId": "cases",
+                "scope": "common",
+                "docId": "kibCasesPluginApi",
+                "section": "def-common.CaseStatuses",
+                "text": "CaseStatuses"
+              },
+              "; tags: string[]; title: string; type: ",
+              {
+                "pluginId": "cases",
+                "scope": "common",
+                "docId": "kibCasesPluginApi",
+                "section": "def-common.CaseType",
+                "text": "CaseType"
+              },
+              "; connector: ({ id: string; name: string; } & { type: ",
+              {
+                "pluginId": "cases",
+                "scope": "common",
+                "docId": "kibCasesPluginApi",
+                "section": "def-common.ConnectorTypes",
+                "text": "ConnectorTypes"
+              },
+              ".jira; fields: { issueType: string | null; priority: string | null; parent: string | null; } | null; }) | ({ id: string; name: string; } & { type: ",
+              {
+                "pluginId": "cases",
+                "scope": "common",
+                "docId": "kibCasesPluginApi",
+                "section": "def-common.ConnectorTypes",
+                "text": "ConnectorTypes"
+              }
+            ],
+            "source": {
+              "path": "x-pack/plugins/cases/server/client/types.ts",
+              "lineNumber": 105
+            },
+            "deprecated": false,
+            "children": [
+              {
+                "parentPluginId": "cases",
+                "id": "def-server.CasesClient.get.$1",
+                "type": "Object",
+                "tags": [],
+                "label": "args",
+                "description": [],
+                "signature": [
+                  "CasesClientGet"
+                ],
+                "source": {
+                  "path": "x-pack/plugins/cases/server/client/types.ts",
+                  "lineNumber": 105
+                },
+                "deprecated": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "cases",
+            "id": "def-server.CasesClient.getAlerts",
+            "type": "Function",
+            "tags": [],
+            "label": "getAlerts",
+            "description": [],
+            "signature": [
+              "(args: ",
+              "CasesClientGetAlerts",
+              ") => Promise<",
+              "CasesClientGetAlertsResponse",
+              ">"
+            ],
+            "source": {
+              "path": "x-pack/plugins/cases/server/client/types.ts",
+              "lineNumber": 106
+            },
+            "deprecated": false,
+            "children": [
+              {
+                "parentPluginId": "cases",
+                "id": "def-server.CasesClient.getAlerts.$1",
+                "type": "Object",
+                "tags": [],
+                "label": "args",
+                "description": [],
+                "signature": [
+                  "CasesClientGetAlerts"
+                ],
+                "source": {
+                  "path": "x-pack/plugins/cases/server/client/types.ts",
+                  "lineNumber": 106
+                },
+                "deprecated": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "cases",
+            "id": "def-server.CasesClient.getFields",
+            "type": "Function",
+            "tags": [],
+            "label": "getFields",
+            "description": [],
+            "signature": [
+              "(args: ",
+              "ConfigureFields",
+              ") => Promise<{ defaultMappings: { action_type: \"append\" | \"overwrite\" | \"nothing\"; source: \"description\" | \"title\" | \"comments\"; target: string; }[]; fields: { id: string; name: string; required: boolean; type: \"text\" | \"textarea\"; }[]; }>"
+            ],
+            "source": {
+              "path": "x-pack/plugins/cases/server/client/types.ts",
+              "lineNumber": 107
+            },
+            "deprecated": false,
+            "children": [
+              {
+                "parentPluginId": "cases",
+                "id": "def-server.CasesClient.getFields.$1",
+                "type": "Object",
+                "tags": [],
+                "label": "args",
+                "description": [],
+                "signature": [
+                  "ConfigureFields"
+                ],
+                "source": {
+                  "path": "x-pack/plugins/cases/server/client/types.ts",
+                  "lineNumber": 107
+                },
+                "deprecated": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "cases",
+            "id": "def-server.CasesClient.getMappings",
+            "type": "Function",
+            "tags": [],
+            "label": "getMappings",
+            "description": [],
+            "signature": [
+              "(args: ",
+              "MappingsClient",
+              ") => Promise<{ action_type: \"append\" | \"overwrite\" | \"nothing\"; source: \"description\" | \"title\" | \"comments\"; target: string; }[]>"
+            ],
+            "source": {
+              "path": "x-pack/plugins/cases/server/client/types.ts",
+              "lineNumber": 108
+            },
+            "deprecated": false,
+            "children": [
+              {
+                "parentPluginId": "cases",
+                "id": "def-server.CasesClient.getMappings.$1",
+                "type": "Object",
+                "tags": [],
+                "label": "args",
+                "description": [],
+                "signature": [
+                  "MappingsClient"
+                ],
+                "source": {
+                  "path": "x-pack/plugins/cases/server/client/types.ts",
+                  "lineNumber": 108
+                },
+                "deprecated": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "cases",
+            "id": "def-server.CasesClient.getUserActions",
+            "type": "Function",
+            "tags": [],
+            "label": "getUserActions",
+            "description": [],
+            "signature": [
+              "(args: ",
+              "CasesClientGetUserActions",
+              ") => Promise<({ action_field: (\"status\" | \"description\" | \"title\" | \"comment\" | \"tags\" | \"settings\" | \"connector\" | \"pushed\" | \"sub_case\")[]; action: \"add\" | \"delete\" | \"create\" | \"update\" | \"push-to-service\"; action_at: string; action_by: { email: string | null | undefined; full_name: string | null | undefined; username: string | null | undefined; }; new_value: string | null; old_value: string | null; } & { action_id: string; case_id: string; comment_id: string | null; } & { sub_case_id?: string | undefined; })[]>"
+            ],
+            "source": {
+              "path": "x-pack/plugins/cases/server/client/types.ts",
+              "lineNumber": 109
+            },
+            "deprecated": false,
+            "children": [
+              {
+                "parentPluginId": "cases",
+                "id": "def-server.CasesClient.getUserActions.$1",
+                "type": "Object",
+                "tags": [],
+                "label": "args",
+                "description": [],
+                "signature": [
+                  "CasesClientGetUserActions"
+                ],
+                "source": {
+                  "path": "x-pack/plugins/cases/server/client/types.ts",
+                  "lineNumber": 109
+                },
+                "deprecated": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "cases",
+            "id": "def-server.CasesClient.push",
+            "type": "Function",
+            "tags": [],
+            "label": "push",
+            "description": [],
+            "signature": [
+              "(args: ",
+              "CasesClientPush",
+              ") => Promise<{ description: string; status: ",
+              {
+                "pluginId": "cases",
+                "scope": "common",
+                "docId": "kibCasesPluginApi",
+                "section": "def-common.CaseStatuses",
+                "text": "CaseStatuses"
+              },
+              "; tags: string[]; title: string; type: ",
+              {
+                "pluginId": "cases",
+                "scope": "common",
+                "docId": "kibCasesPluginApi",
+                "section": "def-common.CaseType",
+                "text": "CaseType"
+              },
+              "; connector: ({ id: string; name: string; } & { type: ",
+              {
+                "pluginId": "cases",
+                "scope": "common",
+                "docId": "kibCasesPluginApi",
+                "section": "def-common.ConnectorTypes",
+                "text": "ConnectorTypes"
+              },
+              ".jira; fields: { issueType: string | null; priority: string | null; parent: string | null; } | null; }) | ({ id: string; name: string; } & { type: ",
+              {
+                "pluginId": "cases",
+                "scope": "common",
+                "docId": "kibCasesPluginApi",
+                "section": "def-common.ConnectorTypes",
+                "text": "ConnectorTypes"
+              }
+            ],
+            "source": {
+              "path": "x-pack/plugins/cases/server/client/types.ts",
+              "lineNumber": 110
+            },
+            "deprecated": false,
+            "children": [
+              {
+                "parentPluginId": "cases",
+                "id": "def-server.CasesClient.push.$1",
+                "type": "Object",
+                "tags": [],
+                "label": "args",
+                "description": [],
+                "signature": [
+                  "CasesClientPush"
+                ],
+                "source": {
+                  "path": "x-pack/plugins/cases/server/client/types.ts",
+                  "lineNumber": 110
+                },
+                "deprecated": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "cases",
+            "id": "def-server.CasesClient.update",
+            "type": "Function",
+            "tags": [],
+            "label": "update",
+            "description": [],
+            "signature": [
+              "(args: { cases: ({ description?: string | undefined; status?: ",
+              {
+                "pluginId": "cases",
+                "scope": "common",
+                "docId": "kibCasesPluginApi",
+                "section": "def-common.CaseStatuses",
+                "text": "CaseStatuses"
+              },
+              " | undefined; tags?: string[] | undefined; title?: string | undefined; type?: ",
+              {
+                "pluginId": "cases",
+                "scope": "common",
+                "docId": "kibCasesPluginApi",
+                "section": "def-common.CaseType",
+                "text": "CaseType"
+              },
+              " | undefined; connector?: ({ id: string; name: string; } & { type: ",
+              {
+                "pluginId": "cases",
+                "scope": "common",
+                "docId": "kibCasesPluginApi",
+                "section": "def-common.ConnectorTypes",
+                "text": "ConnectorTypes"
+              },
+              ".jira; fields: { issueType: string | null; priority: string | null; parent: string | null; } | null; }) | ({ id: string; name: string; } & { type: ",
+              {
+                "pluginId": "cases",
+                "scope": "common",
+                "docId": "kibCasesPluginApi",
+                "section": "def-common.ConnectorTypes",
+                "text": "ConnectorTypes"
+              },
+              ".resilient; fields: { incidentTypes: string[] | null; severityCode: string | null; } | null; }) | ({ id: string; name: string; } & { type: ",
+              {
+                "pluginId": "cases",
+                "scope": "common",
+                "docId": "kibCasesPluginApi",
+                "section": "def-common.ConnectorTypes",
+                "text": "ConnectorTypes"
+              }
             ],
             "source": {
-              "path": "x-pack/plugins/cases/server/types.ts",
-              "lineNumber": 13
+              "path": "x-pack/plugins/cases/server/client/types.ts",
+              "lineNumber": 111
             },
-            "deprecated": false
+            "deprecated": false,
+            "children": [
+              {
+                "parentPluginId": "cases",
+                "id": "def-server.CasesClient.update.$1",
+                "type": "Object",
+                "tags": [],
+                "label": "args",
+                "description": [],
+                "signature": [
+                  "{ cases: ({ description?: string | undefined; status?: ",
+                  {
+                    "pluginId": "cases",
+                    "scope": "common",
+                    "docId": "kibCasesPluginApi",
+                    "section": "def-common.CaseStatuses",
+                    "text": "CaseStatuses"
+                  },
+                  " | undefined; tags?: string[] | undefined; title?: string | undefined; type?: ",
+                  {
+                    "pluginId": "cases",
+                    "scope": "common",
+                    "docId": "kibCasesPluginApi",
+                    "section": "def-common.CaseType",
+                    "text": "CaseType"
+                  },
+                  " | undefined; connector?: ({ id: string; name: string; } & { type: ",
+                  {
+                    "pluginId": "cases",
+                    "scope": "common",
+                    "docId": "kibCasesPluginApi",
+                    "section": "def-common.ConnectorTypes",
+                    "text": "ConnectorTypes"
+                  },
+                  ".jira; fields: { issueType: string | null; priority: string | null; parent: string | null; } | null; }) | ({ id: string; name: string; } & { type: ",
+                  {
+                    "pluginId": "cases",
+                    "scope": "common",
+                    "docId": "kibCasesPluginApi",
+                    "section": "def-common.ConnectorTypes",
+                    "text": "ConnectorTypes"
+                  },
+                  ".resilient; fields: { incidentTypes: string[] | null; severityCode: string | null; } | null; }) | ({ id: string; name: string; } & { type: ",
+                  {
+                    "pluginId": "cases",
+                    "scope": "common",
+                    "docId": "kibCasesPluginApi",
+                    "section": "def-common.ConnectorTypes",
+                    "text": "ConnectorTypes"
+                  }
+                ],
+                "source": {
+                  "path": "x-pack/plugins/cases/server/client/types.ts",
+                  "lineNumber": 111
+                },
+                "deprecated": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "cases",
+            "id": "def-server.CasesClient.updateAlertsStatus",
+            "type": "Function",
+            "tags": [],
+            "label": "updateAlertsStatus",
+            "description": [],
+            "signature": [
+              "(args: ",
+              "CasesClientUpdateAlertsStatus",
+              ") => Promise<void>"
+            ],
+            "source": {
+              "path": "x-pack/plugins/cases/server/client/types.ts",
+              "lineNumber": 112
+            },
+            "deprecated": false,
+            "children": [
+              {
+                "parentPluginId": "cases",
+                "id": "def-server.CasesClient.updateAlertsStatus.$1",
+                "type": "Object",
+                "tags": [],
+                "label": "args",
+                "description": [],
+                "signature": [
+                  "CasesClientUpdateAlertsStatus"
+                ],
+                "source": {
+                  "path": "x-pack/plugins/cases/server/client/types.ts",
+                  "lineNumber": 112
+                },
+                "deprecated": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "cases",
+            "id": "def-server.CasesClient.getCaseIdsByAlertId",
+            "type": "Function",
+            "tags": [],
+            "label": "getCaseIdsByAlertId",
+            "description": [],
+            "signature": [
+              "(args: ",
+              "CasesClientGetCasesByAlert",
+              ") => Promise<string[]>"
+            ],
+            "source": {
+              "path": "x-pack/plugins/cases/server/client/types.ts",
+              "lineNumber": 113
+            },
+            "deprecated": false,
+            "children": [
+              {
+                "parentPluginId": "cases",
+                "id": "def-server.CasesClient.getCaseIdsByAlertId.$1",
+                "type": "Object",
+                "tags": [],
+                "label": "args",
+                "description": [],
+                "signature": [
+                  "CasesClientGetCasesByAlert"
+                ],
+                "source": {
+                  "path": "x-pack/plugins/cases/server/client/types.ts",
+                  "lineNumber": 113
+                },
+                "deprecated": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "cases",
+        "id": "def-server.PluginStartContract",
+        "type": "Interface",
+        "tags": [],
+        "label": "PluginStartContract",
+        "description": [],
+        "source": {
+          "path": "x-pack/plugins/cases/server/index.ts",
+          "lineNumber": 29
+        },
+        "deprecated": false,
+        "children": [
+          {
+            "parentPluginId": "cases",
+            "id": "def-server.PluginStartContract.getCasesClientWithRequestAndContext",
+            "type": "Function",
+            "tags": [],
+            "label": "getCasesClientWithRequestAndContext",
+            "description": [],
+            "signature": [
+              "(context: ",
+              {
+                "pluginId": "core",
+                "scope": "server",
+                "docId": "kibCorePluginApi",
+                "section": "def-server.RequestHandlerContext",
+                "text": "RequestHandlerContext"
+              },
+              ", request: ",
+              {
+                "pluginId": "core",
+                "scope": "server",
+                "docId": "kibCoreHttpPluginApi",
+                "section": "def-server.KibanaRequest",
+                "text": "KibanaRequest"
+              },
+              "<unknown, unknown, unknown, any>) => ",
+              {
+                "pluginId": "cases",
+                "scope": "server",
+                "docId": "kibCasesPluginApi",
+                "section": "def-server.CasesClient",
+                "text": "CasesClient"
+              }
+            ],
+            "source": {
+              "path": "x-pack/plugins/cases/server/index.ts",
+              "lineNumber": 30
+            },
+            "deprecated": false,
+            "children": [
+              {
+                "parentPluginId": "cases",
+                "id": "def-server.PluginStartContract.getCasesClientWithRequestAndContext.$1",
+                "type": "Object",
+                "tags": [],
+                "label": "context",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "core",
+                    "scope": "server",
+                    "docId": "kibCorePluginApi",
+                    "section": "def-server.RequestHandlerContext",
+                    "text": "RequestHandlerContext"
+                  }
+                ],
+                "source": {
+                  "path": "x-pack/plugins/cases/server/index.ts",
+                  "lineNumber": 31
+                },
+                "deprecated": false,
+                "isRequired": true
+              },
+              {
+                "parentPluginId": "cases",
+                "id": "def-server.PluginStartContract.getCasesClientWithRequestAndContext.$2",
+                "type": "Object",
+                "tags": [],
+                "label": "request",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "core",
+                    "scope": "server",
+                    "docId": "kibCoreHttpPluginApi",
+                    "section": "def-server.KibanaRequest",
+                    "text": "KibanaRequest"
+                  },
+                  "<unknown, unknown, unknown, any>"
+                ],
+                "source": {
+                  "path": "x-pack/plugins/cases/server/index.ts",
+                  "lineNumber": 32
+                },
+                "deprecated": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
           }
         ],
         "initialIsOpen": false
@@ -786,7 +1580,7 @@
         ],
         "source": {
           "path": "x-pack/plugins/cases/common/api/helpers.ts",
-          "lineNumber": 35
+          "lineNumber": 36
         },
         "deprecated": false,
         "children": [
@@ -802,7 +1596,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/cases/common/api/helpers.ts",
-              "lineNumber": 35
+              "lineNumber": 36
             },
             "deprecated": false,
             "isRequired": true
@@ -819,7 +1613,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/cases/common/api/helpers.ts",
-              "lineNumber": 35
+              "lineNumber": 36
             },
             "deprecated": false,
             "isRequired": true
@@ -840,7 +1634,7 @@
         ],
         "source": {
           "path": "x-pack/plugins/cases/common/api/helpers.ts",
-          "lineNumber": 31
+          "lineNumber": 32
         },
         "deprecated": false,
         "children": [
@@ -856,7 +1650,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/cases/common/api/helpers.ts",
-              "lineNumber": 31
+              "lineNumber": 32
             },
             "deprecated": false,
             "isRequired": true
@@ -877,7 +1671,7 @@
         ],
         "source": {
           "path": "x-pack/plugins/cases/common/api/helpers.ts",
-          "lineNumber": 19
+          "lineNumber": 20
         },
         "deprecated": false,
         "children": [
@@ -893,7 +1687,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/cases/common/api/helpers.ts",
-              "lineNumber": 19
+              "lineNumber": 20
             },
             "deprecated": false,
             "isRequired": true
@@ -914,7 +1708,7 @@
         ],
         "source": {
           "path": "x-pack/plugins/cases/common/api/helpers.ts",
-          "lineNumber": 47
+          "lineNumber": 48
         },
         "deprecated": false,
         "children": [
@@ -930,7 +1724,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/cases/common/api/helpers.ts",
-              "lineNumber": 47
+              "lineNumber": 48
             },
             "deprecated": false,
             "isRequired": true
@@ -947,7 +1741,44 @@
             ],
             "source": {
               "path": "x-pack/plugins/cases/common/api/helpers.ts",
-              "lineNumber": 47
+              "lineNumber": 48
+            },
+            "deprecated": false,
+            "isRequired": true
+          }
+        ],
+        "returnComment": [],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "cases",
+        "id": "def-common.getCasesFromAlertsUrl",
+        "type": "Function",
+        "tags": [],
+        "label": "getCasesFromAlertsUrl",
+        "description": [],
+        "signature": [
+          "(alertId: string) => string"
+        ],
+        "source": {
+          "path": "x-pack/plugins/cases/common/api/helpers.ts",
+          "lineNumber": 52
+        },
+        "deprecated": false,
+        "children": [
+          {
+            "parentPluginId": "cases",
+            "id": "def-common.getCasesFromAlertsUrl.$1",
+            "type": "string",
+            "tags": [],
+            "label": "alertId",
+            "description": [],
+            "signature": [
+              "string"
+            ],
+            "source": {
+              "path": "x-pack/plugins/cases/common/api/helpers.ts",
+              "lineNumber": 52
             },
             "deprecated": false,
             "isRequired": true
@@ -968,7 +1799,7 @@
         ],
         "source": {
           "path": "x-pack/plugins/cases/common/api/helpers.ts",
-          "lineNumber": 39
+          "lineNumber": 40
         },
         "deprecated": false,
         "children": [
@@ -984,7 +1815,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/cases/common/api/helpers.ts",
-              "lineNumber": 39
+              "lineNumber": 40
             },
             "deprecated": false,
             "isRequired": true
@@ -1005,7 +1836,7 @@
         ],
         "source": {
           "path": "x-pack/plugins/cases/common/api/helpers.ts",
-          "lineNumber": 27
+          "lineNumber": 28
         },
         "deprecated": false,
         "children": [
@@ -1021,7 +1852,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/cases/common/api/helpers.ts",
-              "lineNumber": 27
+              "lineNumber": 28
             },
             "deprecated": false,
             "isRequired": true
@@ -1038,7 +1869,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/cases/common/api/helpers.ts",
-              "lineNumber": 27
+              "lineNumber": 28
             },
             "deprecated": false,
             "isRequired": true
@@ -1059,7 +1890,7 @@
         ],
         "source": {
           "path": "x-pack/plugins/cases/common/api/helpers.ts",
-          "lineNumber": 23
+          "lineNumber": 24
         },
         "deprecated": false,
         "children": [
@@ -1075,7 +1906,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/cases/common/api/helpers.ts",
-              "lineNumber": 23
+              "lineNumber": 24
             },
             "deprecated": false,
             "isRequired": true
@@ -1096,7 +1927,7 @@
         ],
         "source": {
           "path": "x-pack/plugins/cases/common/api/helpers.ts",
-          "lineNumber": 43
+          "lineNumber": 44
         },
         "deprecated": false,
         "children": [
@@ -1112,7 +1943,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/cases/common/api/helpers.ts",
-              "lineNumber": 43
+              "lineNumber": 44
             },
             "deprecated": false,
             "isRequired": true
@@ -1129,7 +1960,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/cases/common/api/helpers.ts",
-              "lineNumber": 43
+              "lineNumber": 44
             },
             "deprecated": false,
             "isRequired": true
diff --git a/api_docs/core.json b/api_docs/core.json
index 10c205c445d1a..0805c57d2488e 100644
--- a/api_docs/core.json
+++ b/api_docs/core.json
@@ -1112,7 +1112,7 @@
         ],
         "source": {
           "path": "src/core/public/index.ts",
-          "lineNumber": 213
+          "lineNumber": 215
         },
         "deprecated": false,
         "children": [
@@ -1136,7 +1136,7 @@
             ],
             "source": {
               "path": "src/core/public/index.ts",
-              "lineNumber": 215
+              "lineNumber": 217
             },
             "deprecated": false
           },
@@ -1160,7 +1160,7 @@
             ],
             "source": {
               "path": "src/core/public/index.ts",
-              "lineNumber": 217
+              "lineNumber": 219
             },
             "deprecated": false
           },
@@ -1184,7 +1184,7 @@
             ],
             "source": {
               "path": "src/core/public/index.ts",
-              "lineNumber": 219
+              "lineNumber": 221
             },
             "deprecated": false
           },
@@ -1208,7 +1208,7 @@
             ],
             "source": {
               "path": "src/core/public/index.ts",
-              "lineNumber": 221
+              "lineNumber": 223
             },
             "deprecated": false
           },
@@ -1232,7 +1232,7 @@
             ],
             "source": {
               "path": "src/core/public/index.ts",
-              "lineNumber": 223
+              "lineNumber": 225
             },
             "deprecated": false
           },
@@ -1252,7 +1252,7 @@
             ],
             "source": {
               "path": "src/core/public/index.ts",
-              "lineNumber": 230
+              "lineNumber": 232
             },
             "deprecated": true,
             "references": []
@@ -1278,7 +1278,7 @@
             ],
             "source": {
               "path": "src/core/public/index.ts",
-              "lineNumber": 234
+              "lineNumber": 236
             },
             "deprecated": false
           }
@@ -1296,7 +1296,7 @@
         ],
         "source": {
           "path": "src/core/public/index.ts",
-          "lineNumber": 258
+          "lineNumber": 260
         },
         "deprecated": false,
         "children": [
@@ -1320,7 +1320,7 @@
             ],
             "source": {
               "path": "src/core/public/index.ts",
-              "lineNumber": 260
+              "lineNumber": 262
             },
             "deprecated": false
           },
@@ -1344,7 +1344,7 @@
             ],
             "source": {
               "path": "src/core/public/index.ts",
-              "lineNumber": 262
+              "lineNumber": 264
             },
             "deprecated": false
           },
@@ -1368,7 +1368,7 @@
             ],
             "source": {
               "path": "src/core/public/index.ts",
-              "lineNumber": 264
+              "lineNumber": 266
             },
             "deprecated": false
           },
@@ -1392,7 +1392,7 @@
             ],
             "source": {
               "path": "src/core/public/index.ts",
-              "lineNumber": 266
+              "lineNumber": 268
             },
             "deprecated": false
           },
@@ -1416,7 +1416,7 @@
             ],
             "source": {
               "path": "src/core/public/index.ts",
-              "lineNumber": 268
+              "lineNumber": 270
             },
             "deprecated": false
           },
@@ -1440,7 +1440,7 @@
             ],
             "source": {
               "path": "src/core/public/index.ts",
-              "lineNumber": 270
+              "lineNumber": 272
             },
             "deprecated": false
           },
@@ -1464,7 +1464,7 @@
             ],
             "source": {
               "path": "src/core/public/index.ts",
-              "lineNumber": 272
+              "lineNumber": 274
             },
             "deprecated": false
           },
@@ -1488,7 +1488,7 @@
             ],
             "source": {
               "path": "src/core/public/index.ts",
-              "lineNumber": 274
+              "lineNumber": 276
             },
             "deprecated": false
           },
@@ -1512,7 +1512,7 @@
             ],
             "source": {
               "path": "src/core/public/index.ts",
-              "lineNumber": 276
+              "lineNumber": 278
             },
             "deprecated": false
           },
@@ -1536,7 +1536,7 @@
             ],
             "source": {
               "path": "src/core/public/index.ts",
-              "lineNumber": 278
+              "lineNumber": 280
             },
             "deprecated": false
           },
@@ -1560,7 +1560,7 @@
             ],
             "source": {
               "path": "src/core/public/index.ts",
-              "lineNumber": 280
+              "lineNumber": 282
             },
             "deprecated": false
           },
@@ -1580,7 +1580,7 @@
             ],
             "source": {
               "path": "src/core/public/index.ts",
-              "lineNumber": 287
+              "lineNumber": 289
             },
             "deprecated": true,
             "references": [
@@ -4328,6 +4328,126 @@
         ],
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "core",
+        "id": "def-public.SavedObjectReferenceWithContext",
+        "type": "Interface",
+        "tags": [],
+        "label": "SavedObjectReferenceWithContext",
+        "description": [
+          "\nA returned input object or one of its references, with additional context.\n"
+        ],
+        "source": {
+          "path": "src/core/server/saved_objects/service/lib/collect_multi_namespace_references.ts",
+          "lineNumber": 66
+        },
+        "deprecated": false,
+        "children": [
+          {
+            "parentPluginId": "core",
+            "id": "def-public.SavedObjectReferenceWithContext.type",
+            "type": "string",
+            "tags": [],
+            "label": "type",
+            "description": [
+              "The type of the referenced object"
+            ],
+            "source": {
+              "path": "src/core/server/saved_objects/service/lib/collect_multi_namespace_references.ts",
+              "lineNumber": 68
+            },
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "core",
+            "id": "def-public.SavedObjectReferenceWithContext.id",
+            "type": "string",
+            "tags": [],
+            "label": "id",
+            "description": [
+              "The ID of the referenced object"
+            ],
+            "source": {
+              "path": "src/core/server/saved_objects/service/lib/collect_multi_namespace_references.ts",
+              "lineNumber": 70
+            },
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "core",
+            "id": "def-public.SavedObjectReferenceWithContext.spaces",
+            "type": "Array",
+            "tags": [],
+            "label": "spaces",
+            "description": [
+              "The space(s) that the referenced object exists in"
+            ],
+            "signature": [
+              "string[]"
+            ],
+            "source": {
+              "path": "src/core/server/saved_objects/service/lib/collect_multi_namespace_references.ts",
+              "lineNumber": 72
+            },
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "core",
+            "id": "def-public.SavedObjectReferenceWithContext.inboundReferences",
+            "type": "Array",
+            "tags": [],
+            "label": "inboundReferences",
+            "description": [
+              "\nReferences to this object; note that this does not contain _all inbound references everywhere for this object_, it only contains\ninbound references for the scope of this operation"
+            ],
+            "signature": [
+              "{ type: string; id: string; name: string; }[]"
+            ],
+            "source": {
+              "path": "src/core/server/saved_objects/service/lib/collect_multi_namespace_references.ts",
+              "lineNumber": 77
+            },
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "core",
+            "id": "def-public.SavedObjectReferenceWithContext.isMissing",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "isMissing",
+            "description": [
+              "Whether or not this object or reference is missing"
+            ],
+            "signature": [
+              "boolean | undefined"
+            ],
+            "source": {
+              "path": "src/core/server/saved_objects/service/lib/collect_multi_namespace_references.ts",
+              "lineNumber": 86
+            },
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "core",
+            "id": "def-public.SavedObjectReferenceWithContext.spacesWithMatchingAliases",
+            "type": "Array",
+            "tags": [],
+            "label": "spacesWithMatchingAliases",
+            "description": [
+              "The space(s) that legacy URL aliases matching this type/id exist in"
+            ],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "source": {
+              "path": "src/core/server/saved_objects/service/lib/collect_multi_namespace_references.ts",
+              "lineNumber": 88
+            },
+            "deprecated": false
+          }
+        ],
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "core",
         "id": "def-public.SavedObjectsBaseOptions",
@@ -4364,6 +4484,47 @@
         ],
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "core",
+        "id": "def-public.SavedObjectsCollectMultiNamespaceReferencesResponse",
+        "type": "Interface",
+        "tags": [],
+        "label": "SavedObjectsCollectMultiNamespaceReferencesResponse",
+        "description": [
+          "\nThe response when object references are collected.\n"
+        ],
+        "source": {
+          "path": "src/core/server/saved_objects/service/lib/collect_multi_namespace_references.ts",
+          "lineNumber": 96
+        },
+        "deprecated": false,
+        "children": [
+          {
+            "parentPluginId": "core",
+            "id": "def-public.SavedObjectsCollectMultiNamespaceReferencesResponse.objects",
+            "type": "Array",
+            "tags": [],
+            "label": "objects",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "core",
+                "scope": "server",
+                "docId": "kibCoreSavedObjectsPluginApi",
+                "section": "def-server.SavedObjectReferenceWithContext",
+                "text": "SavedObjectReferenceWithContext"
+              },
+              "[]"
+            ],
+            "source": {
+              "path": "src/core/server/saved_objects/service/lib/collect_multi_namespace_references.ts",
+              "lineNumber": 97
+            },
+            "deprecated": false
+          }
+        ],
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "core",
         "id": "def-public.SavedObjectsFindOptions",
@@ -6528,7 +6689,7 @@
         ],
         "source": {
           "path": "src/core/public/index.ts",
-          "lineNumber": 244
+          "lineNumber": 246
         },
         "deprecated": false,
         "initialIsOpen": false
@@ -8249,6 +8410,20 @@
                   "lineNumber": 67
                 }
               },
+              {
+                "plugin": "lists",
+                "link": {
+                  "path": "x-pack/plugins/lists/server/routes/read_privileges_route.ts",
+                  "lineNumber": 31
+                }
+              },
+              {
+                "plugin": "lists",
+                "link": {
+                  "path": "x-pack/plugins/lists/server/routes/read_privileges_route.ts",
+                  "lineNumber": 35
+                }
+              },
               {
                 "plugin": "securitySolution",
                 "link": {
@@ -8277,20 +8452,6 @@
                   "lineNumber": 39
                 }
               },
-              {
-                "plugin": "lists",
-                "link": {
-                  "path": "x-pack/plugins/lists/server/routes/read_privileges_route.ts",
-                  "lineNumber": 31
-                }
-              },
-              {
-                "plugin": "lists",
-                "link": {
-                  "path": "x-pack/plugins/lists/server/routes/read_privileges_route.ts",
-                  "lineNumber": 35
-                }
-              },
               {
                 "plugin": "beatsManagement",
                 "link": {
@@ -9166,7 +9327,7 @@
             "plugin": "fleet",
             "link": {
               "path": "x-pack/plugins/fleet/server/plugin.ts",
-              "lineNumber": 15
+              "lineNumber": 14
             }
           },
           {
@@ -9187,7 +9348,7 @@
             "plugin": "fleet",
             "link": {
               "path": "x-pack/plugins/fleet/target/types/server/plugin.d.ts",
-              "lineNumber": 83
+              "lineNumber": 84
             }
           }
         ],
@@ -10026,7 +10187,7 @@
         ],
         "source": {
           "path": "src/core/server/index.ts",
-          "lineNumber": 472
+          "lineNumber": 476
         },
         "deprecated": false,
         "children": [
@@ -10050,7 +10211,7 @@
             ],
             "source": {
               "path": "src/core/server/index.ts",
-              "lineNumber": 474
+              "lineNumber": 478
             },
             "deprecated": false
           },
@@ -10074,7 +10235,7 @@
             ],
             "source": {
               "path": "src/core/server/index.ts",
-              "lineNumber": 476
+              "lineNumber": 480
             },
             "deprecated": false
           },
@@ -10098,7 +10259,7 @@
             ],
             "source": {
               "path": "src/core/server/index.ts",
-              "lineNumber": 478
+              "lineNumber": 482
             },
             "deprecated": false
           },
@@ -10131,7 +10292,7 @@
             ],
             "source": {
               "path": "src/core/server/index.ts",
-              "lineNumber": 480
+              "lineNumber": 484
             },
             "deprecated": false
           },
@@ -10155,7 +10316,7 @@
             ],
             "source": {
               "path": "src/core/server/index.ts",
-              "lineNumber": 485
+              "lineNumber": 489
             },
             "deprecated": false
           },
@@ -10179,7 +10340,7 @@
             ],
             "source": {
               "path": "src/core/server/index.ts",
-              "lineNumber": 487
+              "lineNumber": 491
             },
             "deprecated": false
           },
@@ -10203,7 +10364,7 @@
             ],
             "source": {
               "path": "src/core/server/index.ts",
-              "lineNumber": 489
+              "lineNumber": 493
             },
             "deprecated": false
           },
@@ -10227,7 +10388,7 @@
             ],
             "source": {
               "path": "src/core/server/index.ts",
-              "lineNumber": 491
+              "lineNumber": 495
             },
             "deprecated": false
           },
@@ -10251,7 +10412,7 @@
             ],
             "source": {
               "path": "src/core/server/index.ts",
-              "lineNumber": 493
+              "lineNumber": 497
             },
             "deprecated": false
           },
@@ -10275,7 +10436,7 @@
             ],
             "source": {
               "path": "src/core/server/index.ts",
-              "lineNumber": 495
+              "lineNumber": 499
             },
             "deprecated": false
           },
@@ -10299,7 +10460,7 @@
             ],
             "source": {
               "path": "src/core/server/index.ts",
-              "lineNumber": 497
+              "lineNumber": 501
             },
             "deprecated": false
           },
@@ -10324,7 +10485,7 @@
             ],
             "source": {
               "path": "src/core/server/index.ts",
-              "lineNumber": 499
+              "lineNumber": 503
             },
             "deprecated": false
           }
@@ -10342,7 +10503,7 @@
         ],
         "source": {
           "path": "src/core/server/index.ts",
-          "lineNumber": 520
+          "lineNumber": 524
         },
         "deprecated": false,
         "children": [
@@ -10366,7 +10527,7 @@
             ],
             "source": {
               "path": "src/core/server/index.ts",
-              "lineNumber": 522
+              "lineNumber": 526
             },
             "deprecated": false
           },
@@ -10390,7 +10551,7 @@
             ],
             "source": {
               "path": "src/core/server/index.ts",
-              "lineNumber": 524
+              "lineNumber": 528
             },
             "deprecated": false
           },
@@ -10414,7 +10575,7 @@
             ],
             "source": {
               "path": "src/core/server/index.ts",
-              "lineNumber": 526
+              "lineNumber": 530
             },
             "deprecated": false
           },
@@ -10438,7 +10599,7 @@
             ],
             "source": {
               "path": "src/core/server/index.ts",
-              "lineNumber": 528
+              "lineNumber": 532
             },
             "deprecated": false
           },
@@ -10462,7 +10623,7 @@
             ],
             "source": {
               "path": "src/core/server/index.ts",
-              "lineNumber": 530
+              "lineNumber": 534
             },
             "deprecated": false
           },
@@ -10486,7 +10647,7 @@
             ],
             "source": {
               "path": "src/core/server/index.ts",
-              "lineNumber": 532
+              "lineNumber": 536
             },
             "deprecated": false
           }
@@ -11632,6 +11793,22 @@
               "lineNumber": 181
             },
             "deprecated": false
+          },
+          {
+            "parentPluginId": "core",
+            "id": "def-server.ElasticsearchStatusMeta.nodesInfoRequestError",
+            "type": "Object",
+            "tags": [],
+            "label": "nodesInfoRequestError",
+            "description": [],
+            "signature": [
+              "Error | undefined"
+            ],
+            "source": {
+              "path": "src/core/server/elasticsearch/types.ts",
+              "lineNumber": 182
+            },
+            "deprecated": false
           }
         ],
         "initialIsOpen": false
@@ -11708,7 +11885,7 @@
         ],
         "source": {
           "path": "src/core/server/elasticsearch/types.ts",
-          "lineNumber": 188
+          "lineNumber": 189
         },
         "deprecated": false,
         "children": [
@@ -11732,7 +11909,7 @@
             ],
             "source": {
               "path": "src/core/server/elasticsearch/types.ts",
-              "lineNumber": 190
+              "lineNumber": 191
             },
             "deprecated": false
           }
@@ -11790,7 +11967,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"addToNamespaces\" | \"deleteFromNamespaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
+              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
             ],
             "source": {
               "path": "src/core/server/deprecations/types.ts",
@@ -13223,45 +13400,45 @@
         "removeBy": "7.16",
         "references": [
           {
-            "plugin": "securitySolution",
+            "plugin": "lists",
             "link": {
-              "path": "x-pack/plugins/security_solution/server/lib/telemetry/sender.ts",
-              "lineNumber": 10
+              "path": "x-pack/plugins/lists/server/schemas/common/get_call_cluster.mock.ts",
+              "lineNumber": 9
             }
           },
           {
-            "plugin": "securitySolution",
+            "plugin": "lists",
             "link": {
-              "path": "x-pack/plugins/security_solution/server/lib/telemetry/sender.ts",
-              "lineNumber": 447
+              "path": "x-pack/plugins/lists/server/schemas/common/get_call_cluster.mock.ts",
+              "lineNumber": 27
             }
           },
           {
-            "plugin": "securitySolution",
+            "plugin": "lists",
             "link": {
-              "path": "x-pack/plugins/security_solution/server/lib/telemetry/sender.ts",
-              "lineNumber": 466
+              "path": "x-pack/plugins/lists/server/schemas/common/get_call_cluster.mock.ts",
+              "lineNumber": 31
             }
           },
           {
-            "plugin": "lists",
+            "plugin": "securitySolution",
             "link": {
-              "path": "x-pack/plugins/lists/server/schemas/common/get_call_cluster.mock.ts",
-              "lineNumber": 9
+              "path": "x-pack/plugins/security_solution/server/lib/telemetry/sender.ts",
+              "lineNumber": 10
             }
           },
           {
-            "plugin": "lists",
+            "plugin": "securitySolution",
             "link": {
-              "path": "x-pack/plugins/lists/server/schemas/common/get_call_cluster.mock.ts",
-              "lineNumber": 27
+              "path": "x-pack/plugins/security_solution/server/lib/telemetry/sender.ts",
+              "lineNumber": 447
             }
           },
           {
-            "plugin": "lists",
+            "plugin": "securitySolution",
             "link": {
-              "path": "x-pack/plugins/lists/server/schemas/common/get_call_cluster.mock.ts",
-              "lineNumber": 31
+              "path": "x-pack/plugins/security_solution/server/lib/telemetry/sender.ts",
+              "lineNumber": 466
             }
           },
           {
@@ -16644,6 +16821,22 @@
               "lineNumber": 51
             },
             "deprecated": false
+          },
+          {
+            "parentPluginId": "core",
+            "id": "def-server.NodesVersionCompatibility.nodesInfoRequestError",
+            "type": "Object",
+            "tags": [],
+            "label": "nodesInfoRequestError",
+            "description": [],
+            "signature": [
+              "Error | undefined"
+            ],
+            "source": {
+              "path": "src/core/server/elasticsearch/version_check/ensure_es_version.ts",
+              "lineNumber": 52
+            },
+            "deprecated": false
           }
         ],
         "initialIsOpen": false
@@ -17859,7 +18052,7 @@
         ],
         "source": {
           "path": "src/core/server/index.ts",
-          "lineNumber": 439
+          "lineNumber": 443
         },
         "deprecated": false,
         "children": [
@@ -17879,7 +18072,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"addToNamespaces\" | \"deleteFromNamespaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">; typeRegistry: Pick<",
+              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">; typeRegistry: Pick<",
               {
                 "pluginId": "core",
                 "scope": "server",
@@ -17903,7 +18096,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"addToNamespaces\" | \"deleteFromNamespaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">; getExporter: (client: Pick<",
+              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">; getExporter: (client: Pick<",
               {
                 "pluginId": "core",
                 "scope": "server",
@@ -17914,7 +18107,7 @@
             ],
             "source": {
               "path": "src/core/server/index.ts",
-              "lineNumber": 440
+              "lineNumber": 444
             },
             "deprecated": false
           }
@@ -19380,7 +19573,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"addToNamespaces\" | \"deleteFromNamespaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">) => ",
+              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">) => ",
               {
                 "pluginId": "core",
                 "scope": "server",
@@ -19411,7 +19604,7 @@
                     "section": "def-server.SavedObjectsClient",
                     "text": "SavedObjectsClient"
                   },
-                  ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"addToNamespaces\" | \"deleteFromNamespaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
+                  ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
                 ],
                 "source": {
                   "path": "src/core/server/ui_settings/types.ts",
@@ -20966,7 +21159,7 @@
         ],
         "source": {
           "path": "src/core/server/elasticsearch/types.ts",
-          "lineNumber": 200
+          "lineNumber": 201
         },
         "deprecated": false,
         "initialIsOpen": false
@@ -21038,7 +21231,7 @@
         ],
         "source": {
           "path": "src/core/server/index.ts",
-          "lineNumber": 510
+          "lineNumber": 514
         },
         "deprecated": false,
         "initialIsOpen": false
diff --git a/api_docs/core_application.json b/api_docs/core_application.json
index d1b76aa645bf7..e1194b18f3b41 100644
--- a/api_docs/core_application.json
+++ b/api_docs/core_application.json
@@ -1707,7 +1707,7 @@
                 "plugin": "lens",
                 "link": {
                   "path": "x-pack/plugins/lens/public/app_plugin/types.ts",
-                  "lineNumber": 75
+                  "lineNumber": 71
                 }
               },
               {
@@ -1728,7 +1728,7 @@
                 "plugin": "maps",
                 "link": {
                   "path": "x-pack/plugins/maps/public/routes/map_page/map_app/map_app.tsx",
-                  "lineNumber": 60
+                  "lineNumber": 59
                 }
               },
               {
@@ -1812,7 +1812,7 @@
                 "plugin": "maps",
                 "link": {
                   "path": "x-pack/plugins/maps/target/types/public/routes/map_page/map_app/map_app.d.ts",
-                  "lineNumber": 14
+                  "lineNumber": 13
                 }
               }
             ]
diff --git a/api_docs/core_saved_objects.json b/api_docs/core_saved_objects.json
index c2d2dff35c9dd..4cbc986be8529 100644
--- a/api_docs/core_saved_objects.json
+++ b/api_docs/core_saved_objects.json
@@ -1667,7 +1667,7 @@
         ],
         "source": {
           "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-          "lineNumber": 404
+          "lineNumber": 371
         },
         "deprecated": false,
         "children": [
@@ -1690,7 +1690,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 405
+              "lineNumber": 372
             },
             "deprecated": false
           },
@@ -1713,7 +1713,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 406
+              "lineNumber": 373
             },
             "deprecated": false
           },
@@ -1741,7 +1741,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 422
+              "lineNumber": 389
             },
             "deprecated": false,
             "children": [
@@ -1757,7 +1757,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-                  "lineNumber": 422
+                  "lineNumber": 389
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -1774,7 +1774,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-                  "lineNumber": 422
+                  "lineNumber": 389
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -1798,7 +1798,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-                  "lineNumber": 422
+                  "lineNumber": 389
                 },
                 "deprecated": false,
                 "isRequired": false
@@ -1844,7 +1844,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 432
+              "lineNumber": 399
             },
             "deprecated": false,
             "children": [
@@ -1867,7 +1867,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-                  "lineNumber": 433
+                  "lineNumber": 400
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -1891,7 +1891,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-                  "lineNumber": 434
+                  "lineNumber": 401
                 },
                 "deprecated": false,
                 "isRequired": false
@@ -1937,7 +1937,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 446
+              "lineNumber": 413
             },
             "deprecated": false,
             "children": [
@@ -1960,7 +1960,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-                  "lineNumber": 447
+                  "lineNumber": 414
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -1983,7 +1983,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-                  "lineNumber": 448
+                  "lineNumber": 415
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -2013,7 +2013,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 460
+              "lineNumber": 427
             },
             "deprecated": false,
             "children": [
@@ -2029,7 +2029,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-                  "lineNumber": 460
+                  "lineNumber": 427
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -2046,7 +2046,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-                  "lineNumber": 460
+                  "lineNumber": 427
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -2069,7 +2069,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-                  "lineNumber": 460
+                  "lineNumber": 427
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -2107,7 +2107,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 469
+              "lineNumber": 436
             },
             "deprecated": false,
             "children": [
@@ -2129,7 +2129,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-                  "lineNumber": 470
+                  "lineNumber": 437
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -2175,7 +2175,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 486
+              "lineNumber": 453
             },
             "deprecated": false,
             "children": [
@@ -2200,7 +2200,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-                  "lineNumber": 487
+                  "lineNumber": 454
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -2223,7 +2223,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-                  "lineNumber": 488
+                  "lineNumber": 455
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -2255,7 +2255,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 500
+              "lineNumber": 467
             },
             "deprecated": false,
             "children": [
@@ -2273,7 +2273,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-                  "lineNumber": 501
+                  "lineNumber": 468
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -2292,7 +2292,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-                  "lineNumber": 502
+                  "lineNumber": 469
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -2315,7 +2315,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-                  "lineNumber": 503
+                  "lineNumber": 470
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -2353,7 +2353,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 515
+              "lineNumber": 482
             },
             "deprecated": false,
             "children": [
@@ -2371,7 +2371,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-                  "lineNumber": 516
+                  "lineNumber": 483
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -2390,7 +2390,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-                  "lineNumber": 517
+                  "lineNumber": 484
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -2413,7 +2413,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-                  "lineNumber": 518
+                  "lineNumber": 485
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -2451,7 +2451,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 530
+              "lineNumber": 497
             },
             "deprecated": false,
             "children": [
@@ -2467,7 +2467,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-                  "lineNumber": 531
+                  "lineNumber": 498
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -2484,7 +2484,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-                  "lineNumber": 532
+                  "lineNumber": 499
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -2501,7 +2501,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-                  "lineNumber": 533
+                  "lineNumber": 500
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -2525,7 +2525,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-                  "lineNumber": 534
+                  "lineNumber": 501
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -2535,92 +2535,73 @@
           },
           {
             "parentPluginId": "core",
-            "id": "def-server.SavedObjectsClient.addToNamespaces",
+            "id": "def-server.SavedObjectsClient.bulkUpdate",
             "type": "Function",
             "tags": [],
-            "label": "addToNamespaces",
+            "label": "bulkUpdate",
             "description": [
-              "\nAdds namespaces to a SavedObject\n"
+              "\nBulk Updates multiple SavedObject at once\n"
             ],
             "signature": [
-              "(type: string, id: string, namespaces: string[], options?: ",
+              "<T = unknown>(objects: ",
               {
                 "pluginId": "core",
                 "scope": "server",
                 "docId": "kibCoreSavedObjectsPluginApi",
-                "section": "def-server.SavedObjectsAddToNamespacesOptions",
-                "text": "SavedObjectsAddToNamespacesOptions"
+                "section": "def-server.SavedObjectsBulkUpdateObject",
+                "text": "SavedObjectsBulkUpdateObject"
               },
-              ") => Promise<",
+              "<T>[], options?: ",
               {
                 "pluginId": "core",
                 "scope": "server",
                 "docId": "kibCoreSavedObjectsPluginApi",
-                "section": "def-server.SavedObjectsAddToNamespacesResponse",
-                "text": "SavedObjectsAddToNamespacesResponse"
+                "section": "def-server.SavedObjectsBulkUpdateOptions",
+                "text": "SavedObjectsBulkUpdateOptions"
               },
-              ">"
+              " | undefined) => Promise<",
+              {
+                "pluginId": "core",
+                "scope": "server",
+                "docId": "kibCoreSavedObjectsPluginApi",
+                "section": "def-server.SavedObjectsBulkUpdateResponse",
+                "text": "SavedObjectsBulkUpdateResponse"
+              },
+              "<T>>"
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 547
+              "lineNumber": 511
             },
             "deprecated": false,
             "children": [
               {
                 "parentPluginId": "core",
-                "id": "def-server.SavedObjectsClient.addToNamespaces.$1",
-                "type": "string",
-                "tags": [],
-                "label": "type",
-                "description": [],
-                "signature": [
-                  "string"
-                ],
-                "source": {
-                  "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-                  "lineNumber": 548
-                },
-                "deprecated": false,
-                "isRequired": true
-              },
-              {
-                "parentPluginId": "core",
-                "id": "def-server.SavedObjectsClient.addToNamespaces.$2",
-                "type": "string",
-                "tags": [],
-                "label": "id",
-                "description": [],
-                "signature": [
-                  "string"
-                ],
-                "source": {
-                  "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-                  "lineNumber": 549
-                },
-                "deprecated": false,
-                "isRequired": true
-              },
-              {
-                "parentPluginId": "core",
-                "id": "def-server.SavedObjectsClient.addToNamespaces.$3",
+                "id": "def-server.SavedObjectsClient.bulkUpdate.$1",
                 "type": "Array",
                 "tags": [],
-                "label": "namespaces",
+                "label": "objects",
                 "description": [],
                 "signature": [
-                  "string[]"
+                  {
+                    "pluginId": "core",
+                    "scope": "server",
+                    "docId": "kibCoreSavedObjectsPluginApi",
+                    "section": "def-server.SavedObjectsBulkUpdateObject",
+                    "text": "SavedObjectsBulkUpdateObject"
+                  },
+                  "<T>[]"
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-                  "lineNumber": 550
+                  "lineNumber": 512
                 },
                 "deprecated": false,
                 "isRequired": true
               },
               {
                 "parentPluginId": "core",
-                "id": "def-server.SavedObjectsClient.addToNamespaces.$4",
+                "id": "def-server.SavedObjectsClient.bulkUpdate.$2",
                 "type": "Object",
                 "tags": [],
                 "label": "options",
@@ -2630,57 +2611,58 @@
                     "pluginId": "core",
                     "scope": "server",
                     "docId": "kibCoreSavedObjectsPluginApi",
-                    "section": "def-server.SavedObjectsAddToNamespacesOptions",
-                    "text": "SavedObjectsAddToNamespacesOptions"
-                  }
+                    "section": "def-server.SavedObjectsBulkUpdateOptions",
+                    "text": "SavedObjectsBulkUpdateOptions"
+                  },
+                  " | undefined"
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-                  "lineNumber": 551
+                  "lineNumber": 513
                 },
                 "deprecated": false,
-                "isRequired": true
+                "isRequired": false
               }
             ],
             "returnComment": []
           },
           {
             "parentPluginId": "core",
-            "id": "def-server.SavedObjectsClient.deleteFromNamespaces",
+            "id": "def-server.SavedObjectsClient.removeReferencesTo",
             "type": "Function",
             "tags": [],
-            "label": "deleteFromNamespaces",
+            "label": "removeReferencesTo",
             "description": [
-              "\nRemoves namespaces from a SavedObject\n"
+              "\nUpdates all objects containing a reference to the given {type, id} tuple to remove the said reference."
             ],
             "signature": [
-              "(type: string, id: string, namespaces: string[], options?: ",
+              "(type: string, id: string, options?: ",
               {
                 "pluginId": "core",
                 "scope": "server",
                 "docId": "kibCoreSavedObjectsPluginApi",
-                "section": "def-server.SavedObjectsDeleteFromNamespacesOptions",
-                "text": "SavedObjectsDeleteFromNamespacesOptions"
+                "section": "def-server.SavedObjectsRemoveReferencesToOptions",
+                "text": "SavedObjectsRemoveReferencesToOptions"
               },
-              ") => Promise<",
+              " | undefined) => Promise<",
               {
                 "pluginId": "core",
                 "scope": "server",
                 "docId": "kibCoreSavedObjectsPluginApi",
-                "section": "def-server.SavedObjectsDeleteFromNamespacesResponse",
-                "text": "SavedObjectsDeleteFromNamespacesResponse"
+                "section": "def-server.SavedObjectsRemoveReferencesToResponse",
+                "text": "SavedObjectsRemoveReferencesToResponse"
               },
               ">"
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 564
+              "lineNumber": 521
             },
             "deprecated": false,
             "children": [
               {
                 "parentPluginId": "core",
-                "id": "def-server.SavedObjectsClient.deleteFromNamespaces.$1",
+                "id": "def-server.SavedObjectsClient.removeReferencesTo.$1",
                 "type": "string",
                 "tags": [],
                 "label": "type",
@@ -2690,14 +2672,14 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-                  "lineNumber": 565
+                  "lineNumber": 522
                 },
                 "deprecated": false,
                 "isRequired": true
               },
               {
                 "parentPluginId": "core",
-                "id": "def-server.SavedObjectsClient.deleteFromNamespaces.$2",
+                "id": "def-server.SavedObjectsClient.removeReferencesTo.$2",
                 "type": "string",
                 "tags": [],
                 "label": "id",
@@ -2707,31 +2689,14 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-                  "lineNumber": 566
+                  "lineNumber": 523
                 },
                 "deprecated": false,
                 "isRequired": true
               },
               {
                 "parentPluginId": "core",
-                "id": "def-server.SavedObjectsClient.deleteFromNamespaces.$3",
-                "type": "Array",
-                "tags": [],
-                "label": "namespaces",
-                "description": [],
-                "signature": [
-                  "string[]"
-                ],
-                "source": {
-                  "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-                  "lineNumber": 567
-                },
-                "deprecated": false,
-                "isRequired": true
-              },
-              {
-                "parentPluginId": "core",
-                "id": "def-server.SavedObjectsClient.deleteFromNamespaces.$4",
+                "id": "def-server.SavedObjectsClient.removeReferencesTo.$3",
                 "type": "Object",
                 "tags": [],
                 "label": "options",
@@ -2741,89 +2706,75 @@
                     "pluginId": "core",
                     "scope": "server",
                     "docId": "kibCoreSavedObjectsPluginApi",
-                    "section": "def-server.SavedObjectsDeleteFromNamespacesOptions",
-                    "text": "SavedObjectsDeleteFromNamespacesOptions"
-                  }
+                    "section": "def-server.SavedObjectsRemoveReferencesToOptions",
+                    "text": "SavedObjectsRemoveReferencesToOptions"
+                  },
+                  " | undefined"
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-                  "lineNumber": 568
+                  "lineNumber": 524
                 },
                 "deprecated": false,
-                "isRequired": true
+                "isRequired": false
               }
             ],
             "returnComment": []
           },
           {
             "parentPluginId": "core",
-            "id": "def-server.SavedObjectsClient.bulkUpdate",
+            "id": "def-server.SavedObjectsClient.openPointInTimeForType",
             "type": "Function",
             "tags": [],
-            "label": "bulkUpdate",
+            "label": "openPointInTimeForType",
             "description": [
-              "\nBulk Updates multiple SavedObject at once\n"
+              "\nOpens a Point In Time (PIT) against the indices for the specified Saved Object types.\nThe returned `id` can then be passed to {@link SavedObjectsClient.find} to search\nagainst that PIT.\n\nOnly use this API if you have an advanced use case that's not solved by the\n{@link SavedObjectsClient.createPointInTimeFinder} method."
             ],
             "signature": [
-              "<T = unknown>(objects: ",
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCoreSavedObjectsPluginApi",
-                "section": "def-server.SavedObjectsBulkUpdateObject",
-                "text": "SavedObjectsBulkUpdateObject"
-              },
-              "<T>[], options?: ",
+              "(type: string | string[], options?: ",
               {
                 "pluginId": "core",
                 "scope": "server",
                 "docId": "kibCoreSavedObjectsPluginApi",
-                "section": "def-server.SavedObjectsBulkUpdateOptions",
-                "text": "SavedObjectsBulkUpdateOptions"
+                "section": "def-server.SavedObjectsOpenPointInTimeOptions",
+                "text": "SavedObjectsOpenPointInTimeOptions"
               },
-              " | undefined) => Promise<",
+              ") => Promise<",
               {
                 "pluginId": "core",
                 "scope": "server",
                 "docId": "kibCoreSavedObjectsPluginApi",
-                "section": "def-server.SavedObjectsBulkUpdateResponse",
-                "text": "SavedObjectsBulkUpdateResponse"
+                "section": "def-server.SavedObjectsOpenPointInTimeResponse",
+                "text": "SavedObjectsOpenPointInTimeResponse"
               },
-              "<T>>"
+              ">"
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 578
+              "lineNumber": 537
             },
             "deprecated": false,
             "children": [
               {
                 "parentPluginId": "core",
-                "id": "def-server.SavedObjectsClient.bulkUpdate.$1",
-                "type": "Array",
+                "id": "def-server.SavedObjectsClient.openPointInTimeForType.$1",
+                "type": "CompoundType",
                 "tags": [],
-                "label": "objects",
+                "label": "type",
                 "description": [],
                 "signature": [
-                  {
-                    "pluginId": "core",
-                    "scope": "server",
-                    "docId": "kibCoreSavedObjectsPluginApi",
-                    "section": "def-server.SavedObjectsBulkUpdateObject",
-                    "text": "SavedObjectsBulkUpdateObject"
-                  },
-                  "<T>[]"
+                  "string | string[]"
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-                  "lineNumber": 579
+                  "lineNumber": 538
                 },
                 "deprecated": false,
                 "isRequired": true
               },
               {
                 "parentPluginId": "core",
-                "id": "def-server.SavedObjectsClient.bulkUpdate.$2",
+                "id": "def-server.SavedObjectsClient.openPointInTimeForType.$2",
                 "type": "Object",
                 "tags": [],
                 "label": "options",
@@ -2833,75 +2784,57 @@
                     "pluginId": "core",
                     "scope": "server",
                     "docId": "kibCoreSavedObjectsPluginApi",
-                    "section": "def-server.SavedObjectsBulkUpdateOptions",
-                    "text": "SavedObjectsBulkUpdateOptions"
-                  },
-                  " | undefined"
+                    "section": "def-server.SavedObjectsOpenPointInTimeOptions",
+                    "text": "SavedObjectsOpenPointInTimeOptions"
+                  }
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-                  "lineNumber": 580
+                  "lineNumber": 539
                 },
                 "deprecated": false,
-                "isRequired": false
+                "isRequired": true
               }
             ],
             "returnComment": []
           },
           {
             "parentPluginId": "core",
-            "id": "def-server.SavedObjectsClient.removeReferencesTo",
+            "id": "def-server.SavedObjectsClient.closePointInTime",
             "type": "Function",
             "tags": [],
-            "label": "removeReferencesTo",
+            "label": "closePointInTime",
             "description": [
-              "\nUpdates all objects containing a reference to the given {type, id} tuple to remove the said reference."
+              "\nCloses a Point In Time (PIT) by ID. This simply proxies the request to ES via the\nElasticsearch client, and is included in the Saved Objects Client as a convenience\nfor consumers who are using {@link SavedObjectsClient.openPointInTimeForType}.\n\nOnly use this API if you have an advanced use case that's not solved by the\n{@link SavedObjectsClient.createPointInTimeFinder} method."
             ],
             "signature": [
-              "(type: string, id: string, options?: ",
+              "(id: string, options?: ",
               {
                 "pluginId": "core",
                 "scope": "server",
                 "docId": "kibCoreSavedObjectsPluginApi",
-                "section": "def-server.SavedObjectsRemoveReferencesToOptions",
-                "text": "SavedObjectsRemoveReferencesToOptions"
+                "section": "def-server.SavedObjectsBaseOptions",
+                "text": "SavedObjectsBaseOptions"
               },
               " | undefined) => Promise<",
               {
                 "pluginId": "core",
                 "scope": "server",
                 "docId": "kibCoreSavedObjectsPluginApi",
-                "section": "def-server.SavedObjectsRemoveReferencesToResponse",
-                "text": "SavedObjectsRemoveReferencesToResponse"
+                "section": "def-server.SavedObjectsClosePointInTimeResponse",
+                "text": "SavedObjectsClosePointInTimeResponse"
               },
               ">"
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 588
+              "lineNumber": 552
             },
             "deprecated": false,
             "children": [
               {
                 "parentPluginId": "core",
-                "id": "def-server.SavedObjectsClient.removeReferencesTo.$1",
-                "type": "string",
-                "tags": [],
-                "label": "type",
-                "description": [],
-                "signature": [
-                  "string"
-                ],
-                "source": {
-                  "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-                  "lineNumber": 589
-                },
-                "deprecated": false,
-                "isRequired": true
-              },
-              {
-                "parentPluginId": "core",
-                "id": "def-server.SavedObjectsClient.removeReferencesTo.$2",
+                "id": "def-server.SavedObjectsClient.closePointInTime.$1",
                 "type": "string",
                 "tags": [],
                 "label": "id",
@@ -2911,14 +2844,14 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-                  "lineNumber": 590
+                  "lineNumber": 552
                 },
                 "deprecated": false,
                 "isRequired": true
               },
               {
                 "parentPluginId": "core",
-                "id": "def-server.SavedObjectsClient.removeReferencesTo.$3",
+                "id": "def-server.SavedObjectsClient.closePointInTime.$2",
                 "type": "Object",
                 "tags": [],
                 "label": "options",
@@ -2928,14 +2861,14 @@
                     "pluginId": "core",
                     "scope": "server",
                     "docId": "kibCoreSavedObjectsPluginApi",
-                    "section": "def-server.SavedObjectsRemoveReferencesToOptions",
-                    "text": "SavedObjectsRemoveReferencesToOptions"
+                    "section": "def-server.SavedObjectsBaseOptions",
+                    "text": "SavedObjectsBaseOptions"
                   },
                   " | undefined"
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-                  "lineNumber": 591
+                  "lineNumber": 552
                 },
                 "deprecated": false,
                 "isRequired": false
@@ -2945,124 +2878,156 @@
           },
           {
             "parentPluginId": "core",
-            "id": "def-server.SavedObjectsClient.openPointInTimeForType",
+            "id": "def-server.SavedObjectsClient.createPointInTimeFinder",
             "type": "Function",
             "tags": [],
-            "label": "openPointInTimeForType",
+            "label": "createPointInTimeFinder",
             "description": [
-              "\nOpens a Point In Time (PIT) against the indices for the specified Saved Object types.\nThe returned `id` can then be passed to {@link SavedObjectsClient.find} to search\nagainst that PIT.\n\nOnly use this API if you have an advanced use case that's not solved by the\n{@link SavedObjectsClient.createPointInTimeFinder} method."
+              "\nReturns a {@link ISavedObjectsPointInTimeFinder} to help page through\nlarge sets of saved objects. We strongly recommend using this API for\nany `find` queries that might return more than 1000 saved objects,\nhowever this API is only intended for use in server-side \"batch\"\nprocessing of objects where you are collecting all objects in memory\nor streaming them back to the client.\n\nDo NOT use this API in a route handler to facilitate paging through\nsaved objects on the client-side unless you are streaming all of the\nresults back to the client at once. Because the returned generator is\nstateful, you cannot rely on subsequent http requests retrieving new\npages from the same Kibana server in multi-instance deployments.\n\nThe generator wraps calls to {@link SavedObjectsClient.find} and iterates\nover multiple pages of results using `_pit` and `search_after`. This will\nopen a new Point-In-Time (PIT), and continue paging until a set of\nresults is received that's smaller than the designated `perPage`.\n\nOnce you have retrieved all of the results you need, it is recommended\nto call `close()` to clean up the PIT and prevent Elasticsearch from\nconsuming resources unnecessarily. This is only required if you are\ndone iterating and have not yet paged through all of the results: the\nPIT will automatically be closed for you once you reach the last page\nof results, or if the underlying call to `find` fails for any reason.\n"
             ],
             "signature": [
-              "(type: string | string[], options?: ",
+              "<T = unknown, A = unknown>(findOptions: Pick<",
               {
                 "pluginId": "core",
                 "scope": "server",
                 "docId": "kibCoreSavedObjectsPluginApi",
-                "section": "def-server.SavedObjectsOpenPointInTimeOptions",
-                "text": "SavedObjectsOpenPointInTimeOptions"
+                "section": "def-server.SavedObjectsFindOptions",
+                "text": "SavedObjectsFindOptions"
               },
-              ") => Promise<",
+              ", \"type\" | \"filter\" | \"aggs\" | \"fields\" | \"preference\" | \"perPage\" | \"sortField\" | \"sortOrder\" | \"search\" | \"searchFields\" | \"rootSearchFields\" | \"hasReference\" | \"hasReferenceOperator\" | \"defaultSearchOperator\" | \"namespaces\" | \"typeToNamespacesMap\">, dependencies?: ",
               {
                 "pluginId": "core",
                 "scope": "server",
                 "docId": "kibCoreSavedObjectsPluginApi",
-                "section": "def-server.SavedObjectsOpenPointInTimeResponse",
-                "text": "SavedObjectsOpenPointInTimeResponse"
+                "section": "def-server.SavedObjectsCreatePointInTimeFinderDependencies",
+                "text": "SavedObjectsCreatePointInTimeFinderDependencies"
               },
-              ">"
+              " | undefined) => ",
+              {
+                "pluginId": "core",
+                "scope": "server",
+                "docId": "kibCoreSavedObjectsPluginApi",
+                "section": "def-server.ISavedObjectsPointInTimeFinder",
+                "text": "ISavedObjectsPointInTimeFinder"
+              },
+              "<T, A>"
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 604
+              "lineNumber": 601
             },
             "deprecated": false,
             "children": [
               {
                 "parentPluginId": "core",
-                "id": "def-server.SavedObjectsClient.openPointInTimeForType.$1",
-                "type": "CompoundType",
+                "id": "def-server.SavedObjectsClient.createPointInTimeFinder.$1",
+                "type": "Object",
                 "tags": [],
-                "label": "type",
+                "label": "findOptions",
                 "description": [],
                 "signature": [
-                  "string | string[]"
+                  "Pick<",
+                  {
+                    "pluginId": "core",
+                    "scope": "server",
+                    "docId": "kibCoreSavedObjectsPluginApi",
+                    "section": "def-server.SavedObjectsFindOptions",
+                    "text": "SavedObjectsFindOptions"
+                  },
+                  ", \"type\" | \"filter\" | \"aggs\" | \"fields\" | \"preference\" | \"perPage\" | \"sortField\" | \"sortOrder\" | \"search\" | \"searchFields\" | \"rootSearchFields\" | \"hasReference\" | \"hasReferenceOperator\" | \"defaultSearchOperator\" | \"namespaces\" | \"typeToNamespacesMap\">"
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-                  "lineNumber": 605
+                  "lineNumber": 602
                 },
                 "deprecated": false,
                 "isRequired": true
               },
               {
                 "parentPluginId": "core",
-                "id": "def-server.SavedObjectsClient.openPointInTimeForType.$2",
+                "id": "def-server.SavedObjectsClient.createPointInTimeFinder.$2",
                 "type": "Object",
                 "tags": [],
-                "label": "options",
+                "label": "dependencies",
                 "description": [],
                 "signature": [
                   {
                     "pluginId": "core",
                     "scope": "server",
                     "docId": "kibCoreSavedObjectsPluginApi",
-                    "section": "def-server.SavedObjectsOpenPointInTimeOptions",
-                    "text": "SavedObjectsOpenPointInTimeOptions"
-                  }
+                    "section": "def-server.SavedObjectsCreatePointInTimeFinderDependencies",
+                    "text": "SavedObjectsCreatePointInTimeFinderDependencies"
+                  },
+                  " | undefined"
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-                  "lineNumber": 606
+                  "lineNumber": 603
                 },
                 "deprecated": false,
-                "isRequired": true
+                "isRequired": false
               }
             ],
             "returnComment": []
           },
           {
             "parentPluginId": "core",
-            "id": "def-server.SavedObjectsClient.closePointInTime",
+            "id": "def-server.SavedObjectsClient.collectMultiNamespaceReferences",
             "type": "Function",
             "tags": [],
-            "label": "closePointInTime",
+            "label": "collectMultiNamespaceReferences",
             "description": [
-              "\nCloses a Point In Time (PIT) by ID. This simply proxies the request to ES via the\nElasticsearch client, and is included in the Saved Objects Client as a convenience\nfor consumers who are using {@link SavedObjectsClient.openPointInTimeForType}.\n\nOnly use this API if you have an advanced use case that's not solved by the\n{@link SavedObjectsClient.createPointInTimeFinder} method."
+              "\nGets all references and transitive references of the listed objects. Ignores any object that is not a multi-namespace type.\n"
             ],
             "signature": [
-              "(id: string, options?: ",
+              "(objects: ",
               {
                 "pluginId": "core",
                 "scope": "server",
                 "docId": "kibCoreSavedObjectsPluginApi",
-                "section": "def-server.SavedObjectsBaseOptions",
-                "text": "SavedObjectsBaseOptions"
+                "section": "def-server.SavedObjectsCollectMultiNamespaceReferencesObject",
+                "text": "SavedObjectsCollectMultiNamespaceReferencesObject"
               },
-              " | undefined) => Promise<",
+              "[], options?: ",
               {
                 "pluginId": "core",
                 "scope": "server",
                 "docId": "kibCoreSavedObjectsPluginApi",
-                "section": "def-server.SavedObjectsClosePointInTimeResponse",
-                "text": "SavedObjectsClosePointInTimeResponse"
+                "section": "def-server.SavedObjectsCollectMultiNamespaceReferencesOptions",
+                "text": "SavedObjectsCollectMultiNamespaceReferencesOptions"
+              },
+              " | undefined) => Promise<",
+              {
+                "pluginId": "core",
+                "scope": "server",
+                "docId": "kibCoreSavedObjectsPluginApi",
+                "section": "def-server.SavedObjectsCollectMultiNamespaceReferencesResponse",
+                "text": "SavedObjectsCollectMultiNamespaceReferencesResponse"
               },
               ">"
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 619
+              "lineNumber": 618
             },
             "deprecated": false,
             "children": [
               {
                 "parentPluginId": "core",
-                "id": "def-server.SavedObjectsClient.closePointInTime.$1",
-                "type": "string",
+                "id": "def-server.SavedObjectsClient.collectMultiNamespaceReferences.$1",
+                "type": "Array",
                 "tags": [],
-                "label": "id",
+                "label": "objects",
                 "description": [],
                 "signature": [
-                  "string"
+                  {
+                    "pluginId": "core",
+                    "scope": "server",
+                    "docId": "kibCoreSavedObjectsPluginApi",
+                    "section": "def-server.SavedObjectsCollectMultiNamespaceReferencesObject",
+                    "text": "SavedObjectsCollectMultiNamespaceReferencesObject"
+                  },
+                  "[]"
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
@@ -3073,7 +3038,7 @@
               },
               {
                 "parentPluginId": "core",
-                "id": "def-server.SavedObjectsClient.closePointInTime.$2",
+                "id": "def-server.SavedObjectsClient.collectMultiNamespaceReferences.$2",
                 "type": "Object",
                 "tags": [],
                 "label": "options",
@@ -3083,14 +3048,14 @@
                     "pluginId": "core",
                     "scope": "server",
                     "docId": "kibCoreSavedObjectsPluginApi",
-                    "section": "def-server.SavedObjectsBaseOptions",
-                    "text": "SavedObjectsBaseOptions"
+                    "section": "def-server.SavedObjectsCollectMultiNamespaceReferencesOptions",
+                    "text": "SavedObjectsCollectMultiNamespaceReferencesOptions"
                   },
                   " | undefined"
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-                  "lineNumber": 619
+                  "lineNumber": 620
                 },
                 "deprecated": false,
                 "isRequired": false
@@ -3100,90 +3065,124 @@
           },
           {
             "parentPluginId": "core",
-            "id": "def-server.SavedObjectsClient.createPointInTimeFinder",
+            "id": "def-server.SavedObjectsClient.updateObjectsSpaces",
             "type": "Function",
             "tags": [],
-            "label": "createPointInTimeFinder",
+            "label": "updateObjectsSpaces",
             "description": [
-              "\nReturns a {@link ISavedObjectsPointInTimeFinder} to help page through\nlarge sets of saved objects. We strongly recommend using this API for\nany `find` queries that might return more than 1000 saved objects,\nhowever this API is only intended for use in server-side \"batch\"\nprocessing of objects where you are collecting all objects in memory\nor streaming them back to the client.\n\nDo NOT use this API in a route handler to facilitate paging through\nsaved objects on the client-side unless you are streaming all of the\nresults back to the client at once. Because the returned generator is\nstateful, you cannot rely on subsequent http requests retrieving new\npages from the same Kibana server in multi-instance deployments.\n\nThe generator wraps calls to {@link SavedObjectsClient.find} and iterates\nover multiple pages of results using `_pit` and `search_after`. This will\nopen a new Point-In-Time (PIT), and continue paging until a set of\nresults is received that's smaller than the designated `perPage`.\n\nOnce you have retrieved all of the results you need, it is recommended\nto call `close()` to clean up the PIT and prevent Elasticsearch from\nconsuming resources unnecessarily. This is only required if you are\ndone iterating and have not yet paged through all of the results: the\nPIT will automatically be closed for you once you reach the last page\nof results, or if the underlying call to `find` fails for any reason.\n"
+              "\nUpdates one or more objects to add and/or remove them from specified spaces.\n"
             ],
             "signature": [
-              "(findOptions: Pick<",
+              "(objects: ",
               {
                 "pluginId": "core",
                 "scope": "server",
                 "docId": "kibCoreSavedObjectsPluginApi",
-                "section": "def-server.SavedObjectsFindOptions",
-                "text": "SavedObjectsFindOptions"
+                "section": "def-server.SavedObjectsUpdateObjectsSpacesObject",
+                "text": "SavedObjectsUpdateObjectsSpacesObject"
               },
-              ", \"type\" | \"filter\" | \"aggs\" | \"fields\" | \"preference\" | \"perPage\" | \"sortField\" | \"sortOrder\" | \"search\" | \"searchFields\" | \"rootSearchFields\" | \"hasReference\" | \"hasReferenceOperator\" | \"defaultSearchOperator\" | \"namespaces\" | \"typeToNamespacesMap\">, dependencies?: ",
+              "[], spacesToAdd: string[], spacesToRemove: string[], options?: ",
               {
                 "pluginId": "core",
                 "scope": "server",
                 "docId": "kibCoreSavedObjectsPluginApi",
-                "section": "def-server.SavedObjectsCreatePointInTimeFinderDependencies",
-                "text": "SavedObjectsCreatePointInTimeFinderDependencies"
+                "section": "def-server.SavedObjectsUpdateObjectsSpacesOptions",
+                "text": "SavedObjectsUpdateObjectsSpacesOptions"
               },
-              " | undefined) => ",
+              " | undefined) => Promise<",
               {
                 "pluginId": "core",
                 "scope": "server",
                 "docId": "kibCoreSavedObjectsPluginApi",
-                "section": "def-server.ISavedObjectsPointInTimeFinder",
-                "text": "ISavedObjectsPointInTimeFinder"
-              }
+                "section": "def-server.SavedObjectsUpdateObjectsSpacesResponse",
+                "text": "SavedObjectsUpdateObjectsSpacesResponse"
+              },
+              ">"
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 668
+              "lineNumber": 633
             },
             "deprecated": false,
             "children": [
               {
                 "parentPluginId": "core",
-                "id": "def-server.SavedObjectsClient.createPointInTimeFinder.$1",
-                "type": "Object",
+                "id": "def-server.SavedObjectsClient.updateObjectsSpaces.$1",
+                "type": "Array",
                 "tags": [],
-                "label": "findOptions",
+                "label": "objects",
                 "description": [],
                 "signature": [
-                  "Pick<",
                   {
                     "pluginId": "core",
                     "scope": "server",
                     "docId": "kibCoreSavedObjectsPluginApi",
-                    "section": "def-server.SavedObjectsFindOptions",
-                    "text": "SavedObjectsFindOptions"
+                    "section": "def-server.SavedObjectsUpdateObjectsSpacesObject",
+                    "text": "SavedObjectsUpdateObjectsSpacesObject"
                   },
-                  ", \"type\" | \"filter\" | \"aggs\" | \"fields\" | \"preference\" | \"perPage\" | \"sortField\" | \"sortOrder\" | \"search\" | \"searchFields\" | \"rootSearchFields\" | \"hasReference\" | \"hasReferenceOperator\" | \"defaultSearchOperator\" | \"namespaces\" | \"typeToNamespacesMap\">"
+                  "[]"
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-                  "lineNumber": 669
+                  "lineNumber": 634
                 },
                 "deprecated": false,
                 "isRequired": true
               },
               {
                 "parentPluginId": "core",
-                "id": "def-server.SavedObjectsClient.createPointInTimeFinder.$2",
+                "id": "def-server.SavedObjectsClient.updateObjectsSpaces.$2",
+                "type": "Array",
+                "tags": [],
+                "label": "spacesToAdd",
+                "description": [],
+                "signature": [
+                  "string[]"
+                ],
+                "source": {
+                  "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
+                  "lineNumber": 635
+                },
+                "deprecated": false,
+                "isRequired": true
+              },
+              {
+                "parentPluginId": "core",
+                "id": "def-server.SavedObjectsClient.updateObjectsSpaces.$3",
+                "type": "Array",
+                "tags": [],
+                "label": "spacesToRemove",
+                "description": [],
+                "signature": [
+                  "string[]"
+                ],
+                "source": {
+                  "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
+                  "lineNumber": 636
+                },
+                "deprecated": false,
+                "isRequired": true
+              },
+              {
+                "parentPluginId": "core",
+                "id": "def-server.SavedObjectsClient.updateObjectsSpaces.$4",
                 "type": "Object",
                 "tags": [],
-                "label": "dependencies",
+                "label": "options",
                 "description": [],
                 "signature": [
                   {
                     "pluginId": "core",
                     "scope": "server",
                     "docId": "kibCoreSavedObjectsPluginApi",
-                    "section": "def-server.SavedObjectsCreatePointInTimeFinderDependencies",
-                    "text": "SavedObjectsCreatePointInTimeFinderDependencies"
+                    "section": "def-server.SavedObjectsUpdateObjectsSpacesOptions",
+                    "text": "SavedObjectsUpdateObjectsSpacesOptions"
                   },
                   " | undefined"
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-                  "lineNumber": 670
+                  "lineNumber": 637
                 },
                 "deprecated": false,
                 "isRequired": false
@@ -4764,7 +4763,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"addToNamespaces\" | \"deleteFromNamespaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
+              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
             ],
             "source": {
               "path": "src/core/server/saved_objects/export/saved_objects_exporter.ts",
@@ -4870,7 +4869,7 @@
                         "section": "def-server.SavedObjectsClient",
                         "text": "SavedObjectsClient"
                       },
-                      ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"addToNamespaces\" | \"deleteFromNamespaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
+                      ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
                     ],
                     "source": {
                       "path": "src/core/server/saved_objects/export/saved_objects_exporter.ts",
@@ -5018,7 +5017,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/export/saved_objects_exporter.ts",
-              "lineNumber": 92
+              "lineNumber": 93
             },
             "deprecated": false,
             "children": [
@@ -5040,7 +5039,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/export/saved_objects_exporter.ts",
-                  "lineNumber": 92
+                  "lineNumber": 93
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -5375,7 +5374,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"addToNamespaces\" | \"deleteFromNamespaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
+              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
             ],
             "source": {
               "path": "src/core/server/saved_objects/import/saved_objects_importer.ts",
@@ -5489,7 +5488,7 @@
                         "section": "def-server.SavedObjectsClient",
                         "text": "SavedObjectsClient"
                       },
-                      ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"addToNamespaces\" | \"deleteFromNamespaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
+                      ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
                     ],
                     "source": {
                       "path": "src/core/server/saved_objects/import/saved_objects_importer.ts",
@@ -5922,7 +5921,7 @@
         "description": [],
         "source": {
           "path": "src/core/server/saved_objects/service/lib/repository.ts",
-          "lineNumber": 159
+          "lineNumber": 171
         },
         "deprecated": false,
         "children": [
@@ -5956,7 +5955,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/lib/repository.ts",
-              "lineNumber": 257
+              "lineNumber": 269
             },
             "deprecated": false,
             "children": [
@@ -5972,7 +5971,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 258
+                  "lineNumber": 270
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -5989,7 +5988,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 259
+                  "lineNumber": 271
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -6012,7 +6011,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 260
+                  "lineNumber": 272
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -6063,7 +6062,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/lib/repository.ts",
-              "lineNumber": 350
+              "lineNumber": 362
             },
             "deprecated": false,
             "children": [
@@ -6088,7 +6087,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 351
+                  "lineNumber": 363
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -6111,7 +6110,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 352
+                  "lineNumber": 364
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -6159,7 +6158,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/lib/repository.ts",
-              "lineNumber": 541
+              "lineNumber": 548
             },
             "deprecated": false,
             "children": [
@@ -6182,7 +6181,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 542
+                  "lineNumber": 549
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -6205,7 +6204,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 543
+                  "lineNumber": 550
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -6237,7 +6236,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/lib/repository.ts",
-              "lineNumber": 628
+              "lineNumber": 635
             },
             "deprecated": false,
             "children": [
@@ -6253,7 +6252,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 628
+                  "lineNumber": 635
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -6270,7 +6269,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 628
+                  "lineNumber": 635
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -6293,7 +6292,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 628
+                  "lineNumber": 635
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -6323,7 +6322,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/lib/repository.ts",
-              "lineNumber": 690
+              "lineNumber": 697
             },
             "deprecated": false,
             "children": [
@@ -6339,7 +6338,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 691
+                  "lineNumber": 698
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -6362,7 +6361,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 692
+                  "lineNumber": 699
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -6415,7 +6414,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/lib/repository.ts",
-              "lineNumber": 752
+              "lineNumber": 759
             },
             "deprecated": false,
             "children": [
@@ -6437,7 +6436,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 753
+                  "lineNumber": 760
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -6487,7 +6486,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/lib/repository.ts",
-              "lineNumber": 919
+              "lineNumber": 926
             },
             "deprecated": false,
             "children": [
@@ -6512,7 +6511,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 920
+                  "lineNumber": 927
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -6535,7 +6534,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 921
+                  "lineNumber": 928
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -6571,7 +6570,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/lib/repository.ts",
-              "lineNumber": 1006
+              "lineNumber": 1013
             },
             "deprecated": false,
             "children": [
@@ -6587,7 +6586,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 1007
+                  "lineNumber": 1014
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -6604,7 +6603,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 1008
+                  "lineNumber": 1015
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -6627,7 +6626,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 1009
+                  "lineNumber": 1016
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -6669,7 +6668,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/lib/repository.ts",
-              "lineNumber": 1048
+              "lineNumber": 1055
             },
             "deprecated": false,
             "children": [
@@ -6685,7 +6684,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 1049
+                  "lineNumber": 1056
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -6702,7 +6701,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 1050
+                  "lineNumber": 1057
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -6725,7 +6724,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 1051
+                  "lineNumber": 1058
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -6769,7 +6768,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/lib/repository.ts",
-              "lineNumber": 1173
+              "lineNumber": 1185
             },
             "deprecated": false,
             "children": [
@@ -6785,7 +6784,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 1174
+                  "lineNumber": 1186
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -6802,7 +6801,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 1175
+                  "lineNumber": 1187
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -6819,7 +6818,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 1176
+                  "lineNumber": 1188
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -6843,7 +6842,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 1177
+                  "lineNumber": 1189
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -6853,92 +6852,75 @@
           },
           {
             "parentPluginId": "core",
-            "id": "def-server.SavedObjectsRepository.addToNamespaces",
+            "id": "def-server.SavedObjectsRepository.collectMultiNamespaceReferences",
             "type": "Function",
             "tags": [],
-            "label": "addToNamespaces",
+            "label": "collectMultiNamespaceReferences",
             "description": [
-              "\nAdds one or more namespaces to a given multi-namespace saved object. This method and\n[`deleteFromNamespaces`]{@link SavedObjectsRepository.deleteFromNamespaces} are the only ways to change which Spaces a multi-namespace\nsaved object is shared to."
+              "\nGets all references and transitive references of the given objects. Ignores any object and/or reference that is not a multi-namespace\ntype.\n"
             ],
             "signature": [
-              "(type: string, id: string, namespaces: string[], options?: ",
+              "(objects: ",
               {
                 "pluginId": "core",
                 "scope": "server",
                 "docId": "kibCoreSavedObjectsPluginApi",
-                "section": "def-server.SavedObjectsAddToNamespacesOptions",
-                "text": "SavedObjectsAddToNamespacesOptions"
+                "section": "def-server.SavedObjectsCollectMultiNamespaceReferencesObject",
+                "text": "SavedObjectsCollectMultiNamespaceReferencesObject"
               },
-              ") => Promise<",
+              "[], options?: ",
+              {
+                "pluginId": "core",
+                "scope": "server",
+                "docId": "kibCoreSavedObjectsPluginApi",
+                "section": "def-server.SavedObjectsCollectMultiNamespaceReferencesOptions",
+                "text": "SavedObjectsCollectMultiNamespaceReferencesOptions"
+              },
+              " | undefined) => Promise<",
               {
                 "pluginId": "core",
                 "scope": "server",
                 "docId": "kibCoreSavedObjectsPluginApi",
-                "section": "def-server.SavedObjectsAddToNamespacesResponse",
-                "text": "SavedObjectsAddToNamespacesResponse"
+                "section": "def-server.SavedObjectsCollectMultiNamespaceReferencesResponse",
+                "text": "SavedObjectsCollectMultiNamespaceReferencesResponse"
               },
               ">"
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/lib/repository.ts",
-              "lineNumber": 1270
+              "lineNumber": 1283
             },
             "deprecated": false,
             "children": [
               {
                 "parentPluginId": "core",
-                "id": "def-server.SavedObjectsRepository.addToNamespaces.$1",
-                "type": "string",
-                "tags": [],
-                "label": "type",
-                "description": [],
-                "signature": [
-                  "string"
-                ],
-                "source": {
-                  "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 1271
-                },
-                "deprecated": false,
-                "isRequired": true
-              },
-              {
-                "parentPluginId": "core",
-                "id": "def-server.SavedObjectsRepository.addToNamespaces.$2",
-                "type": "string",
-                "tags": [],
-                "label": "id",
-                "description": [],
-                "signature": [
-                  "string"
-                ],
-                "source": {
-                  "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 1272
-                },
-                "deprecated": false,
-                "isRequired": true
-              },
-              {
-                "parentPluginId": "core",
-                "id": "def-server.SavedObjectsRepository.addToNamespaces.$3",
+                "id": "def-server.SavedObjectsRepository.collectMultiNamespaceReferences.$1",
                 "type": "Array",
                 "tags": [],
-                "label": "namespaces",
-                "description": [],
+                "label": "objects",
+                "description": [
+                  "The objects to get the references for."
+                ],
                 "signature": [
-                  "string[]"
+                  {
+                    "pluginId": "core",
+                    "scope": "server",
+                    "docId": "kibCoreSavedObjectsPluginApi",
+                    "section": "def-server.SavedObjectsCollectMultiNamespaceReferencesObject",
+                    "text": "SavedObjectsCollectMultiNamespaceReferencesObject"
+                  },
+                  "[]"
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 1273
+                  "lineNumber": 1284
                 },
                 "deprecated": false,
                 "isRequired": true
               },
               {
                 "parentPluginId": "core",
-                "id": "def-server.SavedObjectsRepository.addToNamespaces.$4",
+                "id": "def-server.SavedObjectsRepository.collectMultiNamespaceReferences.$2",
                 "type": "Object",
                 "tags": [],
                 "label": "options",
@@ -6948,108 +6930,124 @@
                     "pluginId": "core",
                     "scope": "server",
                     "docId": "kibCoreSavedObjectsPluginApi",
-                    "section": "def-server.SavedObjectsAddToNamespacesOptions",
-                    "text": "SavedObjectsAddToNamespacesOptions"
-                  }
+                    "section": "def-server.SavedObjectsCollectMultiNamespaceReferencesOptions",
+                    "text": "SavedObjectsCollectMultiNamespaceReferencesOptions"
+                  },
+                  " | undefined"
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 1274
+                  "lineNumber": 1285
                 },
                 "deprecated": false,
-                "isRequired": true
+                "isRequired": false
               }
             ],
             "returnComment": []
           },
           {
             "parentPluginId": "core",
-            "id": "def-server.SavedObjectsRepository.deleteFromNamespaces",
+            "id": "def-server.SavedObjectsRepository.updateObjectsSpaces",
             "type": "Function",
             "tags": [],
-            "label": "deleteFromNamespaces",
+            "label": "updateObjectsSpaces",
             "description": [
-              "\nRemoves one or more namespaces from a given multi-namespace saved object. If no namespaces remain, the saved object is deleted\nentirely. This method and [`addToNamespaces`]{@link SavedObjectsRepository.addToNamespaces} are the only ways to change which Spaces a\nmulti-namespace saved object is shared to."
+              "\nUpdates one or more objects to add and/or remove them from specified spaces.\n"
             ],
             "signature": [
-              "(type: string, id: string, namespaces: string[], options?: ",
+              "(objects: ",
               {
                 "pluginId": "core",
                 "scope": "server",
                 "docId": "kibCoreSavedObjectsPluginApi",
-                "section": "def-server.SavedObjectsDeleteFromNamespacesOptions",
-                "text": "SavedObjectsDeleteFromNamespacesOptions"
+                "section": "def-server.SavedObjectsUpdateObjectsSpacesObject",
+                "text": "SavedObjectsUpdateObjectsSpacesObject"
               },
-              ") => Promise<",
+              "[], spacesToAdd: string[], spacesToRemove: string[], options?: ",
+              {
+                "pluginId": "core",
+                "scope": "server",
+                "docId": "kibCoreSavedObjectsPluginApi",
+                "section": "def-server.SavedObjectsUpdateObjectsSpacesOptions",
+                "text": "SavedObjectsUpdateObjectsSpacesOptions"
+              },
+              " | undefined) => Promise<",
               {
                 "pluginId": "core",
                 "scope": "server",
                 "docId": "kibCoreSavedObjectsPluginApi",
-                "section": "def-server.SavedObjectsDeleteFromNamespacesResponse",
-                "text": "SavedObjectsDeleteFromNamespacesResponse"
+                "section": "def-server.SavedObjectsUpdateObjectsSpacesResponse",
+                "text": "SavedObjectsUpdateObjectsSpacesResponse"
               },
               ">"
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/lib/repository.ts",
-              "lineNumber": 1333
+              "lineNumber": 1307
             },
             "deprecated": false,
             "children": [
               {
                 "parentPluginId": "core",
-                "id": "def-server.SavedObjectsRepository.deleteFromNamespaces.$1",
-                "type": "string",
+                "id": "def-server.SavedObjectsRepository.updateObjectsSpaces.$1",
+                "type": "Array",
                 "tags": [],
-                "label": "type",
+                "label": "objects",
                 "description": [],
                 "signature": [
-                  "string"
+                  {
+                    "pluginId": "core",
+                    "scope": "server",
+                    "docId": "kibCoreSavedObjectsPluginApi",
+                    "section": "def-server.SavedObjectsUpdateObjectsSpacesObject",
+                    "text": "SavedObjectsUpdateObjectsSpacesObject"
+                  },
+                  "[]"
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 1334
+                  "lineNumber": 1308
                 },
                 "deprecated": false,
                 "isRequired": true
               },
               {
                 "parentPluginId": "core",
-                "id": "def-server.SavedObjectsRepository.deleteFromNamespaces.$2",
-                "type": "string",
+                "id": "def-server.SavedObjectsRepository.updateObjectsSpaces.$2",
+                "type": "Array",
                 "tags": [],
-                "label": "id",
+                "label": "spacesToAdd",
                 "description": [],
                 "signature": [
-                  "string"
+                  "string[]"
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 1335
+                  "lineNumber": 1309
                 },
                 "deprecated": false,
                 "isRequired": true
               },
               {
                 "parentPluginId": "core",
-                "id": "def-server.SavedObjectsRepository.deleteFromNamespaces.$3",
+                "id": "def-server.SavedObjectsRepository.updateObjectsSpaces.$3",
                 "type": "Array",
                 "tags": [],
-                "label": "namespaces",
+                "label": "spacesToRemove",
                 "description": [],
                 "signature": [
                   "string[]"
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 1336
+                  "lineNumber": 1310
                 },
                 "deprecated": false,
                 "isRequired": true
               },
               {
                 "parentPluginId": "core",
-                "id": "def-server.SavedObjectsRepository.deleteFromNamespaces.$4",
+                "id": "def-server.SavedObjectsRepository.updateObjectsSpaces.$4",
                 "type": "Object",
                 "tags": [],
                 "label": "options",
@@ -7059,16 +7057,17 @@
                     "pluginId": "core",
                     "scope": "server",
                     "docId": "kibCoreSavedObjectsPluginApi",
-                    "section": "def-server.SavedObjectsDeleteFromNamespacesOptions",
-                    "text": "SavedObjectsDeleteFromNamespacesOptions"
-                  }
+                    "section": "def-server.SavedObjectsUpdateObjectsSpacesOptions",
+                    "text": "SavedObjectsUpdateObjectsSpacesOptions"
+                  },
+                  " | undefined"
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 1337
+                  "lineNumber": 1311
                 },
                 "deprecated": false,
-                "isRequired": true
+                "isRequired": false
               }
             ],
             "returnComment": []
@@ -7114,7 +7113,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/lib/repository.ts",
-              "lineNumber": 1439
+              "lineNumber": 1334
             },
             "deprecated": false,
             "children": [
@@ -7139,7 +7138,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 1440
+                  "lineNumber": 1335
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -7162,7 +7161,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 1441
+                  "lineNumber": 1336
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -7202,7 +7201,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/lib/repository.ts",
-              "lineNumber": 1658
+              "lineNumber": 1551
             },
             "deprecated": false,
             "children": [
@@ -7218,7 +7217,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 1659
+                  "lineNumber": 1552
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -7235,7 +7234,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 1660
+                  "lineNumber": 1553
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -7258,7 +7257,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 1661
+                  "lineNumber": 1554
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -7298,7 +7297,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/lib/repository.ts",
-              "lineNumber": 1769
+              "lineNumber": 1662
             },
             "deprecated": false,
             "children": [
@@ -7316,7 +7315,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 1770
+                  "lineNumber": 1663
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -7335,7 +7334,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 1771
+                  "lineNumber": 1664
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -7362,7 +7361,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 1772
+                  "lineNumber": 1665
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -7388,7 +7387,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 1773
+                  "lineNumber": 1666
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -7431,7 +7430,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/lib/repository.ts",
-              "lineNumber": 1929
+              "lineNumber": 1822
             },
             "deprecated": false,
             "children": [
@@ -7447,7 +7446,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 1930
+                  "lineNumber": 1823
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -7470,7 +7469,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 1931
+                  "lineNumber": 1824
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -7510,7 +7509,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/lib/repository.ts",
-              "lineNumber": 2002
+              "lineNumber": 1895
             },
             "deprecated": false,
             "children": [
@@ -7526,7 +7525,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 2003
+                  "lineNumber": 1896
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -7552,7 +7551,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 2004
+                  "lineNumber": 1897
                 },
                 "deprecated": false,
                 "isRequired": false
@@ -7572,7 +7571,7 @@
               "\nReturns a {@link ISavedObjectsPointInTimeFinder} to help page through\nlarge sets of saved objects. We strongly recommend using this API for\nany `find` queries that might return more than 1000 saved objects,\nhowever this API is only intended for use in server-side \"batch\"\nprocessing of objects where you are collecting all objects in memory\nor streaming them back to the client.\n\nDo NOT use this API in a route handler to facilitate paging through\nsaved objects on the client-side unless you are streaming all of the\nresults back to the client at once. Because the returned generator is\nstateful, you cannot rely on subsequent http requests retrieving new\npages from the same Kibana server in multi-instance deployments.\n\nThis generator wraps calls to {@link SavedObjectsRepository.find} and\niterates over multiple pages of results using `_pit` and `search_after`.\nThis will open a new Point-In-Time (PIT), and continue paging until a\nset of results is received that's smaller than the designated `perPage`.\n\nOnce you have retrieved all of the results you need, it is recommended\nto call `close()` to clean up the PIT and prevent Elasticsearch from\nconsuming resources unnecessarily. This is only required if you are\ndone iterating and have not yet paged through all of the results: the\nPIT will automatically be closed for you once you reach the last page\nof results, or if the underlying call to `find` fails for any reason.\n"
             ],
             "signature": [
-              "(findOptions: Pick<",
+              "<T = unknown, A = unknown>(findOptions: Pick<",
               {
                 "pluginId": "core",
                 "scope": "server",
@@ -7595,11 +7594,12 @@
                 "docId": "kibCoreSavedObjectsPluginApi",
                 "section": "def-server.ISavedObjectsPointInTimeFinder",
                 "text": "ISavedObjectsPointInTimeFinder"
-              }
+              },
+              "<T, A>"
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/lib/repository.ts",
-              "lineNumber": 2058
+              "lineNumber": 1951
             },
             "deprecated": false,
             "children": [
@@ -7623,7 +7623,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 2059
+                  "lineNumber": 1952
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -7647,7 +7647,7 @@
                 ],
                 "source": {
                   "path": "src/core/server/saved_objects/service/lib/repository.ts",
-                  "lineNumber": 2060
+                  "lineNumber": 1953
                 },
                 "deprecated": false,
                 "isRequired": false
@@ -7770,7 +7770,7 @@
               "\nConverts a document from the format that is stored in elasticsearch to the saved object client format.\n"
             ],
             "signature": [
-              "(doc: ",
+              "<T = unknown>(doc: ",
               {
                 "pluginId": "core",
                 "scope": "server",
@@ -7794,7 +7794,7 @@
                 "section": "def-server.SavedObjectSanitizedDoc",
                 "text": "SavedObjectSanitizedDoc"
               },
-              "<unknown>"
+              "<T>"
             ],
             "source": {
               "path": "src/core/server/saved_objects/serialization/serializer.ts",
@@ -8782,6 +8782,16 @@
         "tags": [],
         "label": "ISavedObjectsPointInTimeFinder",
         "description": [],
+        "signature": [
+          {
+            "pluginId": "core",
+            "scope": "server",
+            "docId": "kibCoreSavedObjectsPluginApi",
+            "section": "def-server.ISavedObjectsPointInTimeFinder",
+            "text": "ISavedObjectsPointInTimeFinder"
+          },
+          "<T, A>"
+        ],
         "source": {
           "path": "src/core/server/saved_objects/service/lib/point_in_time_finder.ts",
           "lineNumber": 42
@@ -8806,7 +8816,7 @@
                 "section": "def-server.SavedObjectsFindResponse",
                 "text": "SavedObjectsFindResponse"
               },
-              "<unknown, unknown>, any, unknown>"
+              "<T, A>, any, unknown>"
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/lib/point_in_time_finder.ts",
@@ -8891,6 +8901,24 @@
             },
             "deprecated": false
           },
+          {
+            "parentPluginId": "core",
+            "id": "def-server.SavedObjectExportBaseOptions.includeNamespaces",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "includeNamespaces",
+            "description": [
+              "\nFlag to also include namespace information in the export stream. By default, namespace information is not included in exported objects.\nThis is only intended to be used internally during copy-to-space operations, and it is not exposed as an option for the external HTTP\nroute for exports."
+            ],
+            "signature": [
+              "boolean | undefined"
+            ],
+            "source": {
+              "path": "src/core/server/saved_objects/export/types.ts",
+              "lineNumber": 23
+            },
+            "deprecated": false
+          },
           {
             "parentPluginId": "core",
             "id": "def-server.SavedObjectExportBaseOptions.excludeExportDetails",
@@ -8905,7 +8933,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/export/types.ts",
-              "lineNumber": 19
+              "lineNumber": 25
             },
             "deprecated": false
           },
@@ -8923,7 +8951,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/export/types.ts",
-              "lineNumber": 21
+              "lineNumber": 27
             },
             "deprecated": false
           }
@@ -9041,105 +9069,118 @@
       },
       {
         "parentPluginId": "core",
-        "id": "def-server.SavedObjectsAddToNamespacesOptions",
+        "id": "def-server.SavedObjectReferenceWithContext",
         "type": "Interface",
         "tags": [],
-        "label": "SavedObjectsAddToNamespacesOptions",
+        "label": "SavedObjectReferenceWithContext",
         "description": [
-          "\n"
-        ],
-        "signature": [
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCoreSavedObjectsPluginApi",
-            "section": "def-server.SavedObjectsAddToNamespacesOptions",
-            "text": "SavedObjectsAddToNamespacesOptions"
-          },
-          " extends ",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCoreSavedObjectsPluginApi",
-            "section": "def-server.SavedObjectsBaseOptions",
-            "text": "SavedObjectsBaseOptions"
-          }
+          "\nA returned input object or one of its references, with additional context.\n"
         ],
         "source": {
-          "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-          "lineNumber": 225
+          "path": "src/core/server/saved_objects/service/lib/collect_multi_namespace_references.ts",
+          "lineNumber": 66
         },
         "deprecated": false,
         "children": [
           {
             "parentPluginId": "core",
-            "id": "def-server.SavedObjectsAddToNamespacesOptions.version",
-            "type": "string",
+            "id": "def-server.SavedObjectReferenceWithContext.type",
+            "type": "string",
+            "tags": [],
+            "label": "type",
+            "description": [
+              "The type of the referenced object"
+            ],
+            "source": {
+              "path": "src/core/server/saved_objects/service/lib/collect_multi_namespace_references.ts",
+              "lineNumber": 68
+            },
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "core",
+            "id": "def-server.SavedObjectReferenceWithContext.id",
+            "type": "string",
+            "tags": [],
+            "label": "id",
+            "description": [
+              "The ID of the referenced object"
+            ],
+            "source": {
+              "path": "src/core/server/saved_objects/service/lib/collect_multi_namespace_references.ts",
+              "lineNumber": 70
+            },
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "core",
+            "id": "def-server.SavedObjectReferenceWithContext.spaces",
+            "type": "Array",
+            "tags": [],
+            "label": "spaces",
+            "description": [
+              "The space(s) that the referenced object exists in"
+            ],
+            "signature": [
+              "string[]"
+            ],
+            "source": {
+              "path": "src/core/server/saved_objects/service/lib/collect_multi_namespace_references.ts",
+              "lineNumber": 72
+            },
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "core",
+            "id": "def-server.SavedObjectReferenceWithContext.inboundReferences",
+            "type": "Array",
             "tags": [],
-            "label": "version",
+            "label": "inboundReferences",
             "description": [
-              "An opaque version number which changes on each successful write operation. Can be used for implementing optimistic concurrency control."
+              "\nReferences to this object; note that this does not contain _all inbound references everywhere for this object_, it only contains\ninbound references for the scope of this operation"
             ],
             "signature": [
-              "string | undefined"
+              "{ type: string; id: string; name: string; }[]"
             ],
             "source": {
-              "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 227
+              "path": "src/core/server/saved_objects/service/lib/collect_multi_namespace_references.ts",
+              "lineNumber": 77
             },
             "deprecated": false
           },
           {
             "parentPluginId": "core",
-            "id": "def-server.SavedObjectsAddToNamespacesOptions.refresh",
+            "id": "def-server.SavedObjectReferenceWithContext.isMissing",
             "type": "CompoundType",
             "tags": [],
-            "label": "refresh",
+            "label": "isMissing",
             "description": [
-              "The Elasticsearch Refresh setting for this operation"
+              "Whether or not this object or reference is missing"
             ],
             "signature": [
-              "boolean | \"wait_for\" | undefined"
+              "boolean | undefined"
             ],
             "source": {
-              "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 229
+              "path": "src/core/server/saved_objects/service/lib/collect_multi_namespace_references.ts",
+              "lineNumber": 86
             },
             "deprecated": false
-          }
-        ],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "core",
-        "id": "def-server.SavedObjectsAddToNamespacesResponse",
-        "type": "Interface",
-        "tags": [],
-        "label": "SavedObjectsAddToNamespacesResponse",
-        "description": [
-          "\n"
-        ],
-        "source": {
-          "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-          "lineNumber": 236
-        },
-        "deprecated": false,
-        "children": [
+          },
           {
             "parentPluginId": "core",
-            "id": "def-server.SavedObjectsAddToNamespacesResponse.namespaces",
+            "id": "def-server.SavedObjectReferenceWithContext.spacesWithMatchingAliases",
             "type": "Array",
             "tags": [],
-            "label": "namespaces",
+            "label": "spacesWithMatchingAliases",
             "description": [
-              "The namespaces the object exists in after this operation is complete."
+              "The space(s) that legacy URL aliases matching this type/id exist in"
             ],
             "signature": [
-              "string[]"
+              "string[] | undefined"
             ],
             "source": {
-              "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 238
+              "path": "src/core/server/saved_objects/service/lib/collect_multi_namespace_references.ts",
+              "lineNumber": 88
             },
             "deprecated": false
           }
@@ -9203,7 +9244,7 @@
         ],
         "source": {
           "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-          "lineNumber": 70
+          "lineNumber": 75
         },
         "deprecated": false,
         "children": [
@@ -9219,7 +9260,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 71
+              "lineNumber": 76
             },
             "deprecated": false
           },
@@ -9232,7 +9273,7 @@
             "description": [],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 72
+              "lineNumber": 77
             },
             "deprecated": false
           },
@@ -9248,7 +9289,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 73
+              "lineNumber": 78
             },
             "deprecated": false
           },
@@ -9264,7 +9305,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 74
+              "lineNumber": 79
             },
             "deprecated": false
           },
@@ -9281,7 +9322,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 75
+              "lineNumber": 80
             },
             "deprecated": false
           },
@@ -9300,7 +9341,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 77
+              "lineNumber": 82
             },
             "deprecated": false
           },
@@ -9318,7 +9359,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 87
+              "lineNumber": 92
             },
             "deprecated": false
           },
@@ -9336,7 +9377,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 89
+              "lineNumber": 94
             },
             "deprecated": false
           },
@@ -9354,7 +9395,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 96
+              "lineNumber": 101
             },
             "deprecated": false
           }
@@ -9372,7 +9413,7 @@
         ],
         "source": {
           "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-          "lineNumber": 301
+          "lineNumber": 268
         },
         "deprecated": false,
         "children": [
@@ -9385,7 +9426,7 @@
             "description": [],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 302
+              "lineNumber": 269
             },
             "deprecated": false
           },
@@ -9398,7 +9439,7 @@
             "description": [],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 303
+              "lineNumber": 270
             },
             "deprecated": false
           },
@@ -9416,7 +9457,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 305
+              "lineNumber": 272
             },
             "deprecated": false
           }
@@ -9444,7 +9485,7 @@
         ],
         "source": {
           "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-          "lineNumber": 124
+          "lineNumber": 129
         },
         "deprecated": false,
         "children": [
@@ -9461,7 +9502,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 125
+              "lineNumber": 130
             },
             "deprecated": false
           }
@@ -9489,7 +9530,7 @@
         ],
         "source": {
           "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-          "lineNumber": 312
+          "lineNumber": 279
         },
         "deprecated": false,
         "children": [
@@ -9506,7 +9547,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 313
+              "lineNumber": 280
             },
             "deprecated": false
           }
@@ -9542,7 +9583,7 @@
         ],
         "source": {
           "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-          "lineNumber": 103
+          "lineNumber": 108
         },
         "deprecated": false,
         "children": [
@@ -9557,7 +9598,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 106
+              "lineNumber": 111
             },
             "deprecated": false
           },
@@ -9572,7 +9613,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 108
+              "lineNumber": 113
             },
             "deprecated": false
           },
@@ -9590,7 +9631,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 110
+              "lineNumber": 115
             },
             "deprecated": false
           },
@@ -9608,7 +9649,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 117
+              "lineNumber": 122
             },
             "deprecated": false
           }
@@ -9643,7 +9684,7 @@
         ],
         "source": {
           "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-          "lineNumber": 281
+          "lineNumber": 248
         },
         "deprecated": false,
         "children": [
@@ -9661,7 +9702,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 283
+              "lineNumber": 250
             },
             "deprecated": false
           }
@@ -9689,7 +9730,7 @@
         ],
         "source": {
           "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-          "lineNumber": 320
+          "lineNumber": 287
         },
         "deprecated": false,
         "children": [
@@ -9712,7 +9753,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 321
+              "lineNumber": 288
             },
             "deprecated": false
           }
@@ -9730,7 +9771,7 @@
         ],
         "source": {
           "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-          "lineNumber": 189
+          "lineNumber": 194
         },
         "deprecated": false,
         "children": [
@@ -9743,7 +9784,7 @@
             "description": [],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 190
+              "lineNumber": 195
             },
             "deprecated": false
           },
@@ -9756,7 +9797,7 @@
             "description": [],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 191
+              "lineNumber": 196
             },
             "deprecated": false
           }
@@ -9774,7 +9815,7 @@
         ],
         "source": {
           "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-          "lineNumber": 198
+          "lineNumber": 203
         },
         "deprecated": false,
         "children": [
@@ -9792,7 +9833,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 199
+              "lineNumber": 204
             },
             "deprecated": false
           }
@@ -9880,7 +9921,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"addToNamespaces\" | \"deleteFromNamespaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
+              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/lib/scoped_client_provider.ts",
@@ -9947,7 +9988,7 @@
         "description": [],
         "source": {
           "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-          "lineNumber": 388
+          "lineNumber": 355
         },
         "deprecated": false,
         "children": [
@@ -9962,7 +10003,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 393
+              "lineNumber": 360
             },
             "deprecated": false
           },
@@ -9977,7 +10018,145 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 397
+              "lineNumber": 364
+            },
+            "deprecated": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "core",
+        "id": "def-server.SavedObjectsCollectMultiNamespaceReferencesObject",
+        "type": "Interface",
+        "tags": [],
+        "label": "SavedObjectsCollectMultiNamespaceReferencesObject",
+        "description": [
+          "\nAn object to collect references for. It must be a multi-namespace type (in other words, the object type must be registered with the\n`namespaceType: 'multiple'` or `namespaceType: 'multiple-isolated'` option).\n\nNote: if options.purpose is 'updateObjectsSpaces', it must be a shareable type (in other words, the object type must be registered with\nthe `namespaceType: 'multiple'`).\n"
+        ],
+        "source": {
+          "path": "src/core/server/saved_objects/service/lib/collect_multi_namespace_references.ts",
+          "lineNumber": 45
+        },
+        "deprecated": false,
+        "children": [
+          {
+            "parentPluginId": "core",
+            "id": "def-server.SavedObjectsCollectMultiNamespaceReferencesObject.id",
+            "type": "string",
+            "tags": [],
+            "label": "id",
+            "description": [],
+            "source": {
+              "path": "src/core/server/saved_objects/service/lib/collect_multi_namespace_references.ts",
+              "lineNumber": 46
+            },
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "core",
+            "id": "def-server.SavedObjectsCollectMultiNamespaceReferencesObject.type",
+            "type": "string",
+            "tags": [],
+            "label": "type",
+            "description": [],
+            "source": {
+              "path": "src/core/server/saved_objects/service/lib/collect_multi_namespace_references.ts",
+              "lineNumber": 47
+            },
+            "deprecated": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "core",
+        "id": "def-server.SavedObjectsCollectMultiNamespaceReferencesOptions",
+        "type": "Interface",
+        "tags": [],
+        "label": "SavedObjectsCollectMultiNamespaceReferencesOptions",
+        "description": [
+          "\nOptions for collecting references.\n"
+        ],
+        "signature": [
+          {
+            "pluginId": "core",
+            "scope": "server",
+            "docId": "kibCoreSavedObjectsPluginApi",
+            "section": "def-server.SavedObjectsCollectMultiNamespaceReferencesOptions",
+            "text": "SavedObjectsCollectMultiNamespaceReferencesOptions"
+          },
+          " extends ",
+          {
+            "pluginId": "core",
+            "scope": "server",
+            "docId": "kibCoreSavedObjectsPluginApi",
+            "section": "def-server.SavedObjectsBaseOptions",
+            "text": "SavedObjectsBaseOptions"
+          }
+        ],
+        "source": {
+          "path": "src/core/server/saved_objects/service/lib/collect_multi_namespace_references.ts",
+          "lineNumber": 55
+        },
+        "deprecated": false,
+        "children": [
+          {
+            "parentPluginId": "core",
+            "id": "def-server.SavedObjectsCollectMultiNamespaceReferencesOptions.purpose",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "purpose",
+            "description": [
+              "Optional purpose used to determine filtering and authorization checks; default is 'collectMultiNamespaceReferences'"
+            ],
+            "signature": [
+              "\"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | undefined"
+            ],
+            "source": {
+              "path": "src/core/server/saved_objects/service/lib/collect_multi_namespace_references.ts",
+              "lineNumber": 58
+            },
+            "deprecated": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "core",
+        "id": "def-server.SavedObjectsCollectMultiNamespaceReferencesResponse",
+        "type": "Interface",
+        "tags": [],
+        "label": "SavedObjectsCollectMultiNamespaceReferencesResponse",
+        "description": [
+          "\nThe response when object references are collected.\n"
+        ],
+        "source": {
+          "path": "src/core/server/saved_objects/service/lib/collect_multi_namespace_references.ts",
+          "lineNumber": 96
+        },
+        "deprecated": false,
+        "children": [
+          {
+            "parentPluginId": "core",
+            "id": "def-server.SavedObjectsCollectMultiNamespaceReferencesResponse.objects",
+            "type": "Array",
+            "tags": [],
+            "label": "objects",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "core",
+                "scope": "server",
+                "docId": "kibCoreSavedObjectsPluginApi",
+                "section": "def-server.SavedObjectReferenceWithContext",
+                "text": "SavedObjectReferenceWithContext"
+              },
+              "[]"
+            ],
+            "source": {
+              "path": "src/core/server/saved_objects/service/lib/collect_multi_namespace_references.ts",
+              "lineNumber": 97
             },
             "deprecated": false
           }
@@ -10213,7 +10392,7 @@
         ],
         "source": {
           "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-          "lineNumber": 30
+          "lineNumber": 35
         },
         "deprecated": false,
         "children": [
@@ -10231,7 +10410,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 32
+              "lineNumber": 37
             },
             "deprecated": false
           },
@@ -10249,7 +10428,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 34
+              "lineNumber": 39
             },
             "deprecated": false
           },
@@ -10267,7 +10446,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 39
+              "lineNumber": 44
             },
             "deprecated": false
           },
@@ -10286,7 +10465,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 41
+              "lineNumber": 46
             },
             "deprecated": false
           },
@@ -10304,7 +10483,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 51
+              "lineNumber": 56
             },
             "deprecated": false
           },
@@ -10321,7 +10500,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 52
+              "lineNumber": 57
             },
             "deprecated": false
           },
@@ -10339,7 +10518,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 54
+              "lineNumber": 59
             },
             "deprecated": false
           },
@@ -10357,7 +10536,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 56
+              "lineNumber": 61
             },
             "deprecated": false
           },
@@ -10375,7 +10554,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 63
+              "lineNumber": 68
             },
             "deprecated": false
           }
@@ -10411,7 +10590,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"addToNamespaces\" | \"deleteFromNamespaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, \"find\" | \"openPointInTimeForType\" | \"closePointInTime\">"
+              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, \"find\" | \"openPointInTimeForType\" | \"closePointInTime\">"
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/lib/point_in_time_finder.ts",
@@ -10449,115 +10628,26 @@
           }
         ],
         "source": {
-          "path": "src/core/server/saved_objects/service/lib/repository.ts",
-          "lineNumber": 132
-        },
-        "deprecated": false,
-        "children": [
-          {
-            "parentPluginId": "core",
-            "id": "def-server.SavedObjectsDeleteByNamespaceOptions.refresh",
-            "type": "CompoundType",
-            "tags": [],
-            "label": "refresh",
-            "description": [
-              "The Elasticsearch supports only boolean flag for this operation"
-            ],
-            "signature": [
-              "boolean | undefined"
-            ],
-            "source": {
-              "path": "src/core/server/saved_objects/service/lib/repository.ts",
-              "lineNumber": 134
-            },
-            "deprecated": false
-          }
-        ],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "core",
-        "id": "def-server.SavedObjectsDeleteFromNamespacesOptions",
-        "type": "Interface",
-        "tags": [],
-        "label": "SavedObjectsDeleteFromNamespacesOptions",
-        "description": [
-          "\n"
-        ],
-        "signature": [
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCoreSavedObjectsPluginApi",
-            "section": "def-server.SavedObjectsDeleteFromNamespacesOptions",
-            "text": "SavedObjectsDeleteFromNamespacesOptions"
-          },
-          " extends ",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCoreSavedObjectsPluginApi",
-            "section": "def-server.SavedObjectsBaseOptions",
-            "text": "SavedObjectsBaseOptions"
-          }
-        ],
-        "source": {
-          "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-          "lineNumber": 245
-        },
-        "deprecated": false,
-        "children": [
-          {
-            "parentPluginId": "core",
-            "id": "def-server.SavedObjectsDeleteFromNamespacesOptions.refresh",
-            "type": "CompoundType",
-            "tags": [],
-            "label": "refresh",
-            "description": [
-              "The Elasticsearch Refresh setting for this operation"
-            ],
-            "signature": [
-              "boolean | \"wait_for\" | undefined"
-            ],
-            "source": {
-              "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 247
-            },
-            "deprecated": false
-          }
-        ],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "core",
-        "id": "def-server.SavedObjectsDeleteFromNamespacesResponse",
-        "type": "Interface",
-        "tags": [],
-        "label": "SavedObjectsDeleteFromNamespacesResponse",
-        "description": [
-          "\n"
-        ],
-        "source": {
-          "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-          "lineNumber": 254
+          "path": "src/core/server/saved_objects/service/lib/repository.ts",
+          "lineNumber": 144
         },
         "deprecated": false,
         "children": [
           {
             "parentPluginId": "core",
-            "id": "def-server.SavedObjectsDeleteFromNamespacesResponse.namespaces",
-            "type": "Array",
+            "id": "def-server.SavedObjectsDeleteByNamespaceOptions.refresh",
+            "type": "CompoundType",
             "tags": [],
-            "label": "namespaces",
+            "label": "refresh",
             "description": [
-              "The namespaces the object exists in after this operation is complete. An empty array indicates the object was deleted."
+              "The Elasticsearch supports only boolean flag for this operation"
             ],
             "signature": [
-              "string[]"
+              "boolean | undefined"
             ],
             "source": {
-              "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 256
+              "path": "src/core/server/saved_objects/service/lib/repository.ts",
+              "lineNumber": 146
             },
             "deprecated": false
           }
@@ -10592,7 +10682,7 @@
         ],
         "source": {
           "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-          "lineNumber": 290
+          "lineNumber": 257
         },
         "deprecated": false,
         "children": [
@@ -10610,7 +10700,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 292
+              "lineNumber": 259
             },
             "deprecated": false
           },
@@ -10628,7 +10718,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 294
+              "lineNumber": 261
             },
             "deprecated": false
           }
@@ -10663,7 +10753,7 @@
         ],
         "source": {
           "path": "src/core/server/saved_objects/export/types.ts",
-          "lineNumber": 43
+          "lineNumber": 49
         },
         "deprecated": false,
         "children": [
@@ -10681,7 +10771,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/export/types.ts",
-              "lineNumber": 45
+              "lineNumber": 51
             },
             "deprecated": false
           }
@@ -10716,7 +10806,7 @@
         ],
         "source": {
           "path": "src/core/server/saved_objects/export/types.ts",
-          "lineNumber": 29
+          "lineNumber": 35
         },
         "deprecated": false,
         "children": [
@@ -10734,7 +10824,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/export/types.ts",
-              "lineNumber": 31
+              "lineNumber": 37
             },
             "deprecated": false
           },
@@ -10759,7 +10849,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/export/types.ts",
-              "lineNumber": 33
+              "lineNumber": 39
             },
             "deprecated": false
           },
@@ -10777,7 +10867,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/export/types.ts",
-              "lineNumber": 35
+              "lineNumber": 41
             },
             "deprecated": false
           }
@@ -10795,7 +10885,7 @@
         ],
         "source": {
           "path": "src/core/server/saved_objects/export/types.ts",
-          "lineNumber": 57
+          "lineNumber": 63
         },
         "deprecated": false,
         "children": [
@@ -10810,7 +10900,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/export/types.ts",
-              "lineNumber": 59
+              "lineNumber": 65
             },
             "deprecated": false
           },
@@ -10825,7 +10915,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/export/types.ts",
-              "lineNumber": 61
+              "lineNumber": 67
             },
             "deprecated": false
           },
@@ -10843,7 +10933,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/export/types.ts",
-              "lineNumber": 63
+              "lineNumber": 69
             },
             "deprecated": false
           }
@@ -10861,7 +10951,7 @@
         ],
         "source": {
           "path": "src/core/server/saved_objects/export/types.ts",
-          "lineNumber": 76
+          "lineNumber": 82
         },
         "deprecated": false,
         "children": [
@@ -10886,7 +10976,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/export/types.ts",
-              "lineNumber": 81
+              "lineNumber": 87
             },
             "deprecated": false
           }
@@ -11328,7 +11418,7 @@
         ],
         "source": {
           "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-          "lineNumber": 176
+          "lineNumber": 181
         },
         "deprecated": false,
         "children": [
@@ -11344,7 +11434,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 177
+              "lineNumber": 182
             },
             "deprecated": false
           },
@@ -11367,7 +11457,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 178
+              "lineNumber": 183
             },
             "deprecated": false
           },
@@ -11380,7 +11470,7 @@
             "description": [],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 179
+              "lineNumber": 184
             },
             "deprecated": false
           },
@@ -11393,7 +11483,7 @@
             "description": [],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 180
+              "lineNumber": 185
             },
             "deprecated": false
           },
@@ -11406,7 +11496,7 @@
             "description": [],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 181
+              "lineNumber": 186
             },
             "deprecated": false
           },
@@ -11422,7 +11512,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 182
+              "lineNumber": 187
             },
             "deprecated": false
           }
@@ -11452,7 +11542,7 @@
         ],
         "source": {
           "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-          "lineNumber": 132
+          "lineNumber": 137
         },
         "deprecated": false,
         "children": [
@@ -11467,7 +11557,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 136
+              "lineNumber": 141
             },
             "deprecated": false
           },
@@ -11485,7 +11575,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 165
+              "lineNumber": 170
             },
             "deprecated": false
           }
@@ -12524,7 +12614,7 @@
         "description": [],
         "source": {
           "path": "src/core/server/saved_objects/service/lib/repository.ts",
-          "lineNumber": 149
+          "lineNumber": 161
         },
         "deprecated": false,
         "children": [
@@ -12539,7 +12629,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/lib/repository.ts",
-              "lineNumber": 151
+              "lineNumber": 163
             },
             "deprecated": false
           },
@@ -12557,7 +12647,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/lib/repository.ts",
-              "lineNumber": 153
+              "lineNumber": 165
             },
             "deprecated": false
           }
@@ -12590,7 +12680,7 @@
         ],
         "source": {
           "path": "src/core/server/saved_objects/service/lib/repository.ts",
-          "lineNumber": 108
+          "lineNumber": 120
         },
         "deprecated": false,
         "children": [
@@ -12608,7 +12698,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/lib/repository.ts",
-              "lineNumber": 114
+              "lineNumber": 126
             },
             "deprecated": false
           },
@@ -12627,7 +12717,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/lib/repository.ts",
-              "lineNumber": 116
+              "lineNumber": 128
             },
             "deprecated": false
           },
@@ -12645,7 +12735,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/lib/repository.ts",
-              "lineNumber": 121
+              "lineNumber": 133
             },
             "deprecated": false
           },
@@ -12663,7 +12753,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/lib/repository.ts",
-              "lineNumber": 125
+              "lineNumber": 137
             },
             "deprecated": false
           }
@@ -12862,7 +12952,7 @@
         ],
         "source": {
           "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-          "lineNumber": 359
+          "lineNumber": 326
         },
         "deprecated": false,
         "children": [
@@ -12880,7 +12970,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 363
+              "lineNumber": 330
             },
             "deprecated": false
           },
@@ -12898,7 +12988,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 367
+              "lineNumber": 334
             },
             "deprecated": false
           }
@@ -12914,7 +13004,7 @@
         "description": [],
         "source": {
           "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-          "lineNumber": 373
+          "lineNumber": 340
         },
         "deprecated": false,
         "children": [
@@ -12929,7 +13019,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 377
+              "lineNumber": 344
             },
             "deprecated": false
           }
@@ -13124,7 +13214,7 @@
         ],
         "source": {
           "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-          "lineNumber": 263
+          "lineNumber": 230
         },
         "deprecated": false,
         "children": [
@@ -13142,7 +13232,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 265
+              "lineNumber": 232
             },
             "deprecated": false
           }
@@ -13177,7 +13267,7 @@
         ],
         "source": {
           "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-          "lineNumber": 272
+          "lineNumber": 239
         },
         "deprecated": false,
         "children": [
@@ -13192,7 +13282,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 274
+              "lineNumber": 241
             },
             "deprecated": false
           }
@@ -13240,7 +13330,7 @@
                 "section": "def-server.SavedObjectsRepository",
                 "text": "SavedObjectsRepository"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"deleteByNamespace\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"addToNamespaces\" | \"deleteFromNamespaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"incrementCounter\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\">"
+              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"deleteByNamespace\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"incrementCounter\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\">"
             ],
             "source": {
               "path": "src/core/server/saved_objects/saved_objects_service.ts",
@@ -13266,7 +13356,7 @@
                 "section": "def-server.SavedObjectsRepository",
                 "text": "SavedObjectsRepository"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"deleteByNamespace\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"addToNamespaces\" | \"deleteFromNamespaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"incrementCounter\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\">"
+              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"deleteByNamespace\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"incrementCounter\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\">"
             ],
             "source": {
               "path": "src/core/server/saved_objects/saved_objects_service.ts",
@@ -13392,7 +13482,7 @@
         ],
         "source": {
           "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-          "lineNumber": 338
+          "lineNumber": 305
         },
         "deprecated": false,
         "children": [
@@ -13409,7 +13499,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 339
+              "lineNumber": 306
             },
             "deprecated": false
           },
@@ -13427,7 +13517,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 349
+              "lineNumber": 316
             },
             "deprecated": false
           },
@@ -13445,7 +13535,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 353
+              "lineNumber": 320
             },
             "deprecated": false
           }
@@ -13597,7 +13687,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"addToNamespaces\" | \"deleteFromNamespaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
+              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
             ],
             "source": {
               "path": "src/core/server/saved_objects/saved_objects_service.ts",
@@ -13631,7 +13721,7 @@
                 "section": "def-server.SavedObjectsRepository",
                 "text": "SavedObjectsRepository"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"deleteByNamespace\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"addToNamespaces\" | \"deleteFromNamespaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"incrementCounter\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\">"
+              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"deleteByNamespace\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"incrementCounter\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\">"
             ],
             "source": {
               "path": "src/core/server/saved_objects/saved_objects_service.ts",
@@ -13657,7 +13747,7 @@
                 "section": "def-server.SavedObjectsRepository",
                 "text": "SavedObjectsRepository"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"deleteByNamespace\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"addToNamespaces\" | \"deleteFromNamespaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"incrementCounter\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\">"
+              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"deleteByNamespace\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"incrementCounter\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\">"
             ],
             "source": {
               "path": "src/core/server/saved_objects/saved_objects_service.ts",
@@ -13708,7 +13798,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"addToNamespaces\" | \"deleteFromNamespaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">) => Pick<",
+              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">) => Pick<",
               {
                 "pluginId": "core",
                 "scope": "server",
@@ -13742,7 +13832,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"addToNamespaces\" | \"deleteFromNamespaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">) => Pick<",
+              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">) => Pick<",
               {
                 "pluginId": "core",
                 "scope": "server",
@@ -14269,6 +14359,233 @@
         ],
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "core",
+        "id": "def-server.SavedObjectsUpdateObjectsSpacesObject",
+        "type": "Interface",
+        "tags": [],
+        "label": "SavedObjectsUpdateObjectsSpacesObject",
+        "description": [
+          "\nAn object that should have its spaces updated.\n"
+        ],
+        "source": {
+          "path": "src/core/server/saved_objects/service/lib/update_objects_spaces.ts",
+          "lineNumber": 34
+        },
+        "deprecated": false,
+        "children": [
+          {
+            "parentPluginId": "core",
+            "id": "def-server.SavedObjectsUpdateObjectsSpacesObject.id",
+            "type": "string",
+            "tags": [],
+            "label": "id",
+            "description": [
+              "The type of the object to update"
+            ],
+            "source": {
+              "path": "src/core/server/saved_objects/service/lib/update_objects_spaces.ts",
+              "lineNumber": 36
+            },
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "core",
+            "id": "def-server.SavedObjectsUpdateObjectsSpacesObject.type",
+            "type": "string",
+            "tags": [],
+            "label": "type",
+            "description": [
+              "The ID of the object to update"
+            ],
+            "source": {
+              "path": "src/core/server/saved_objects/service/lib/update_objects_spaces.ts",
+              "lineNumber": 38
+            },
+            "deprecated": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "core",
+        "id": "def-server.SavedObjectsUpdateObjectsSpacesOptions",
+        "type": "Interface",
+        "tags": [],
+        "label": "SavedObjectsUpdateObjectsSpacesOptions",
+        "description": [
+          "\nOptions for the update operation.\n"
+        ],
+        "signature": [
+          {
+            "pluginId": "core",
+            "scope": "server",
+            "docId": "kibCoreSavedObjectsPluginApi",
+            "section": "def-server.SavedObjectsUpdateObjectsSpacesOptions",
+            "text": "SavedObjectsUpdateObjectsSpacesOptions"
+          },
+          " extends ",
+          {
+            "pluginId": "core",
+            "scope": "server",
+            "docId": "kibCoreSavedObjectsPluginApi",
+            "section": "def-server.SavedObjectsBaseOptions",
+            "text": "SavedObjectsBaseOptions"
+          }
+        ],
+        "source": {
+          "path": "src/core/server/saved_objects/service/lib/update_objects_spaces.ts",
+          "lineNumber": 58
+        },
+        "deprecated": false,
+        "children": [
+          {
+            "parentPluginId": "core",
+            "id": "def-server.SavedObjectsUpdateObjectsSpacesOptions.refresh",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "refresh",
+            "description": [
+              "The Elasticsearch Refresh setting for this operation"
+            ],
+            "signature": [
+              "boolean | \"wait_for\" | undefined"
+            ],
+            "source": {
+              "path": "src/core/server/saved_objects/service/lib/update_objects_spaces.ts",
+              "lineNumber": 60
+            },
+            "deprecated": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "core",
+        "id": "def-server.SavedObjectsUpdateObjectsSpacesResponse",
+        "type": "Interface",
+        "tags": [],
+        "label": "SavedObjectsUpdateObjectsSpacesResponse",
+        "description": [
+          "\nThe response when objects' spaces are updated.\n"
+        ],
+        "source": {
+          "path": "src/core/server/saved_objects/service/lib/update_objects_spaces.ts",
+          "lineNumber": 68
+        },
+        "deprecated": false,
+        "children": [
+          {
+            "parentPluginId": "core",
+            "id": "def-server.SavedObjectsUpdateObjectsSpacesResponse.objects",
+            "type": "Array",
+            "tags": [],
+            "label": "objects",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "core",
+                "scope": "server",
+                "docId": "kibCoreSavedObjectsPluginApi",
+                "section": "def-server.SavedObjectsUpdateObjectsSpacesResponseObject",
+                "text": "SavedObjectsUpdateObjectsSpacesResponseObject"
+              },
+              "[]"
+            ],
+            "source": {
+              "path": "src/core/server/saved_objects/service/lib/update_objects_spaces.ts",
+              "lineNumber": 69
+            },
+            "deprecated": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "core",
+        "id": "def-server.SavedObjectsUpdateObjectsSpacesResponseObject",
+        "type": "Interface",
+        "tags": [],
+        "label": "SavedObjectsUpdateObjectsSpacesResponseObject",
+        "description": [
+          "\nDetails about a specific object's update result.\n"
+        ],
+        "source": {
+          "path": "src/core/server/saved_objects/service/lib/update_objects_spaces.ts",
+          "lineNumber": 77
+        },
+        "deprecated": false,
+        "children": [
+          {
+            "parentPluginId": "core",
+            "id": "def-server.SavedObjectsUpdateObjectsSpacesResponseObject.type",
+            "type": "string",
+            "tags": [],
+            "label": "type",
+            "description": [
+              "The type of the referenced object"
+            ],
+            "source": {
+              "path": "src/core/server/saved_objects/service/lib/update_objects_spaces.ts",
+              "lineNumber": 79
+            },
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "core",
+            "id": "def-server.SavedObjectsUpdateObjectsSpacesResponseObject.id",
+            "type": "string",
+            "tags": [],
+            "label": "id",
+            "description": [
+              "The ID of the referenced object"
+            ],
+            "source": {
+              "path": "src/core/server/saved_objects/service/lib/update_objects_spaces.ts",
+              "lineNumber": 81
+            },
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "core",
+            "id": "def-server.SavedObjectsUpdateObjectsSpacesResponseObject.spaces",
+            "type": "Array",
+            "tags": [],
+            "label": "spaces",
+            "description": [
+              "The space(s) that the referenced object exists in"
+            ],
+            "signature": [
+              "string[]"
+            ],
+            "source": {
+              "path": "src/core/server/saved_objects/service/lib/update_objects_spaces.ts",
+              "lineNumber": 83
+            },
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "core",
+            "id": "def-server.SavedObjectsUpdateObjectsSpacesResponseObject.error",
+            "type": "Object",
+            "tags": [],
+            "label": "error",
+            "description": [
+              "Included if there was an error updating this object's spaces"
+            ],
+            "signature": [
+              "SavedObjectError",
+              " | undefined"
+            ],
+            "source": {
+              "path": "src/core/server/saved_objects/service/lib/update_objects_spaces.ts",
+              "lineNumber": 85
+            },
+            "deprecated": false
+          }
+        ],
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "core",
         "id": "def-server.SavedObjectsUpdateOptions",
@@ -14297,7 +14614,7 @@
         ],
         "source": {
           "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-          "lineNumber": 210
+          "lineNumber": 215
         },
         "deprecated": false,
         "children": [
@@ -14315,7 +14632,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 212
+              "lineNumber": 217
             },
             "deprecated": false
           },
@@ -14334,7 +14651,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 214
+              "lineNumber": 219
             },
             "deprecated": false
           },
@@ -14352,7 +14669,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 216
+              "lineNumber": 221
             },
             "deprecated": false
           },
@@ -14370,7 +14687,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 218
+              "lineNumber": 223
             },
             "deprecated": false
           }
@@ -14400,7 +14717,7 @@
         ],
         "source": {
           "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-          "lineNumber": 328
+          "lineNumber": 295
         },
         "deprecated": false,
         "children": [
@@ -14416,7 +14733,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 330
+              "lineNumber": 297
             },
             "deprecated": false
           },
@@ -14433,7 +14750,7 @@
             ],
             "source": {
               "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-              "lineNumber": 331
+              "lineNumber": 298
             },
             "deprecated": false
           }
@@ -14491,11 +14808,27 @@
           "\nSee {@link SavedObjectsRepository}\n"
         ],
         "signature": [
-          "{ get: <T = unknown>(type: string, id: string, options?: SavedObjectsBaseOptions) => Promise<SavedObject<T>>; delete: (type: string, id: string, options?: SavedObjectsDeleteOptions) => Promise<{}>; create: <T = unknown>(type: string, attributes: T, options?: SavedObjectsCreateOptions) => Promise<SavedObject<T>>; bulkCreate: <T = unknown>(objects: SavedObjectsBulkCreateObject<T>[], options?: SavedObjectsCreateOptions) => Promise<SavedObjectsBulkResponse<T>>; checkConflicts: (objects?: SavedObjectsCheckConflictsObject[], options?: SavedObjectsBaseOptions) => Promise<SavedObjectsCheckConflictsResponse>; deleteByNamespace: (namespace: string, options?: SavedObjectsDeleteByNamespaceOptions) => Promise<any>; find: <T = unknown, A = unknown>(options: SavedObjectsFindOptions) => Promise<SavedObjectsFindResponse<T, A>>; bulkGet: <T = unknown>(objects?: SavedObjectsBulkGetObject[], options?: SavedObjectsBaseOptions) => Promise<SavedObjectsBulkResponse<T>>; resolve: <T = unknown>(type: string, id: string, options?: SavedObjectsBaseOptions) => Promise<SavedObjectsResolveResponse<T>>; update: <T = unknown>(type: string, id: string, attributes: Partial<T>, options?: SavedObjectsUpdateOptions<T>) => Promise<SavedObjectsUpdateResponse<T>>; addToNamespaces: (type: string, id: string, namespaces: string[], options?: SavedObjectsAddToNamespacesOptions) => Promise<SavedObjectsAddToNamespacesResponse>; deleteFromNamespaces: (type: string, id: string, namespaces: string[], options?: SavedObjectsDeleteFromNamespacesOptions) => Promise<SavedObjectsDeleteFromNamespacesResponse>; bulkUpdate: <T = unknown>(objects: SavedObjectsBulkUpdateObject<T>[], options?: SavedObjectsBulkUpdateOptions) => Promise<SavedObjectsBulkUpdateResponse<T>>; removeReferencesTo: (type: string, id: string, options?: SavedObjectsRemoveReferencesToOptions) => Promise<SavedObjectsRemoveReferencesToResponse>; incrementCounter: <T>(type: string, id: string, counterFields: (string | SavedObjectsIncrementCounterField)[], options?: SavedObjectsIncrementCounterOptions<T>) => Promise<SavedObject<T>>; openPointInTimeForType: (type: string | string[], { keepAlive, preference }?: SavedObjectsOpenPointInTimeOptions) => Promise<SavedObjectsOpenPointInTimeResponse>; closePointInTime: (id: string, options?: SavedObjectsBaseOptions | undefined) => Promise<SavedObjectsClosePointInTimeResponse>; createPointInTimeFinder: (findOptions: Pick<SavedObjectsFindOptions, \"type\" | \"filter\" | \"aggs\" | \"fields\" | \"preference\" | \"perPage\" | \"sortField\" | \"sortOrder\" | \"search\" | \"searchFields\" | \"rootSearchFields\" | \"hasReference\" | \"hasReferenceOperator\" | \"defaultSearchOperator\" | \"namespaces\" | \"typeToNamespacesMap\">, dependencies?: SavedObjectsCreatePointInTimeFinderDependencies | undefined) => ISavedObjectsPointInTimeFinder; }"
+          "{ get: <T = unknown>(type: string, id: string, options?: SavedObjectsBaseOptions) => Promise<SavedObject<T>>; delete: (type: string, id: string, options?: SavedObjectsDeleteOptions) => Promise<{}>; create: <T = unknown>(type: string, attributes: T, options?: SavedObjectsCreateOptions) => Promise<SavedObject<T>>; bulkCreate: <T = unknown>(objects: SavedObjectsBulkCreateObject<T>[], options?: SavedObjectsCreateOptions) => Promise<SavedObjectsBulkResponse<T>>; checkConflicts: (objects?: SavedObjectsCheckConflictsObject[], options?: SavedObjectsBaseOptions) => Promise<SavedObjectsCheckConflictsResponse>; deleteByNamespace: (namespace: string, options?: SavedObjectsDeleteByNamespaceOptions) => Promise<any>; find: <T = unknown, A = unknown>(options: SavedObjectsFindOptions) => Promise<SavedObjectsFindResponse<T, A>>; bulkGet: <T = unknown>(objects?: SavedObjectsBulkGetObject[], options?: SavedObjectsBaseOptions) => Promise<SavedObjectsBulkResponse<T>>; resolve: <T = unknown>(type: string, id: string, options?: SavedObjectsBaseOptions) => Promise<SavedObjectsResolveResponse<T>>; update: <T = unknown>(type: string, id: string, attributes: Partial<T>, options?: SavedObjectsUpdateOptions<T>) => Promise<SavedObjectsUpdateResponse<T>>; collectMultiNamespaceReferences: (objects: SavedObjectsCollectMultiNamespaceReferencesObject[], options?: SavedObjectsCollectMultiNamespaceReferencesOptions | undefined) => Promise<",
+          {
+            "pluginId": "core",
+            "scope": "server",
+            "docId": "kibCoreSavedObjectsPluginApi",
+            "section": "def-server.SavedObjectsCollectMultiNamespaceReferencesResponse",
+            "text": "SavedObjectsCollectMultiNamespaceReferencesResponse"
+          },
+          ">; updateObjectsSpaces: (objects: SavedObjectsUpdateObjectsSpacesObject[], spacesToAdd: string[], spacesToRemove: string[], options?: SavedObjectsUpdateObjectsSpacesOptions | undefined) => Promise<",
+          {
+            "pluginId": "core",
+            "scope": "server",
+            "docId": "kibCoreSavedObjectsPluginApi",
+            "section": "def-server.SavedObjectsUpdateObjectsSpacesResponse",
+            "text": "SavedObjectsUpdateObjectsSpacesResponse"
+          },
+          ">; bulkUpdate: <T = unknown>(objects: SavedObjectsBulkUpdateObject<T>[], options?: SavedObjectsBulkUpdateOptions) => Promise<SavedObjectsBulkUpdateResponse<T>>; removeReferencesTo: (type: string, id: string, options?: SavedObjectsRemoveReferencesToOptions) => Promise<SavedObjectsRemoveReferencesToResponse>; incrementCounter: <T>(type: string, id: string, counterFields: (string | SavedObjectsIncrementCounterField)[], options?: SavedObjectsIncrementCounterOptions<T>) => Promise<SavedObject<T>>; openPointInTimeForType: (type: string | string[], { keepAlive, preference }?: SavedObjectsOpenPointInTimeOptions) => Promise<SavedObjectsOpenPointInTimeResponse>; closePointInTime: (id: string, options?: SavedObjectsBaseOptions | undefined) => Promise<SavedObjectsClosePointInTimeResponse>; createPointInTimeFinder: <T = unknown, A = unknown>(findOptions: Pick<SavedObjectsFindOptions, \"type\" | \"filter\" | \"aggs\" | \"fields\" | \"preference\" | \"perPage\" | \"sortField\" | \"sortOrder\" | \"search\" | \"searchFields\" | \"rootSearchFields\" | \"hasReference\" | \"hasReferenceOperator\" | \"defaultSearchOperator\" | \"namespaces\" | \"typeToNamespacesMap\">, dependencies?: SavedObjectsCreatePointInTimeFinderDependencies | undefined) => ISavedObjectsPointInTimeFinder<T, A>; }"
         ],
         "source": {
           "path": "src/core/server/saved_objects/service/lib/repository.ts",
-          "lineNumber": 144
+          "lineNumber": 156
         },
         "deprecated": false,
         "initialIsOpen": false
@@ -14684,7 +15017,7 @@
             "section": "def-server.SavedObjectsClient",
             "text": "SavedObjectsClient"
           },
-          ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"addToNamespaces\" | \"deleteFromNamespaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
+          ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
         ],
         "source": {
           "path": "src/core/server/saved_objects/service/lib/scoped_client_provider.ts",
@@ -14753,7 +15086,7 @@
             "section": "def-server.SavedObjectsClient",
             "text": "SavedObjectsClient"
           },
-          ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"addToNamespaces\" | \"deleteFromNamespaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
+          ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
         ],
         "source": {
           "path": "src/core/server/saved_objects/service/lib/scoped_client_provider.ts",
@@ -14774,7 +15107,7 @@
         ],
         "source": {
           "path": "src/core/server/saved_objects/service/saved_objects_client.ts",
-          "lineNumber": 383
+          "lineNumber": 350
         },
         "deprecated": false,
         "initialIsOpen": false
@@ -14840,7 +15173,7 @@
         ],
         "source": {
           "path": "src/core/server/saved_objects/export/types.ts",
-          "lineNumber": 155
+          "lineNumber": 161
         },
         "deprecated": false,
         "initialIsOpen": false
diff --git a/api_docs/dashboard.json b/api_docs/dashboard.json
index 94bd115676741..d0f43a2be22d5 100644
--- a/api_docs/dashboard.json
+++ b/api_docs/dashboard.json
@@ -2390,7 +2390,7 @@
             "section": "def-server.SavedObjectsRepository",
             "text": "SavedObjectsRepository"
           },
-          ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"deleteByNamespace\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"addToNamespaces\" | \"deleteFromNamespaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"incrementCounter\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\">, \"find\">, embeddableType: string) => Promise<{ [key: string]: unknown; }[]>"
+          ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"deleteByNamespace\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"incrementCounter\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\">, \"find\">, embeddableType: string) => Promise<{ [key: string]: unknown; }[]>"
         ],
         "source": {
           "path": "src/plugins/dashboard/server/usage/find_by_value_embeddables.ts",
@@ -2414,7 +2414,7 @@
                 "section": "def-server.SavedObjectsRepository",
                 "text": "SavedObjectsRepository"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"deleteByNamespace\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"addToNamespaces\" | \"deleteFromNamespaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"incrementCounter\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\">, \"find\">"
+              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"deleteByNamespace\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"incrementCounter\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\">, \"find\">"
             ],
             "source": {
               "path": "src/plugins/dashboard/server/usage/find_by_value_embeddables.ts",
diff --git a/api_docs/data.json b/api_docs/data.json
index 4a794bce5581a..61266aa0212b0 100644
--- a/api_docs/data.json
+++ b/api_docs/data.json
@@ -15774,10 +15774,10 @@
               },
               {
                 "parentPluginId": "data",
-                "id": "def-public.search.aggs.Ipv4Address",
+                "id": "def-public.search.aggs.IpAddress",
                 "type": "Object",
                 "tags": [],
-                "label": "Ipv4Address",
+                "label": "IpAddress",
                 "description": [],
                 "signature": [
                   "typeof ",
@@ -15785,8 +15785,8 @@
                     "pluginId": "data",
                     "scope": "common",
                     "docId": "kibDataSearchPluginApi",
-                    "section": "def-common.Ipv4Address",
-                    "text": "Ipv4Address"
+                    "section": "def-common.IpAddress",
+                    "text": "IpAddress"
                   }
                 ],
                 "source": {
@@ -16921,7 +16921,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"addToNamespaces\" | \"deleteFromNamespaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, elasticsearchClient: ",
+              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, elasticsearchClient: ",
               {
                 "pluginId": "core",
                 "scope": "server",
@@ -24541,10 +24541,10 @@
               },
               {
                 "parentPluginId": "data",
-                "id": "def-server.search.aggs.Ipv4Address",
+                "id": "def-server.search.aggs.IpAddress",
                 "type": "Object",
                 "tags": [],
-                "label": "Ipv4Address",
+                "label": "IpAddress",
                 "description": [],
                 "signature": [
                   "typeof ",
@@ -24552,8 +24552,8 @@
                     "pluginId": "data",
                     "scope": "common",
                     "docId": "kibDataSearchPluginApi",
-                    "section": "def-common.Ipv4Address",
-                    "text": "Ipv4Address"
+                    "section": "def-common.IpAddress",
+                    "text": "IpAddress"
                   }
                 ],
                 "source": {
@@ -27980,15 +27980,7 @@
             "section": "def-common.RangeFilterParams",
             "text": "RangeFilterParams"
           },
-          ") => { script: { source: string; params: Partial<",
-          {
-            "pluginId": "data",
-            "scope": "common",
-            "docId": "kibDataPluginApi",
-            "section": "def-common.RangeFilterParams",
-            "text": "RangeFilterParams"
-          },
-          ">; lang: string | undefined; }; }"
+          ") => { script: { source: string; params: { from?: string | number | undefined; to?: string | number | undefined; gt?: string | number | undefined; lt?: string | number | undefined; gte?: string | number | undefined; lte?: string | number | undefined; format?: string | number | undefined; }; lang: string | undefined; }; }"
         ],
         "source": {
           "path": "src/plugins/data/common/es_query/filters/range_filter.ts",
diff --git a/api_docs/data_index_patterns.json b/api_docs/data_index_patterns.json
index 47d73399e5aef..5e4fa735c76ed 100644
--- a/api_docs/data_index_patterns.json
+++ b/api_docs/data_index_patterns.json
@@ -508,7 +508,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"addToNamespaces\" | \"deleteFromNamespaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, elasticsearchClient: ",
+              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, elasticsearchClient: ",
               {
                 "pluginId": "core",
                 "scope": "server",
diff --git a/api_docs/data_search.json b/api_docs/data_search.json
index da5701b50ed0f..d430fe4dce19e 100644
--- a/api_docs/data_search.json
+++ b/api_docs/data_search.json
@@ -2632,7 +2632,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"addToNamespaces\" | \"deleteFromNamespaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
+              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
             ],
             "source": {
               "path": "src/plugins/data/server/search/types.ts",
@@ -6265,45 +6265,10 @@
         "description": [],
         "source": {
           "path": "src/plugins/data/common/search/aggs/buckets/lib/cidr_mask.ts",
-          "lineNumber": 17
+          "lineNumber": 12
         },
         "deprecated": false,
         "children": [
-          {
-            "parentPluginId": "data",
-            "id": "def-common.CidrMask.initialAddress",
-            "type": "Object",
-            "tags": [],
-            "label": "initialAddress",
-            "description": [],
-            "signature": [
-              {
-                "pluginId": "data",
-                "scope": "common",
-                "docId": "kibDataSearchPluginApi",
-                "section": "def-common.Ipv4Address",
-                "text": "Ipv4Address"
-              }
-            ],
-            "source": {
-              "path": "src/plugins/data/common/search/aggs/buckets/lib/cidr_mask.ts",
-              "lineNumber": 18
-            },
-            "deprecated": false
-          },
-          {
-            "parentPluginId": "data",
-            "id": "def-common.CidrMask.prefixLength",
-            "type": "number",
-            "tags": [],
-            "label": "prefixLength",
-            "description": [],
-            "source": {
-              "path": "src/plugins/data/common/search/aggs/buckets/lib/cidr_mask.ts",
-              "lineNumber": 19
-            },
-            "deprecated": false
-          },
           {
             "parentPluginId": "data",
             "id": "def-common.CidrMask.Unnamed",
@@ -6316,7 +6281,7 @@
             ],
             "source": {
               "path": "src/plugins/data/common/search/aggs/buckets/lib/cidr_mask.ts",
-              "lineNumber": 21
+              "lineNumber": 16
             },
             "deprecated": false,
             "children": [
@@ -6325,14 +6290,14 @@
                 "id": "def-common.CidrMask.Unnamed.$1",
                 "type": "string",
                 "tags": [],
-                "label": "mask",
+                "label": "cidr",
                 "description": [],
                 "signature": [
                   "string"
                 ],
                 "source": {
                   "path": "src/plugins/data/common/search/aggs/buckets/lib/cidr_mask.ts",
-                  "lineNumber": 21
+                  "lineNumber": 16
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -6352,7 +6317,7 @@
             ],
             "source": {
               "path": "src/plugins/data/common/search/aggs/buckets/lib/cidr_mask.ts",
-              "lineNumber": 33
+              "lineNumber": 55
             },
             "deprecated": false,
             "children": [],
@@ -6370,7 +6335,7 @@
             ],
             "source": {
               "path": "src/plugins/data/common/search/aggs/buckets/lib/cidr_mask.ts",
-              "lineNumber": 44
+              "lineNumber": 62
             },
             "deprecated": false,
             "children": [],
@@ -6755,20 +6720,20 @@
       },
       {
         "parentPluginId": "data",
-        "id": "def-common.Ipv4Address",
+        "id": "def-common.IpAddress",
         "type": "Class",
         "tags": [],
-        "label": "Ipv4Address",
+        "label": "IpAddress",
         "description": [],
         "source": {
-          "path": "src/plugins/data/common/search/aggs/utils/ipv4_address.ts",
-          "lineNumber": 22
+          "path": "src/plugins/data/common/search/aggs/utils/ip_address.ts",
+          "lineNumber": 15
         },
         "deprecated": false,
         "children": [
           {
             "parentPluginId": "data",
-            "id": "def-common.Ipv4Address.Unnamed",
+            "id": "def-common.IpAddress.Unnamed",
             "type": "Function",
             "tags": [],
             "label": "Constructor",
@@ -6777,24 +6742,24 @@
               "any"
             ],
             "source": {
-              "path": "src/plugins/data/common/search/aggs/utils/ipv4_address.ts",
-              "lineNumber": 25
+              "path": "src/plugins/data/common/search/aggs/utils/ip_address.ts",
+              "lineNumber": 18
             },
             "deprecated": false,
             "children": [
               {
                 "parentPluginId": "data",
-                "id": "def-common.Ipv4Address.Unnamed.$1",
+                "id": "def-common.IpAddress.Unnamed.$1",
                 "type": "CompoundType",
                 "tags": [],
                 "label": "ipAddress",
                 "description": [],
                 "signature": [
-                  "React.ReactText"
+                  "string | number | number[]"
                 ],
                 "source": {
-                  "path": "src/plugins/data/common/search/aggs/utils/ipv4_address.ts",
-                  "lineNumber": 25
+                  "path": "src/plugins/data/common/search/aggs/utils/ip_address.ts",
+                  "lineNumber": 18
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -6804,7 +6769,7 @@
           },
           {
             "parentPluginId": "data",
-            "id": "def-common.Ipv4Address.toString",
+            "id": "def-common.IpAddress.toString",
             "type": "Function",
             "tags": [],
             "label": "toString",
@@ -6813,8 +6778,8 @@
               "() => string"
             ],
             "source": {
-              "path": "src/plugins/data/common/search/aggs/utils/ipv4_address.ts",
-              "lineNumber": 50
+              "path": "src/plugins/data/common/search/aggs/utils/ip_address.ts",
+              "lineNumber": 28
             },
             "deprecated": false,
             "children": [],
@@ -6822,17 +6787,17 @@
           },
           {
             "parentPluginId": "data",
-            "id": "def-common.Ipv4Address.valueOf",
+            "id": "def-common.IpAddress.valueOf",
             "type": "Function",
             "tags": [],
             "label": "valueOf",
             "description": [],
             "signature": [
-              "() => number"
+              "() => number | bigint"
             ],
             "source": {
-              "path": "src/plugins/data/common/search/aggs/utils/ipv4_address.ts",
-              "lineNumber": 60
+              "path": "src/plugins/data/common/search/aggs/utils/ip_address.ts",
+              "lineNumber": 36
             },
             "deprecated": false,
             "children": [],
diff --git a/api_docs/deprecations.mdx b/api_docs/deprecations.mdx
index 76cbb0728b2a3..1bcc9be043ffa 100644
--- a/api_docs/deprecations.mdx
+++ b/api_docs/deprecations.mdx
@@ -155,10 +155,10 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 
 | Deprecated API | Reference location | Remove By |
 | ---------------|-----------|-----------|
-| <DocLink id="kibCorePluginApi" section="def-server.AsyncPlugin" text="AsyncPlugin"/> | [plugin.ts#L15](https://github.com/elastic/kibana/tree/master/x-pack/plugins/fleet/server/plugin.ts#L15) | - |
+| <DocLink id="kibCorePluginApi" section="def-server.AsyncPlugin" text="AsyncPlugin"/> | [plugin.ts#L14](https://github.com/elastic/kibana/tree/master/x-pack/plugins/fleet/server/plugin.ts#L14) | - |
 | <DocLink id="kibCorePluginApi" section="def-server.AsyncPlugin" text="AsyncPlugin"/> | [plugin.ts#L189](https://github.com/elastic/kibana/tree/master/x-pack/plugins/fleet/server/plugin.ts#L189) | - |
 | <DocLink id="kibCorePluginApi" section="def-server.AsyncPlugin" text="AsyncPlugin"/> | [plugin.d.ts#L2](https://github.com/elastic/kibana/tree/master/x-pack/plugins/fleet/target/types/server/plugin.d.ts#L2) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.AsyncPlugin" text="AsyncPlugin"/> | [plugin.d.ts#L83](https://github.com/elastic/kibana/tree/master/x-pack/plugins/fleet/target/types/server/plugin.d.ts#L83) | - |
+| <DocLink id="kibCorePluginApi" section="def-server.AsyncPlugin" text="AsyncPlugin"/> | [plugin.d.ts#L84](https://github.com/elastic/kibana/tree/master/x-pack/plugins/fleet/target/types/server/plugin.d.ts#L84) | - |
 
 
 
@@ -251,7 +251,6 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 
 | Deprecated API | Reference location | Remove By |
 | ---------------|-----------|-----------|
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.formatErrors" text="formatErrors"/> | [siem_server_deps.ts#L24](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/server/siem_server_deps.ts#L24) | - |
 | <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_call_cluster.mock.ts#L9](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/server/schemas/common/get_call_cluster.mock.ts#L9) | 7.16 |
 | <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_call_cluster.mock.ts#L27](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/server/schemas/common/get_call_cluster.mock.ts#L27) | 7.16 |
 | <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_call_cluster.mock.ts#L31](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/server/schemas/common/get_call_cluster.mock.ts#L31) | 7.16 |
diff --git a/api_docs/fleet.json b/api_docs/fleet.json
index 433d47e94dd29..1affecee5b32e 100644
--- a/api_docs/fleet.json
+++ b/api_docs/fleet.json
@@ -1866,7 +1866,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"addToNamespaces\" | \"deleteFromNamespaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, id: string, withPackagePolicies?: boolean) => Promise<",
+              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, id: string, withPackagePolicies?: boolean) => Promise<",
               {
                 "pluginId": "fleet",
                 "scope": "common",
@@ -1898,7 +1898,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"addToNamespaces\" | \"deleteFromNamespaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, options: Readonly<{ page?: number | undefined; perPage?: number | undefined; sortField?: string | undefined; sortOrder?: \"asc\" | \"desc\" | undefined; kuery?: any; showUpgradeable?: boolean | undefined; } & {}> & { withPackagePolicies?: boolean | undefined; }) => Promise<{ items: ",
+              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, options: Readonly<{ page?: number | undefined; perPage?: number | undefined; sortField?: string | undefined; sortOrder?: \"asc\" | \"desc\" | undefined; kuery?: any; showUpgradeable?: boolean | undefined; } & {}> & { withPackagePolicies?: boolean | undefined; }) => Promise<{ items: ",
               {
                 "pluginId": "fleet",
                 "scope": "common",
@@ -1930,7 +1930,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"addToNamespaces\" | \"deleteFromNamespaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">) => Promise<string>"
+              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">) => Promise<string>"
             ],
             "source": {
               "path": "x-pack/plugins/fleet/server/services/index.ts",
@@ -1954,7 +1954,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"addToNamespaces\" | \"deleteFromNamespaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, id: string, options?: { standalone: boolean; } | undefined) => Promise<",
+              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, id: string, options?: { standalone: boolean; } | undefined) => Promise<",
               {
                 "pluginId": "fleet",
                 "scope": "common",
@@ -2561,7 +2561,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"addToNamespaces\" | \"deleteFromNamespaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, pkgName: string, datasetPath: string) => Promise<string | undefined>"
+              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, pkgName: string, datasetPath: string) => Promise<string | undefined>"
             ],
             "source": {
               "path": "x-pack/plugins/fleet/server/services/index.ts",
@@ -2585,7 +2585,7 @@
                     "section": "def-server.SavedObjectsClient",
                     "text": "SavedObjectsClient"
                   },
-                  ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"addToNamespaces\" | \"deleteFromNamespaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
+                  ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
                 ],
                 "source": {
                   "path": "x-pack/plugins/fleet/server/services/index.ts",
@@ -2643,7 +2643,7 @@
         "description": [],
         "source": {
           "path": "x-pack/plugins/fleet/server/plugin.ts",
-          "lineNumber": 91
+          "lineNumber": 90
         },
         "deprecated": false,
         "children": [
@@ -2665,7 +2665,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/fleet/server/plugin.ts",
-              "lineNumber": 92
+              "lineNumber": 91
             },
             "deprecated": false
           },
@@ -2688,7 +2688,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/fleet/server/plugin.ts",
-              "lineNumber": 93
+              "lineNumber": 92
             },
             "deprecated": false
           },
@@ -2711,7 +2711,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/fleet/server/plugin.ts",
-              "lineNumber": 94
+              "lineNumber": 93
             },
             "deprecated": false
           },
@@ -2733,7 +2733,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/fleet/server/plugin.ts",
-              "lineNumber": 95
+              "lineNumber": 94
             },
             "deprecated": false
           },
@@ -2756,7 +2756,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/fleet/server/plugin.ts",
-              "lineNumber": 96
+              "lineNumber": 95
             },
             "deprecated": false
           },
@@ -2779,7 +2779,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/fleet/server/plugin.ts",
-              "lineNumber": 97
+              "lineNumber": 96
             },
             "deprecated": false
           }
@@ -2817,7 +2817,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"addToNamespaces\" | \"deleteFromNamespaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, pkgName: string) => Promise<",
+              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">, pkgName: string) => Promise<",
               {
                 "pluginId": "fleet",
                 "scope": "common",
@@ -2849,7 +2849,7 @@
                     "section": "def-server.SavedObjectsClient",
                     "text": "SavedObjectsClient"
                   },
-                  ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"addToNamespaces\" | \"deleteFromNamespaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
+                  ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
                 ],
                 "source": {
                   "path": "x-pack/plugins/fleet/server/services/index.ts",
@@ -2971,7 +2971,7 @@
         ],
         "source": {
           "path": "x-pack/plugins/fleet/server/services/package_policy.ts",
-          "lineNumber": 650
+          "lineNumber": 651
         },
         "deprecated": false,
         "initialIsOpen": false
@@ -3479,7 +3479,7 @@
         ],
         "source": {
           "path": "x-pack/plugins/fleet/common/types/index.ts",
-          "lineNumber": 44
+          "lineNumber": 35
         },
         "deprecated": false,
         "initialIsOpen": false
@@ -5977,7 +5977,7 @@
             "label": "agents",
             "description": [],
             "signature": [
-              "{ enabled: boolean; tlsCheckDisabled: boolean; pollingRequestTimeout: number; maxConcurrentConnections: number; kibana: { host?: string | string[] | undefined; ca_sha256?: string | undefined; }; elasticsearch: { host?: string | undefined; ca_sha256?: string | undefined; }; fleet_server?: { hosts?: string[] | undefined; } | undefined; agentPolicyRolloutRateLimitIntervalMs: number; agentPolicyRolloutRateLimitRequestPerInterval: number; }"
+              "{ enabled: boolean; elasticsearch: { host?: string | undefined; ca_sha256?: string | undefined; }; fleet_server?: { hosts?: string[] | undefined; } | undefined; }"
             ],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/index.ts",
@@ -6004,7 +6004,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/index.ts",
-              "lineNumber": 35
+              "lineNumber": 26
             },
             "deprecated": false
           },
@@ -6028,7 +6028,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/index.ts",
-              "lineNumber": 36
+              "lineNumber": 27
             },
             "deprecated": false
           }
@@ -15628,7 +15628,7 @@
         ],
         "source": {
           "path": "x-pack/plugins/fleet/common/types/index.ts",
-          "lineNumber": 49
+          "lineNumber": 40
         },
         "deprecated": false,
         "initialIsOpen": false
diff --git a/api_docs/global_search.json b/api_docs/global_search.json
index e0db9993b8597..a264a3f46736d 100644
--- a/api_docs/global_search.json
+++ b/api_docs/global_search.json
@@ -719,7 +719,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"addToNamespaces\" | \"deleteFromNamespaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">; typeRegistry: Pick<",
+              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">; typeRegistry: Pick<",
               {
                 "pluginId": "core",
                 "scope": "server",
diff --git a/api_docs/kibana_react.json b/api_docs/kibana_react.json
index 0edb7b93454ed..f795d9d983dd1 100644
--- a/api_docs/kibana_react.json
+++ b/api_docs/kibana_react.json
@@ -675,7 +675,7 @@
         ],
         "source": {
           "path": "src/plugins/kibana_react/public/code_editor/index.tsx",
-          "lineNumber": 34
+          "lineNumber": 36
         },
         "deprecated": false,
         "children": [
@@ -693,7 +693,7 @@
             ],
             "source": {
               "path": "src/plugins/kibana_react/public/code_editor/index.tsx",
-              "lineNumber": 34
+              "lineNumber": 36
             },
             "deprecated": false,
             "isRequired": true
@@ -718,7 +718,7 @@
         ],
         "source": {
           "path": "src/plugins/kibana_react/public/code_editor/index.tsx",
-          "lineNumber": 48
+          "lineNumber": 50
         },
         "deprecated": false,
         "children": [
@@ -736,7 +736,7 @@
             ],
             "source": {
               "path": "src/plugins/kibana_react/public/code_editor/index.tsx",
-              "lineNumber": 48
+              "lineNumber": 50
             },
             "deprecated": false,
             "isRequired": true
@@ -3429,7 +3429,9 @@
             "label": "onChange",
             "description": [],
             "signature": [
-              "(value: string) => void"
+              "(value: string, event: ",
+              "editor",
+              ".IModelContentChangedEvent) => void"
             ],
             "source": {
               "path": "src/plugins/kibana_react/public/url_template_editor/url_template_editor.tsx",
@@ -3592,6 +3594,23 @@
         "deprecated": false,
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "kibanaReact",
+        "id": "def-public.CodeEditorProps",
+        "type": "Type",
+        "tags": [],
+        "label": "CodeEditorProps",
+        "description": [],
+        "signature": [
+          "Props"
+        ],
+        "source": {
+          "path": "src/plugins/kibana_react/public/code_editor/index.tsx",
+          "lineNumber": 29
+        },
+        "deprecated": false,
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "kibanaReact",
         "id": "def-public.KibanaPageTemplateProps",
diff --git a/api_docs/lens.json b/api_docs/lens.json
index b8200895a7486..aecc135e45cc5 100644
--- a/api_docs/lens.json
+++ b/api_docs/lens.json
@@ -672,7 +672,7 @@
         "description": [],
         "source": {
           "path": "x-pack/plugins/lens/public/types.ts",
-          "lineNumber": 358
+          "lineNumber": 363
         },
         "deprecated": false,
         "children": [
@@ -694,7 +694,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/lens/public/types.ts",
-              "lineNumber": 360
+              "lineNumber": 365
             },
             "deprecated": false
           },
@@ -707,7 +707,7 @@
             "description": [],
             "source": {
               "path": "x-pack/plugins/lens/public/types.ts",
-              "lineNumber": 363
+              "lineNumber": 368
             },
             "deprecated": false
           },
@@ -725,7 +725,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/lens/public/types.ts",
-              "lineNumber": 369
+              "lineNumber": 374
             },
             "deprecated": false
           }
@@ -1654,11 +1654,11 @@
         "label": "DataType",
         "description": [],
         "signature": [
-          "\"string\" | \"number\" | \"boolean\" | \"date\" | \"ip\" | \"histogram\" | \"document\""
+          "\"string\" | \"number\" | \"boolean\" | \"date\" | \"ip\" | \"geo_point\" | \"geo_shape\" | \"histogram\" | \"document\""
         ],
         "source": {
           "path": "x-pack/plugins/lens/public/types.ts",
-          "lineNumber": 347
+          "lineNumber": 352
         },
         "deprecated": false,
         "initialIsOpen": false
diff --git a/api_docs/licensing.json b/api_docs/licensing.json
index 093ebeebfb355..bd019bc41119b 100644
--- a/api_docs/licensing.json
+++ b/api_docs/licensing.json
@@ -939,7 +939,7 @@
               "plugin": "security",
               "link": {
                 "path": "x-pack/plugins/security/public/plugin.tsx",
-                "lineNumber": 89
+                "lineNumber": 82
               }
             },
             {
@@ -2618,7 +2618,7 @@
               "plugin": "fleet",
               "link": {
                 "path": "x-pack/plugins/fleet/server/plugin.ts",
-                "lineNumber": 211
+                "lineNumber": 213
               }
             },
             {
diff --git a/api_docs/lists.json b/api_docs/lists.json
index fb258fa0ac0a2..04536bc29ae10 100644
--- a/api_docs/lists.json
+++ b/api_docs/lists.json
@@ -281,7 +281,7 @@
         "signature": [
           "({ http, signal, }: ",
           "AddEndpointExceptionListProps",
-          ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; id: string; immutable: boolean; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"endpoint\" | \"detection\" | \"endpoint_events\"; updated_at: string; updated_by: string; version: number; } | {}>"
+          ") => Promise<{ _version: string | undefined; created_at: any; created_by: any; description: any; id: any; immutable: boolean; list_id: any; meta: any; name: any; namespace_type: any; os_types: any; tags: any; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; version: number; } | {}>"
         ],
         "source": {
           "path": "x-pack/plugins/lists/public/exceptions/api.ts",
@@ -320,7 +320,7 @@
         "signature": [
           "({ http, listItem, signal, }: ",
           "AddExceptionListItemProps",
-          ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
+          ") => Promise<{ _version: string | undefined; comments: any; created_at: any; created_by: any; description: any; entries: any; id: any; item_id: any; list_id: any; meta: any; name: any; namespace_type: any; os_types: any; tags: any; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; }>"
         ],
         "source": {
           "path": "x-pack/plugins/lists/public/exceptions/api.ts",
@@ -359,7 +359,7 @@
         "signature": [
           "({ http, list, signal, }: ",
           "AddExceptionListProps",
-          ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; id: string; immutable: boolean; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"endpoint\" | \"detection\" | \"endpoint_events\"; updated_at: string; updated_by: string; version: number; }>"
+          ") => Promise<{ _version: string | undefined; created_at: any; created_by: any; description: any; id: any; immutable: boolean; list_id: any; meta: any; name: any; namespace_type: any; os_types: any; tags: any; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; version: number; }>"
         ],
         "source": {
           "path": "x-pack/plugins/lists/public/exceptions/api.ts",
@@ -437,7 +437,7 @@
         "signature": [
           "({ http, id, namespaceType, signal, }: ",
           "ApiCallByIdProps",
-          ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; id: string; immutable: boolean; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"endpoint\" | \"detection\" | \"endpoint_events\"; updated_at: string; updated_by: string; version: number; }>"
+          ") => Promise<{ _version: string | undefined; created_at: any; created_by: any; description: any; id: any; immutable: boolean; list_id: any; meta: any; name: any; namespace_type: any; os_types: any; tags: any; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; version: number; }>"
         ],
         "source": {
           "path": "x-pack/plugins/lists/public/exceptions/api.ts",
@@ -474,7 +474,7 @@
         "label": "transformNewItemOutput",
         "description": [],
         "signature": [
-          "(exceptionItem: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) => { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
+          "(exceptionItem: { description: any; entries: any; list_id: any; name: any; type: any; } & { comments?: any; item_id?: any; meta?: any; namespace_type?: any; os_types?: any; tags?: any; }) => { description: any; entries: any; list_id: any; name: any; type: any; } & { comments?: any; item_id?: any; meta?: any; namespace_type?: any; os_types?: any; tags?: any; }"
         ],
         "source": {
           "path": "x-pack/plugins/lists/public/exceptions/transforms.ts",
@@ -490,7 +490,7 @@
             "label": "exceptionItem",
             "description": [],
             "signature": [
-              "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
+              "{ description: any; entries: any; list_id: any; name: any; type: any; } & { comments?: any; item_id?: any; meta?: any; namespace_type?: any; os_types?: any; tags?: any; }"
             ],
             "source": {
               "path": "x-pack/plugins/lists/public/exceptions/transforms.ts",
@@ -513,7 +513,7 @@
           "\nTransforms the output of exception items to compensate for technical debt or UI concerns such as\nReactJS preferences for having ids within arrays if the data is not modeled that way.\n\nIf you add a new transform of the output called \"myNewTransform\" do it\nin the form of:\nflow(removeIdFromExceptionItemsEntries, myNewTransform)(exceptionItem)\n"
         ],
         "signature": [
-          "(exceptionItem: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })) => { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })"
+          "(exceptionItem: { _version: string | undefined; comments: any; created_at: any; created_by: any; description: any; entries: any; id: any; item_id: any; list_id: any; meta: any; name: any; namespace_type: any; os_types: any; tags: any; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; } | ({ description: any; entries: any; name: any; type: any; } & { _version?: string | undefined; comments?: any; id?: any; item_id?: string | undefined; meta?: any; namespace_type?: any; os_types?: any; tags?: any; })) => { _version: string | undefined; comments: any; created_at: any; created_by: any; description: any; entries: any; id: any; item_id: any; list_id: any; meta: any; name: any; namespace_type: any; os_types: any; tags: any; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; } | ({ description: any; entries: any; name: any; type: any; } & { _version?: string | undefined; comments?: any; id?: any; item_id?: string | undefined; meta?: any; namespace_type?: any; os_types?: any; tags?: any; })"
         ],
         "source": {
           "path": "x-pack/plugins/lists/public/exceptions/transforms.ts",
@@ -529,7 +529,7 @@
             "label": "exceptionItem",
             "description": [],
             "signature": [
-              "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })"
+              "{ _version: string | undefined; comments: any; created_at: any; created_by: any; description: any; entries: any; id: any; item_id: any; list_id: any; meta: any; name: any; namespace_type: any; os_types: any; tags: any; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; } | ({ description: any; entries: any; name: any; type: any; } & { _version?: string | undefined; comments?: any; id?: any; item_id?: string | undefined; meta?: any; namespace_type?: any; os_types?: any; tags?: any; })"
             ],
             "source": {
               "path": "x-pack/plugins/lists/public/exceptions/transforms.ts",
@@ -554,7 +554,7 @@
         "signature": [
           "({ http, listItem, signal, }: ",
           "UpdateExceptionListItemProps",
-          ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
+          ") => Promise<{ _version: string | undefined; comments: any; created_at: any; created_by: any; description: any; entries: any; id: any; item_id: any; list_id: any; meta: any; name: any; namespace_type: any; os_types: any; tags: any; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; }>"
         ],
         "source": {
           "path": "x-pack/plugins/lists/public/exceptions/api.ts",
@@ -756,7 +756,7 @@
           "OptionalSignalArgs",
           "<",
           "DeleteListParams",
-          ">], { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; }>"
+          ">], { _version: string | undefined; created_at: any; created_by: any; description: any; deserializer: string | undefined; id: any; immutable: boolean; meta: any; name: any; serializer: string | undefined; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; version: number; }>"
         ],
         "source": {
           "path": "x-pack/plugins/lists/public/lists/hooks/use_delete_list.ts",
@@ -890,7 +890,7 @@
           "OptionalSignalArgs",
           "<",
           "FindListsParams",
-          ">], { cursor: string; data: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; }[]; page: number; per_page: number; total: number; }>"
+          ">], { cursor: string; data: { _version: string | undefined; created_at: any; created_by: any; description: any; deserializer: string | undefined; id: any; immutable: boolean; meta: any; name: any; serializer: string | undefined; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; version: number; }[]; page: number; per_page: number; total: number; }>"
         ],
         "source": {
           "path": "x-pack/plugins/lists/public/lists/hooks/use_find_lists.ts",
@@ -915,7 +915,7 @@
           "OptionalSignalArgs",
           "<",
           "ImportListParams",
-          ">], { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; }>"
+          ">], { _version: string | undefined; created_at: any; created_by: any; description: any; deserializer: string | undefined; id: any; immutable: boolean; meta: any; name: any; serializer: string | undefined; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; version: number; }>"
         ],
         "source": {
           "path": "x-pack/plugins/lists/public/lists/hooks/use_import_list.ts",
@@ -1143,7 +1143,7 @@
             "section": "def-public.ExceptionList",
             "text": "ExceptionList"
           },
-          " extends { _version: string | undefined; created_at: string; created_by: string; description: string; id: string; immutable: boolean; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"endpoint\" | \"detection\" | \"endpoint_events\"; updated_at: string; updated_by: string; version: number; }"
+          " extends { _version: string | undefined; created_at: any; created_by: any; description: any; id: any; immutable: boolean; list_id: any; meta: any; name: any; namespace_type: any; os_types: any; tags: any; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; version: number; }"
         ],
         "source": {
           "path": "x-pack/plugins/lists/public/exceptions/types.ts",
@@ -1305,12 +1305,12 @@
           {
             "parentPluginId": "lists",
             "id": "def-public.ExceptionListIdentifiers.namespaceType",
-            "type": "CompoundType",
+            "type": "Any",
             "tags": [],
             "label": "namespaceType",
             "description": [],
             "signature": [
-              "\"single\" | \"agnostic\""
+              "any"
             ],
             "source": {
               "path": "x-pack/plugins/lists/public/exceptions/types.ts",
@@ -1321,12 +1321,12 @@
           {
             "parentPluginId": "lists",
             "id": "def-public.ExceptionListIdentifiers.type",
-            "type": "CompoundType",
+            "type": "Any",
             "tags": [],
             "label": "type",
             "description": [],
             "signature": [
-              "\"endpoint\" | \"detection\" | \"endpoint_events\""
+              "any"
             ],
             "source": {
               "path": "x-pack/plugins/lists/public/exceptions/types.ts",
@@ -1416,7 +1416,7 @@
             "label": "exceptions",
             "description": [],
             "signature": [
-              "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]"
+              "{ _version: string | undefined; comments: any; created_at: any; created_by: any; description: any; entries: any; id: any; item_id: any; list_id: any; meta: any; name: any; namespace_type: any; os_types: any; tags: any; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; }[]"
             ],
             "source": {
               "path": "x-pack/plugins/lists/public/exceptions/types.ts",
@@ -1470,7 +1470,7 @@
             "label": "exceptions",
             "description": [],
             "signature": [
-              "{ _version: string | undefined; created_at: string; created_by: string; description: string; id: string; immutable: boolean; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"endpoint\" | \"detection\" | \"endpoint_events\"; updated_at: string; updated_by: string; version: number; }[]"
+              "{ _version: string | undefined; created_at: any; created_by: any; description: any; id: any; immutable: boolean; list_id: any; meta: any; name: any; namespace_type: any; os_types: any; tags: any; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; version: number; }[]"
             ],
             "source": {
               "path": "x-pack/plugins/lists/public/exceptions/types.ts",
@@ -1620,7 +1620,7 @@
             "signature": [
               "({ listId, id, namespaceType, }: ",
               "GetExceptionListOptions",
-              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; id: string; immutable: boolean; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"endpoint\" | \"detection\" | \"endpoint_events\"; updated_at: string; updated_by: string; version: number; } | null>"
+              ") => Promise<{ _version: string | undefined; created_at: any; created_by: any; description: any; id: any; immutable: boolean; list_id: any; meta: any; name: any; namespace_type: any; os_types: any; tags: any; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; version: number; } | null>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
@@ -1658,7 +1658,7 @@
             "signature": [
               "({ itemId, id, namespaceType, }: ",
               "GetExceptionListItemOptions",
-              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
+              ") => Promise<{ _version: string | undefined; comments: any; created_at: any; created_by: any; description: any; entries: any; id: any; item_id: any; list_id: any; meta: any; name: any; namespace_type: any; os_types: any; tags: any; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; } | null>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
@@ -1696,7 +1696,7 @@
               "\nThis creates an agnostic space endpoint list if it does not exist. This tries to be\nas fast as possible by ignoring conflict errors and not returning the contents of the\nlist if it already exists."
             ],
             "signature": [
-              "() => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; id: string; immutable: boolean; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"endpoint\" | \"detection\" | \"endpoint_events\"; updated_at: string; updated_by: string; version: number; } | null>"
+              "() => Promise<{ _version: string | undefined; created_at: any; created_by: any; description: any; id: any; immutable: boolean; list_id: any; meta: any; name: any; namespace_type: any; os_types: any; tags: any; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; version: number; } | null>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
@@ -1718,7 +1718,7 @@
               "\nCreate the Trusted Apps Agnostic list if it does not yet exist (`null` is returned if it does exist)"
             ],
             "signature": [
-              "() => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; id: string; immutable: boolean; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"endpoint\" | \"detection\" | \"endpoint_events\"; updated_at: string; updated_by: string; version: number; } | null>"
+              "() => Promise<{ _version: string | undefined; created_at: any; created_by: any; description: any; id: any; immutable: boolean; list_id: any; meta: any; name: any; namespace_type: any; os_types: any; tags: any; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; version: number; } | null>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
@@ -1738,7 +1738,7 @@
               "\nCreate the Endpoint Event Filters Agnostic list if it does not yet exist (`null` is returned if it does exist)"
             ],
             "signature": [
-              "() => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; id: string; immutable: boolean; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"endpoint\" | \"detection\" | \"endpoint_events\"; updated_at: string; updated_by: string; version: number; } | null>"
+              "() => Promise<{ _version: string | undefined; created_at: any; created_by: any; description: any; id: any; immutable: boolean; list_id: any; meta: any; name: any; namespace_type: any; os_types: any; tags: any; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; version: number; } | null>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
@@ -1760,7 +1760,7 @@
             "signature": [
               "({ comments, description, entries, itemId, meta, name, osTypes, tags, type, }: ",
               "CreateEndpointListItemOptions",
-              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
+              ") => Promise<{ _version: string | undefined; comments: any; created_at: any; created_by: any; description: any; entries: any; id: any; item_id: any; list_id: any; meta: any; name: any; namespace_type: any; os_types: any; tags: any; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; }>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
@@ -1800,7 +1800,7 @@
             "signature": [
               "({ _version, comments, description, entries, id, itemId, meta, name, osTypes, tags, type, }: ",
               "UpdateEndpointListItemOptions",
-              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
+              ") => Promise<{ _version: string | undefined; comments: any; created_at: any; created_by: any; description: any; entries: any; id: any; item_id: any; list_id: any; meta: any; name: any; namespace_type: any; os_types: any; tags: any; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; } | null>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
@@ -1840,7 +1840,7 @@
             "signature": [
               "({ itemId, id, }: ",
               "GetEndpointListItemOptions",
-              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
+              ") => Promise<{ _version: string | undefined; comments: any; created_at: any; created_by: any; description: any; entries: any; id: any; item_id: any; list_id: any; meta: any; name: any; namespace_type: any; os_types: any; tags: any; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; } | null>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
@@ -1878,7 +1878,7 @@
             "signature": [
               "({ description, immutable, listId, meta, name, namespaceType, tags, type, version, }: ",
               "CreateExceptionListOptions",
-              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; id: string; immutable: boolean; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"endpoint\" | \"detection\" | \"endpoint_events\"; updated_at: string; updated_by: string; version: number; }>"
+              ") => Promise<{ _version: string | undefined; created_at: any; created_by: any; description: any; id: any; immutable: boolean; list_id: any; meta: any; name: any; namespace_type: any; os_types: any; tags: any; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; version: number; }>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
@@ -1916,7 +1916,7 @@
             "signature": [
               "({ _version, id, description, listId, meta, name, namespaceType, osTypes, tags, type, version, }: ",
               "UpdateExceptionListOptions",
-              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; id: string; immutable: boolean; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"endpoint\" | \"detection\" | \"endpoint_events\"; updated_at: string; updated_by: string; version: number; } | null>"
+              ") => Promise<{ _version: string | undefined; created_at: any; created_by: any; description: any; id: any; immutable: boolean; list_id: any; meta: any; name: any; namespace_type: any; os_types: any; tags: any; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; version: number; } | null>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
@@ -1954,7 +1954,7 @@
             "signature": [
               "({ id, listId, namespaceType, }: ",
               "DeleteExceptionListOptions",
-              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; id: string; immutable: boolean; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"endpoint\" | \"detection\" | \"endpoint_events\"; updated_at: string; updated_by: string; version: number; } | null>"
+              ") => Promise<{ _version: string | undefined; created_at: any; created_by: any; description: any; id: any; immutable: boolean; list_id: any; meta: any; name: any; namespace_type: any; os_types: any; tags: any; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; version: number; } | null>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
@@ -1998,7 +1998,7 @@
                 "section": "def-server.CreateExceptionListItemOptions",
                 "text": "CreateExceptionListItemOptions"
               },
-              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
+              ") => Promise<{ _version: string | undefined; comments: any; created_at: any; created_by: any; description: any; entries: any; id: any; item_id: any; list_id: any; meta: any; name: any; namespace_type: any; os_types: any; tags: any; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; }>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
@@ -2048,7 +2048,7 @@
                 "section": "def-server.UpdateExceptionListItemOptions",
                 "text": "UpdateExceptionListItemOptions"
               },
-              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
+              ") => Promise<{ _version: string | undefined; comments: any; created_at: any; created_by: any; description: any; entries: any; id: any; item_id: any; list_id: any; meta: any; name: any; namespace_type: any; os_types: any; tags: any; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; } | null>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
@@ -2092,7 +2092,7 @@
             "signature": [
               "({ id, itemId, namespaceType, }: ",
               "DeleteExceptionListItemOptions",
-              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
+              ") => Promise<{ _version: string | undefined; comments: any; created_at: any; created_by: any; description: any; entries: any; id: any; item_id: any; list_id: any; meta: any; name: any; namespace_type: any; os_types: any; tags: any; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; } | null>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
@@ -2170,7 +2170,7 @@
             "signature": [
               "({ id, itemId, }: ",
               "DeleteEndpointListItemOptions",
-              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
+              ") => Promise<{ _version: string | undefined; comments: any; created_at: any; created_by: any; description: any; entries: any; id: any; item_id: any; list_id: any; meta: any; name: any; namespace_type: any; os_types: any; tags: any; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; } | null>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
@@ -2208,7 +2208,7 @@
             "signature": [
               "({ listId, filter, perPage, page, sortField, sortOrder, namespaceType, }: ",
               "FindExceptionListItemOptions",
-              ") => Promise<{ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } | null>"
+              ") => Promise<{ data: { _version: string | undefined; comments: any; created_at: any; created_by: any; description: any; entries: any; id: any; item_id: any; list_id: any; meta: any; name: any; namespace_type: any; os_types: any; tags: any; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; }[]; page: number; per_page: number; total: number; } | null>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
@@ -2246,7 +2246,7 @@
             "signature": [
               "({ listId, filter, perPage, page, sortField, sortOrder, namespaceType, }: ",
               "FindExceptionListsItemOptions",
-              ") => Promise<{ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } | null>"
+              ") => Promise<{ data: { _version: string | undefined; comments: any; created_at: any; created_by: any; description: any; entries: any; id: any; item_id: any; list_id: any; meta: any; name: any; namespace_type: any; os_types: any; tags: any; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; }[]; page: number; per_page: number; total: number; } | null>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
@@ -2284,7 +2284,7 @@
             "signature": [
               "({ perPage, page, sortField, sortOrder, valueListId, }: ",
               "FindValueListExceptionListsItems",
-              ") => Promise<{ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } | null>"
+              ") => Promise<{ data: { _version: string | undefined; comments: any; created_at: any; created_by: any; description: any; entries: any; id: any; item_id: any; list_id: any; meta: any; name: any; namespace_type: any; os_types: any; tags: any; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; }[]; page: number; per_page: number; total: number; } | null>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
@@ -2322,7 +2322,7 @@
             "signature": [
               "({ filter, perPage, page, sortField, sortOrder, namespaceType, }: ",
               "FindExceptionListOptions",
-              ") => Promise<{ data: { _version: string | undefined; created_at: string; created_by: string; description: string; id: string; immutable: boolean; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"endpoint\" | \"detection\" | \"endpoint_events\"; updated_at: string; updated_by: string; version: number; }[]; page: number; per_page: number; total: number; }>"
+              ") => Promise<{ data: { _version: string | undefined; created_at: any; created_by: any; description: any; id: any; immutable: boolean; list_id: any; meta: any; name: any; namespace_type: any; os_types: any; tags: any; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; version: number; }[]; page: number; per_page: number; total: number; }>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
@@ -2362,7 +2362,7 @@
             "signature": [
               "({ filter, perPage, page, sortField, sortOrder, }: ",
               "FindEndpointListItemOptions",
-              ") => Promise<{ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } | null>"
+              ") => Promise<{ data: { _version: string | undefined; comments: any; created_at: any; created_by: any; description: any; entries: any; id: any; item_id: any; list_id: any; meta: any; name: any; namespace_type: any; os_types: any; tags: any; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; }[]; page: number; per_page: number; total: number; } | null>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
@@ -2488,7 +2488,7 @@
             "signature": [
               "({ id }: ",
               "GetListOptions",
-              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; } | null>"
+              ") => Promise<{ _version: string | undefined; created_at: any; created_by: any; description: any; deserializer: string | undefined; id: any; immutable: boolean; meta: any; name: any; serializer: string | undefined; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; version: number; } | null>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/lists/list_client.ts",
@@ -2526,7 +2526,7 @@
             "signature": [
               "({ id, deserializer, immutable, serializer, name, description, type, meta, version, }: ",
               "CreateListOptions",
-              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; }>"
+              ") => Promise<{ _version: string | undefined; created_at: any; created_by: any; description: any; deserializer: string | undefined; id: any; immutable: boolean; meta: any; name: any; serializer: string | undefined; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; version: number; }>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/lists/list_client.ts",
@@ -2564,7 +2564,7 @@
             "signature": [
               "({ id, deserializer, serializer, name, description, immutable, type, meta, version, }: ",
               "CreateListIfItDoesNotExistOptions",
-              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; }>"
+              ") => Promise<{ _version: string | undefined; created_at: any; created_by: any; description: any; deserializer: string | undefined; id: any; immutable: boolean; meta: any; name: any; serializer: string | undefined; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; version: number; }>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/lists/list_client.ts",
@@ -2962,7 +2962,7 @@
             "signature": [
               "({ id }: ",
               "DeleteListItemOptions",
-              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; updated_at: string; updated_by: string; value: string; } | null>"
+              ") => Promise<{ _version: string | undefined; created_at: any; created_by: any; deserializer: string | undefined; id: any; list_id: any; meta: any; serializer: string | undefined; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; value: string; } | null>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/lists/list_client.ts",
@@ -3000,7 +3000,7 @@
             "signature": [
               "({ listId, value, type, }: ",
               "DeleteListItemByValueOptions",
-              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; updated_at: string; updated_by: string; value: string; }[]>"
+              ") => Promise<{ _version: string | undefined; created_at: any; created_by: any; deserializer: string | undefined; id: any; list_id: any; meta: any; serializer: string | undefined; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; value: string; }[]>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/lists/list_client.ts",
@@ -3038,7 +3038,7 @@
             "signature": [
               "({ id }: ",
               "DeleteListOptions",
-              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; } | null>"
+              ") => Promise<{ _version: string | undefined; created_at: any; created_by: any; description: any; deserializer: string | undefined; id: any; immutable: boolean; meta: any; name: any; serializer: string | undefined; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; version: number; } | null>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/lists/list_client.ts",
@@ -3114,7 +3114,7 @@
             "signature": [
               "({ deserializer, serializer, type, listId, stream, meta, version, }: ",
               "ImportListItemsToStreamOptions",
-              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; } | null>"
+              ") => Promise<{ _version: string | undefined; created_at: any; created_by: any; description: any; deserializer: string | undefined; id: any; immutable: boolean; meta: any; name: any; serializer: string | undefined; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; version: number; } | null>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/lists/list_client.ts",
@@ -3152,7 +3152,7 @@
             "signature": [
               "({ listId, value, type, }: ",
               "GetListItemByValueOptions",
-              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; updated_at: string; updated_by: string; value: string; }[]>"
+              ") => Promise<{ _version: string | undefined; created_at: any; created_by: any; deserializer: string | undefined; id: any; list_id: any; meta: any; serializer: string | undefined; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; value: string; }[]>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/lists/list_client.ts",
@@ -3190,7 +3190,7 @@
             "signature": [
               "({ id, deserializer, serializer, listId, value, type, meta, }: ",
               "CreateListItemOptions",
-              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; updated_at: string; updated_by: string; value: string; } | null>"
+              ") => Promise<{ _version: string | undefined; created_at: any; created_by: any; deserializer: string | undefined; id: any; list_id: any; meta: any; serializer: string | undefined; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; value: string; } | null>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/lists/list_client.ts",
@@ -3228,7 +3228,7 @@
             "signature": [
               "({ _version, id, value, meta, }: ",
               "UpdateListItemOptions",
-              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; updated_at: string; updated_by: string; value: string; } | null>"
+              ") => Promise<{ _version: string | undefined; created_at: any; created_by: any; deserializer: string | undefined; id: any; list_id: any; meta: any; serializer: string | undefined; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; value: string; } | null>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/lists/list_client.ts",
@@ -3266,7 +3266,7 @@
             "signature": [
               "({ _version, id, name, description, meta, version, }: ",
               "UpdateListOptions",
-              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; } | null>"
+              ") => Promise<{ _version: string | undefined; created_at: any; created_by: any; description: any; deserializer: string | undefined; id: any; immutable: boolean; meta: any; name: any; serializer: string | undefined; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; version: number; } | null>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/lists/list_client.ts",
@@ -3304,7 +3304,7 @@
             "signature": [
               "({ id }: ",
               "GetListItemOptions",
-              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; updated_at: string; updated_by: string; value: string; } | null>"
+              ") => Promise<{ _version: string | undefined; created_at: any; created_by: any; deserializer: string | undefined; id: any; list_id: any; meta: any; serializer: string | undefined; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; value: string; } | null>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/lists/list_client.ts",
@@ -3342,7 +3342,7 @@
             "signature": [
               "({ type, listId, value, }: ",
               "GetListItemsByValueOptions",
-              ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; updated_at: string; updated_by: string; value: string; }[]>"
+              ") => Promise<{ _version: string | undefined; created_at: any; created_by: any; deserializer: string | undefined; id: any; list_id: any; meta: any; serializer: string | undefined; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; value: string; }[]>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/lists/list_client.ts",
@@ -3380,7 +3380,7 @@
             "signature": [
               "({ type, listId, value, }: ",
               "SearchListItemByValuesOptions",
-              ") => Promise<{ items: { _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; updated_at: string; updated_by: string; value: string; }[]; value: unknown; }[]>"
+              ") => Promise<{ items: { _version: string | undefined; created_at: any; created_by: any; deserializer: string | undefined; id: any; list_id: any; meta: any; serializer: string | undefined; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; value: string; }[]; value: unknown; }[]>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/lists/list_client.ts",
@@ -3418,7 +3418,7 @@
             "signature": [
               "({ filter, currentIndexPosition, perPage, page, sortField, sortOrder, searchAfter, }: ",
               "FindListOptions",
-              ") => Promise<{ cursor: string; data: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; }[]; page: number; per_page: number; total: number; }>"
+              ") => Promise<{ cursor: string; data: { _version: string | undefined; created_at: any; created_by: any; description: any; deserializer: string | undefined; id: any; immutable: boolean; meta: any; name: any; serializer: string | undefined; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; version: number; }[]; page: number; per_page: number; total: number; }>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/lists/list_client.ts",
@@ -3456,7 +3456,7 @@
             "signature": [
               "({ listId, filter, currentIndexPosition, perPage, page, sortField, sortOrder, searchAfter, }: ",
               "FindListItemOptions",
-              ") => Promise<{ cursor: string; data: { _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; updated_at: string; updated_by: string; value: string; }[]; page: number; per_page: number; total: number; } | null>"
+              ") => Promise<{ cursor: string; data: { _version: string | undefined; created_at: any; created_by: any; deserializer: string | undefined; id: any; list_id: any; meta: any; serializer: string | undefined; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; value: string; }[]; page: number; per_page: number; total: number; } | null>"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/lists/list_client.ts",
@@ -3499,171 +3499,183 @@
         "description": [],
         "source": {
           "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-          "lineNumber": 119
+          "lineNumber": 121
         },
         "deprecated": false,
         "children": [
           {
             "parentPluginId": "lists",
             "id": "def-server.CreateExceptionListItemOptions.comments",
-            "type": "Array",
+            "type": "Any",
             "tags": [],
             "label": "comments",
             "description": [],
             "signature": [
-              "{ comment: string; }[]"
+              "any"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 120
+              "lineNumber": 122
             },
             "deprecated": false
           },
           {
             "parentPluginId": "lists",
             "id": "def-server.CreateExceptionListItemOptions.entries",
-            "type": "Array",
+            "type": "Any",
             "tags": [],
             "label": "entries",
             "description": [],
             "signature": [
-              "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]"
+              "any"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 121
+              "lineNumber": 123
             },
             "deprecated": false
           },
           {
             "parentPluginId": "lists",
             "id": "def-server.CreateExceptionListItemOptions.itemId",
-            "type": "string",
+            "type": "Any",
             "tags": [],
             "label": "itemId",
             "description": [],
+            "signature": [
+              "any"
+            ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 122
+              "lineNumber": 124
             },
             "deprecated": false
           },
           {
             "parentPluginId": "lists",
             "id": "def-server.CreateExceptionListItemOptions.listId",
-            "type": "string",
+            "type": "Any",
             "tags": [],
             "label": "listId",
             "description": [],
+            "signature": [
+              "any"
+            ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 123
+              "lineNumber": 125
             },
             "deprecated": false
           },
           {
             "parentPluginId": "lists",
             "id": "def-server.CreateExceptionListItemOptions.namespaceType",
-            "type": "CompoundType",
+            "type": "Any",
             "tags": [],
             "label": "namespaceType",
             "description": [],
             "signature": [
-              "\"single\" | \"agnostic\""
+              "any"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 124
+              "lineNumber": 126
             },
             "deprecated": false
           },
           {
             "parentPluginId": "lists",
             "id": "def-server.CreateExceptionListItemOptions.name",
-            "type": "string",
+            "type": "Any",
             "tags": [],
             "label": "name",
             "description": [],
+            "signature": [
+              "any"
+            ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 125
+              "lineNumber": 127
             },
             "deprecated": false
           },
           {
             "parentPluginId": "lists",
             "id": "def-server.CreateExceptionListItemOptions.osTypes",
-            "type": "Array",
+            "type": "Any",
             "tags": [],
             "label": "osTypes",
             "description": [],
             "signature": [
-              "(\"windows\" | \"linux\" | \"macos\")[]"
+              "any"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 126
+              "lineNumber": 128
             },
             "deprecated": false
           },
           {
             "parentPluginId": "lists",
             "id": "def-server.CreateExceptionListItemOptions.description",
-            "type": "string",
+            "type": "Any",
             "tags": [],
             "label": "description",
             "description": [],
+            "signature": [
+              "any"
+            ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 127
+              "lineNumber": 129
             },
             "deprecated": false
           },
           {
             "parentPluginId": "lists",
             "id": "def-server.CreateExceptionListItemOptions.meta",
-            "type": "Uncategorized",
+            "type": "Any",
             "tags": [],
             "label": "meta",
             "description": [],
             "signature": [
-              "object | undefined"
+              "any"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 128
+              "lineNumber": 130
             },
             "deprecated": false
           },
           {
             "parentPluginId": "lists",
             "id": "def-server.CreateExceptionListItemOptions.tags",
-            "type": "Array",
+            "type": "Any",
             "tags": [],
             "label": "tags",
             "description": [],
             "signature": [
-              "string[]"
+              "any"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 129
+              "lineNumber": 131
             },
             "deprecated": false
           },
           {
             "parentPluginId": "lists",
             "id": "def-server.CreateExceptionListItemOptions.type",
-            "type": "string",
+            "type": "Any",
             "tags": [],
             "label": "type",
             "description": [],
             "signature": [
-              "\"simple\""
+              "any"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 130
+              "lineNumber": 132
             },
             "deprecated": false
           }
@@ -3789,7 +3801,7 @@
         "description": [],
         "source": {
           "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-          "lineNumber": 145
+          "lineNumber": 147
         },
         "deprecated": false,
         "children": [
@@ -3805,183 +3817,183 @@
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 146
+              "lineNumber": 148
             },
             "deprecated": false
           },
           {
             "parentPluginId": "lists",
             "id": "def-server.UpdateExceptionListItemOptions.comments",
-            "type": "Array",
+            "type": "Any",
             "tags": [],
             "label": "comments",
             "description": [],
             "signature": [
-              "({ comment: string; } & { id?: string | undefined; })[]"
+              "any"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 147
+              "lineNumber": 149
             },
             "deprecated": false
           },
           {
             "parentPluginId": "lists",
             "id": "def-server.UpdateExceptionListItemOptions.entries",
-            "type": "Array",
+            "type": "Any",
             "tags": [],
             "label": "entries",
             "description": [],
             "signature": [
-              "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]"
+              "any"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 148
+              "lineNumber": 150
             },
             "deprecated": false
           },
           {
             "parentPluginId": "lists",
             "id": "def-server.UpdateExceptionListItemOptions.id",
-            "type": "string",
+            "type": "Any",
             "tags": [],
             "label": "id",
             "description": [],
             "signature": [
-              "string | undefined"
+              "any"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 149
+              "lineNumber": 151
             },
             "deprecated": false
           },
           {
             "parentPluginId": "lists",
             "id": "def-server.UpdateExceptionListItemOptions.itemId",
-            "type": "string",
+            "type": "Any",
             "tags": [],
             "label": "itemId",
             "description": [],
             "signature": [
-              "string | undefined"
+              "any"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 150
+              "lineNumber": 152
             },
             "deprecated": false
           },
           {
             "parentPluginId": "lists",
             "id": "def-server.UpdateExceptionListItemOptions.namespaceType",
-            "type": "CompoundType",
+            "type": "Any",
             "tags": [],
             "label": "namespaceType",
             "description": [],
             "signature": [
-              "\"single\" | \"agnostic\""
+              "any"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 151
+              "lineNumber": 153
             },
             "deprecated": false
           },
           {
             "parentPluginId": "lists",
             "id": "def-server.UpdateExceptionListItemOptions.name",
-            "type": "string",
+            "type": "Any",
             "tags": [],
             "label": "name",
             "description": [],
             "signature": [
-              "string | undefined"
+              "any"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 152
+              "lineNumber": 154
             },
             "deprecated": false
           },
           {
             "parentPluginId": "lists",
             "id": "def-server.UpdateExceptionListItemOptions.osTypes",
-            "type": "Array",
+            "type": "Any",
             "tags": [],
             "label": "osTypes",
             "description": [],
             "signature": [
-              "(\"windows\" | \"linux\" | \"macos\")[]"
+              "any"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 153
+              "lineNumber": 155
             },
             "deprecated": false
           },
           {
             "parentPluginId": "lists",
             "id": "def-server.UpdateExceptionListItemOptions.description",
-            "type": "string",
+            "type": "Any",
             "tags": [],
             "label": "description",
             "description": [],
             "signature": [
-              "string | undefined"
+              "any"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 154
+              "lineNumber": 156
             },
             "deprecated": false
           },
           {
             "parentPluginId": "lists",
             "id": "def-server.UpdateExceptionListItemOptions.meta",
-            "type": "Uncategorized",
+            "type": "Any",
             "tags": [],
             "label": "meta",
             "description": [],
             "signature": [
-              "object | undefined"
+              "any"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 155
+              "lineNumber": 157
             },
             "deprecated": false
           },
           {
             "parentPluginId": "lists",
             "id": "def-server.UpdateExceptionListItemOptions.tags",
-            "type": "Array",
+            "type": "Any",
             "tags": [],
             "label": "tags",
             "description": [],
             "signature": [
-              "string[] | undefined"
+              "any"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 156
+              "lineNumber": 158
             },
             "deprecated": false
           },
           {
             "parentPluginId": "lists",
             "id": "def-server.UpdateExceptionListItemOptions.type",
-            "type": "string",
+            "type": "Any",
             "tags": [],
             "label": "type",
             "description": [],
             "signature": [
-              "\"simple\" | undefined"
+              "any"
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 157
+              "lineNumber": 159
             },
             "deprecated": false
           }
@@ -4004,7 +4016,7 @@
         "label": "buildExceptionFilter",
         "description": [],
         "signature": [
-          "({ lists, excludeExceptions, chunkSize, }: { lists: (({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) | { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; })[]; excludeExceptions: boolean; chunkSize: number; }) => ",
+          "({ lists, excludeExceptions, chunkSize, }: { lists: (({ description: any; entries: any; list_id: any; name: any; type: any; } & { comments?: any; item_id?: any; meta?: any; namespace_type?: any; os_types?: any; tags?: any; }) | { _version: string | undefined; comments: any; created_at: any; created_by: any; description: any; entries: any; id: any; item_id: any; list_id: any; meta: any; name: any; namespace_type: any; os_types: any; tags: any; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; })[]; excludeExceptions: boolean; chunkSize: number; }) => ",
           {
             "pluginId": "data",
             "scope": "common",
@@ -4041,7 +4053,7 @@
                 "label": "lists",
                 "description": [],
                 "signature": [
-                  "(({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) | { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; })[]"
+                  "(({ description: any; entries: any; list_id: any; name: any; type: any; } & { comments?: any; item_id?: any; meta?: any; namespace_type?: any; os_types?: any; tags?: any; }) | { _version: string | undefined; comments: any; created_at: any; created_by: any; description: any; entries: any; id: any; item_id: any; list_id: any; meta: any; name: any; namespace_type: any; os_types: any; tags: any; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; })[]"
                 ],
                 "source": {
                   "path": "x-pack/plugins/lists/common/exceptions/build_exceptions_filter.ts",
@@ -4083,128 +4095,8 @@
       }
     ],
     "interfaces": [],
-    "enums": [
-      {
-        "parentPluginId": "lists",
-        "id": "def-common.ExceptionListTypeEnum",
-        "type": "Enum",
-        "tags": [],
-        "label": "ExceptionListTypeEnum",
-        "description": [],
-        "signature": [
-          "ExceptionListTypeEnum"
-        ],
-        "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/exception_list/index.d.ts",
-          "lineNumber": 14
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "lists",
-        "id": "def-common.ListOperatorEnum",
-        "type": "Enum",
-        "tags": [],
-        "label": "ListOperatorEnum",
-        "description": [],
-        "signature": [
-          "ListOperatorEnum"
-        ],
-        "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/list_operator/index.d.ts",
-          "lineNumber": 7
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "lists",
-        "id": "def-common.ListOperatorTypeEnum",
-        "type": "Enum",
-        "tags": [],
-        "label": "ListOperatorTypeEnum",
-        "description": [],
-        "signature": [
-          "ListOperatorTypeEnum"
-        ],
-        "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/list_operator/index.d.ts",
-          "lineNumber": 11
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      }
-    ],
+    "enums": [],
     "misc": [
-      {
-        "parentPluginId": "lists",
-        "id": "def-common.Comment",
-        "type": "Type",
-        "tags": [],
-        "label": "Comment",
-        "description": [],
-        "signature": [
-          "{ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; }"
-        ],
-        "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/comment/index.d.ts",
-          "lineNumber": 21
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "lists",
-        "id": "def-common.CommentsArray",
-        "type": "Type",
-        "tags": [],
-        "label": "CommentsArray",
-        "description": [],
-        "signature": [
-          "({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]"
-        ],
-        "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/comment/index.d.ts",
-          "lineNumber": 20
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "lists",
-        "id": "def-common.CreateComment",
-        "type": "Type",
-        "tags": [],
-        "label": "CreateComment",
-        "description": [],
-        "signature": [
-          "{ comment: string; }"
-        ],
-        "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/create_comment/index.d.ts",
-          "lineNumber": 5
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "lists",
-        "id": "def-common.CreateCommentsArray",
-        "type": "Type",
-        "tags": [],
-        "label": "CreateCommentsArray",
-        "description": [],
-        "signature": [
-          "{ comment: string; }[]"
-        ],
-        "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/create_comment/index.d.ts",
-          "lineNumber": 9
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
       {
         "parentPluginId": "lists",
         "id": "def-common.CreateExceptionListItemSchema",
@@ -4213,7 +4105,7 @@
         "label": "CreateExceptionListItemSchema",
         "description": [],
         "signature": [
-          "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
+          "{ description: any; entries: any; list_id: any; name: any; type: any; } & { comments?: any; item_id?: any; meta?: any; namespace_type?: any; os_types?: any; tags?: any; }"
         ],
         "source": {
           "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.ts",
@@ -4230,7 +4122,7 @@
         "label": "CreateExceptionListSchema",
         "description": [],
         "signature": [
-          "{ description: string; name: string; type: \"endpoint\" | \"detection\" | \"endpoint_events\"; } & { list_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; version?: number | undefined; }"
+          "{ description: any; name: any; type: any; } & { list_id?: any; meta?: any; namespace_type?: any; os_types?: any; tags?: any; version?: any; }"
         ],
         "source": {
           "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.ts",
@@ -4336,640 +4228,166 @@
       },
       {
         "parentPluginId": "lists",
-        "id": "def-common.EntriesArray",
-        "type": "Type",
+        "id": "def-common.EXCEPTION_LIST_ITEM_URL",
+        "type": "string",
         "tags": [],
-        "label": "EntriesArray",
+        "label": "EXCEPTION_LIST_ITEM_URL",
         "description": [],
         "signature": [
-          "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]"
+          "\"/api/exception_lists/items\""
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entries/index.d.ts",
-          "lineNumber": 191
+          "path": "x-pack/plugins/lists/common/constants.ts",
+          "lineNumber": 20
         },
         "deprecated": false,
         "initialIsOpen": false
       },
       {
         "parentPluginId": "lists",
-        "id": "def-common.Entry",
-        "type": "Type",
+        "id": "def-common.EXCEPTION_LIST_URL",
+        "type": "string",
         "tags": [],
-        "label": "Entry",
-        "description": [],
+        "label": "EXCEPTION_LIST_URL",
+        "description": [
+          "\nException list routes"
+        ],
         "signature": [
-          "{ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; }"
+          "\"/api/exception_lists\""
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entries/index.d.ts",
-          "lineNumber": 79
+          "path": "x-pack/plugins/lists/common/constants.ts",
+          "lineNumber": 19
         },
         "deprecated": false,
         "initialIsOpen": false
       },
       {
         "parentPluginId": "lists",
-        "id": "def-common.EntryExists",
+        "id": "def-common.ExceptionListItemSchema",
         "type": "Type",
         "tags": [],
-        "label": "EntryExists",
+        "label": "ExceptionListItemSchema",
         "description": [],
         "signature": [
-          "{ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; }"
+          "{ _version: string | undefined; comments: any; created_at: any; created_by: any; description: any; entries: any; id: any; item_id: any; list_id: any; meta: any; name: any; namespace_type: any; os_types: any; tags: any; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; }"
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entries_exist/index.d.ts",
-          "lineNumber": 12
+          "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.ts",
+          "lineNumber": 56
         },
         "deprecated": false,
         "initialIsOpen": false
       },
       {
         "parentPluginId": "lists",
-        "id": "def-common.EntryList",
+        "id": "def-common.ExceptionListSchema",
         "type": "Type",
         "tags": [],
-        "label": "EntryList",
+        "label": "ExceptionListSchema",
         "description": [],
         "signature": [
-          "{ field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; }"
+          "{ _version: string | undefined; created_at: any; created_by: any; description: any; id: any; immutable: boolean; list_id: any; meta: any; name: any; namespace_type: any; os_types: any; tags: any; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; version: number; }"
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entries_list/index.d.ts",
-          "lineNumber": 40
+          "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.ts",
+          "lineNumber": 54
         },
         "deprecated": false,
         "initialIsOpen": false
       },
       {
         "parentPluginId": "lists",
-        "id": "def-common.EntryMatch",
+        "id": "def-common.ListSchema",
         "type": "Type",
         "tags": [],
-        "label": "EntryMatch",
+        "label": "ListSchema",
         "description": [],
         "signature": [
-          "{ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; }"
+          "{ _version: string | undefined; created_at: any; created_by: any; description: any; deserializer: string | undefined; id: any; immutable: boolean; meta: any; name: any; serializer: string | undefined; tie_breaker_id: string; type: any; updated_at: any; updated_by: any; version: number; }"
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entry_match/index.d.ts",
-          "lineNumber": 13
+          "path": "x-pack/plugins/lists/common/schemas/response/list_schema.ts",
+          "lineNumber": 50
         },
         "deprecated": false,
         "initialIsOpen": false
       },
       {
         "parentPluginId": "lists",
-        "id": "def-common.EntryMatchAny",
+        "id": "def-common.UpdateExceptionListItemSchema",
         "type": "Type",
         "tags": [],
-        "label": "EntryMatchAny",
+        "label": "UpdateExceptionListItemSchema",
         "description": [],
         "signature": [
-          "{ field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; }"
+          "{ description: any; entries: any; name: any; type: any; } & { _version?: string | undefined; comments?: any; id?: any; item_id?: string | undefined; meta?: any; namespace_type?: any; os_types?: any; tags?: any; }"
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entry_match_any/index.d.ts",
-          "lineNumber": 13
+          "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.ts",
+          "lineNumber": 52
         },
         "deprecated": false,
         "initialIsOpen": false
-      },
+      }
+    ],
+    "objects": [
       {
         "parentPluginId": "lists",
-        "id": "def-common.EntryMatchWildcard",
-        "type": "Type",
+        "id": "def-common.createExceptionListItemSchema",
+        "type": "Object",
         "tags": [],
-        "label": "EntryMatchWildcard",
+        "label": "createExceptionListItemSchema",
         "description": [],
         "signature": [
-          "{ field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; }"
+          "IntersectionC",
+          "<[",
+          "ExactC",
+          "<",
+          "TypeC",
+          "<{ description: any; entries: any; list_id: any; name: any; type: any; }>>, ",
+          "ExactC",
+          "<",
+          "PartialC"
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entry_match_wildcard/index.d.ts",
-          "lineNumber": 13
+          "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.ts",
+          "lineNumber": 29
         },
         "deprecated": false,
         "initialIsOpen": false
       },
       {
         "parentPluginId": "lists",
-        "id": "def-common.EntryNested",
-        "type": "Type",
+        "id": "def-common.exceptionListItemSchema",
+        "type": "Object",
         "tags": [],
-        "label": "EntryNested",
+        "label": "exceptionListItemSchema",
         "description": [],
         "signature": [
-          "{ entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; }"
+          "ExactC",
+          "<",
+          "TypeC",
+          "<{ _version: ",
+          "UnionC",
+          "<[",
+          "StringC",
+          ", ",
+          "UndefinedC"
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entry_nested/index.d.ts",
-          "lineNumber": 37
+          "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.ts",
+          "lineNumber": 33
         },
         "deprecated": false,
         "initialIsOpen": false
       },
       {
         "parentPluginId": "lists",
-        "id": "def-common.EXCEPTION_LIST_ITEM_URL",
-        "type": "string",
+        "id": "def-common.listSchema",
+        "type": "Object",
         "tags": [],
-        "label": "EXCEPTION_LIST_ITEM_URL",
-        "description": [],
-        "signature": [
-          "\"/api/exception_lists/items\""
-        ],
-        "source": {
-          "path": "x-pack/plugins/lists/common/constants.ts",
-          "lineNumber": 20
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "lists",
-        "id": "def-common.EXCEPTION_LIST_URL",
-        "type": "string",
-        "tags": [],
-        "label": "EXCEPTION_LIST_URL",
-        "description": [
-          "\nException list routes"
-        ],
-        "signature": [
-          "\"/api/exception_lists\""
-        ],
-        "source": {
-          "path": "x-pack/plugins/lists/common/constants.ts",
-          "lineNumber": 19
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "lists",
-        "id": "def-common.ExceptionListItemSchema",
-        "type": "Type",
-        "tags": [],
-        "label": "ExceptionListItemSchema",
-        "description": [],
-        "signature": [
-          "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }"
-        ],
-        "source": {
-          "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.ts",
-          "lineNumber": 56
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "lists",
-        "id": "def-common.ExceptionListSchema",
-        "type": "Type",
-        "tags": [],
-        "label": "ExceptionListSchema",
-        "description": [],
-        "signature": [
-          "{ _version: string | undefined; created_at: string; created_by: string; description: string; id: string; immutable: boolean; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"endpoint\" | \"detection\" | \"endpoint_events\"; updated_at: string; updated_by: string; version: number; }"
-        ],
-        "source": {
-          "path": "x-pack/plugins/lists/common/schemas/response/exception_list_schema.ts",
-          "lineNumber": 54
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "lists",
-        "id": "def-common.ExceptionListType",
-        "type": "Type",
-        "tags": [],
-        "label": "ExceptionListType",
-        "description": [],
-        "signature": [
-          "\"endpoint\" | \"detection\" | \"endpoint_events\""
-        ],
-        "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/exception_list/index.d.ts",
-          "lineNumber": 12
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "lists",
-        "id": "def-common.ListOperator",
-        "type": "Type",
-        "tags": [],
-        "label": "ListOperator",
-        "description": [],
-        "signature": [
-          "\"excluded\" | \"included\""
-        ],
-        "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/list_operator/index.d.ts",
-          "lineNumber": 6
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "lists",
-        "id": "def-common.ListSchema",
-        "type": "Type",
-        "tags": [],
-        "label": "ListSchema",
-        "description": [],
-        "signature": [
-          "{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; updated_at: string; updated_by: string; version: number; }"
-        ],
-        "source": {
-          "path": "x-pack/plugins/lists/common/schemas/response/list_schema.ts",
-          "lineNumber": 50
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "lists",
-        "id": "def-common.NamespaceType",
-        "type": "Type",
-        "tags": [],
-        "label": "NamespaceType",
-        "description": [],
-        "signature": [
-          "\"single\" | \"agnostic\""
-        ],
-        "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/default_namespace/index.d.ts",
-          "lineNumber": 6
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "lists",
-        "id": "def-common.NestedEntriesArray",
-        "type": "Type",
-        "tags": [],
-        "label": "NestedEntriesArray",
-        "description": [],
-        "signature": [
-          "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]"
-        ],
-        "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/non_empty_nested_entries_array/index.d.ts",
-          "lineNumber": 62
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "lists",
-        "id": "def-common.OsTypeArray",
-        "type": "Type",
-        "tags": [],
-        "label": "OsTypeArray",
-        "description": [],
-        "signature": [
-          "(\"windows\" | \"linux\" | \"macos\")[]"
-        ],
-        "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/os_type/index.d.ts",
-          "lineNumber": 9
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "lists",
-        "id": "def-common.Type",
-        "type": "Type",
-        "tags": [],
-        "label": "Type",
-        "description": [],
-        "signature": [
-          "\"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\""
-        ],
-        "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/type/index.d.ts",
-          "lineNumber": 56
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "lists",
-        "id": "def-common.UpdateExceptionListItemSchema",
-        "type": "Type",
-        "tags": [],
-        "label": "UpdateExceptionListItemSchema",
-        "description": [],
-        "signature": [
-          "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"ip\" | \"long\" | \"double\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
-        ],
-        "source": {
-          "path": "x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.ts",
-          "lineNumber": 52
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      }
-    ],
-    "objects": [
-      {
-        "parentPluginId": "lists",
-        "id": "def-common.comment",
-        "type": "Object",
-        "tags": [],
-        "label": "comment",
-        "description": [],
-        "signature": [
-          "IntersectionC",
-          "<[",
-          "ExactC",
-          "<",
-          "TypeC",
-          "<{ comment: ",
-          "Type",
-          "<string, string, unknown>; created_at: ",
-          "StringC"
-        ],
-        "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/comment/index.d.ts",
-          "lineNumber": 2
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "lists",
-        "id": "def-common.createExceptionListItemSchema",
-        "type": "Object",
-        "tags": [],
-        "label": "createExceptionListItemSchema",
-        "description": [],
-        "signature": [
-          "IntersectionC",
-          "<[",
-          "ExactC",
-          "<",
-          "TypeC",
-          "<{ description: ",
-          "StringC",
-          "; entries: ",
-          "Type"
-        ],
-        "source": {
-          "path": "x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.ts",
-          "lineNumber": 29
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "lists",
-        "id": "def-common.entriesExists",
-        "type": "Object",
-        "tags": [],
-        "label": "entriesExists",
-        "description": [],
-        "signature": [
-          "ExactC",
-          "<",
-          "TypeC",
-          "<{ field: ",
-          "Type",
-          "<string, string, unknown>; operator: ",
-          "KeyofC",
-          "<{ excluded: null; included: null; }>; type: ",
-          "KeyofC"
-        ],
-        "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entries_exist/index.d.ts",
-          "lineNumber": 2
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "lists",
-        "id": "def-common.entriesList",
-        "type": "Object",
-        "tags": [],
-        "label": "entriesList",
-        "description": [],
-        "signature": [
-          "ExactC",
-          "<",
-          "TypeC",
-          "<{ field: ",
-          "Type",
-          "<string, string, unknown>; list: ",
-          "ExactC",
-          "<",
-          "TypeC"
-        ],
-        "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entries_list/index.d.ts",
-          "lineNumber": 2
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "lists",
-        "id": "def-common.entriesMatch",
-        "type": "Object",
-        "tags": [],
-        "label": "entriesMatch",
-        "description": [],
-        "signature": [
-          "ExactC",
-          "<",
-          "TypeC",
-          "<{ field: ",
-          "Type",
-          "<string, string, unknown>; operator: ",
-          "KeyofC",
-          "<{ excluded: null; included: null; }>; type: ",
-          "KeyofC"
-        ],
-        "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entry_match/index.d.ts",
-          "lineNumber": 2
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "lists",
-        "id": "def-common.entriesMatchAny",
-        "type": "Object",
-        "tags": [],
-        "label": "entriesMatchAny",
-        "description": [],
-        "signature": [
-          "ExactC",
-          "<",
-          "TypeC",
-          "<{ field: ",
-          "Type",
-          "<string, string, unknown>; operator: ",
-          "KeyofC",
-          "<{ excluded: null; included: null; }>; type: ",
-          "KeyofC"
-        ],
-        "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entry_match_any/index.d.ts",
-          "lineNumber": 2
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "lists",
-        "id": "def-common.entriesMatchWildcard",
-        "type": "Object",
-        "tags": [],
-        "label": "entriesMatchWildcard",
-        "description": [],
-        "signature": [
-          "ExactC",
-          "<",
-          "TypeC",
-          "<{ field: ",
-          "Type",
-          "<string, string, unknown>; operator: ",
-          "KeyofC",
-          "<{ excluded: null; included: null; }>; type: ",
-          "KeyofC"
-        ],
-        "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entry_match_wildcard/index.d.ts",
-          "lineNumber": 2
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "lists",
-        "id": "def-common.entriesNested",
-        "type": "Object",
-        "tags": [],
-        "label": "entriesNested",
-        "description": [],
-        "signature": [
-          "ExactC",
-          "<",
-          "TypeC",
-          "<{ entries: ",
-          "Type",
-          "<({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[], ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[], unknown>; field: ",
-          "Type",
-          "<string, string, unknown>; type: ",
-          "KeyofC"
-        ],
-        "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entry_nested/index.d.ts",
-          "lineNumber": 2
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "lists",
-        "id": "def-common.entry",
-        "type": "Object",
-        "tags": [],
-        "label": "entry",
-        "description": [],
-        "signature": [
-          "UnionC",
-          "<[",
-          "ExactC",
-          "<",
-          "TypeC",
-          "<{ field: ",
-          "Type",
-          "<string, string, unknown>; operator: ",
-          "KeyofC"
-        ],
-        "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entries/index.d.ts",
-          "lineNumber": 2
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "lists",
-        "id": "def-common.exceptionListItemSchema",
-        "type": "Object",
-        "tags": [],
-        "label": "exceptionListItemSchema",
-        "description": [],
-        "signature": [
-          "ExactC",
-          "<",
-          "TypeC",
-          "<{ _version: ",
-          "UnionC",
-          "<[",
-          "StringC",
-          ", ",
-          "UndefinedC"
-        ],
-        "source": {
-          "path": "x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.ts",
-          "lineNumber": 33
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "lists",
-        "id": "def-common.exceptionListType",
-        "type": "Object",
-        "tags": [],
-        "label": "exceptionListType",
-        "description": [],
-        "signature": [
-          "KeyofC",
-          "<{ detection: null; endpoint: null; endpoint_events: null; }>"
-        ],
-        "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/exception_list/index.d.ts",
-          "lineNumber": 2
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "lists",
-        "id": "def-common.listOperator",
-        "type": "Object",
-        "tags": [],
-        "label": "listOperator",
-        "description": [],
-        "signature": [
-          "KeyofC",
-          "<{ excluded: null; included: null; }>"
-        ],
-        "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/list_operator/index.d.ts",
-          "lineNumber": 2
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "lists",
-        "id": "def-common.listSchema",
-        "type": "Object",
-        "tags": [],
-        "label": "listSchema",
+        "label": "listSchema",
         "description": [],
         "signature": [
           "ExactC",
@@ -4988,85 +4406,6 @@
         },
         "deprecated": false,
         "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "lists",
-        "id": "def-common.namespaceType",
-        "type": "Object",
-        "tags": [],
-        "label": "namespaceType",
-        "description": [],
-        "signature": [
-          "KeyofC",
-          "<{ agnostic: null; single: null; }>"
-        ],
-        "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/default_namespace/index.d.ts",
-          "lineNumber": 2
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "lists",
-        "id": "def-common.nestedEntryItem",
-        "type": "Object",
-        "tags": [],
-        "label": "nestedEntryItem",
-        "description": [],
-        "signature": [
-          "UnionC",
-          "<[",
-          "ExactC",
-          "<",
-          "TypeC",
-          "<{ field: ",
-          "Type",
-          "<string, string, unknown>; operator: ",
-          "KeyofC"
-        ],
-        "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/non_empty_nested_entries_array/index.d.ts",
-          "lineNumber": 2
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "lists",
-        "id": "def-common.osType",
-        "type": "Object",
-        "tags": [],
-        "label": "osType",
-        "description": [],
-        "signature": [
-          "KeyofC",
-          "<{ linux: null; macos: null; windows: null; }>"
-        ],
-        "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/os_type/index.d.ts",
-          "lineNumber": 2
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "lists",
-        "id": "def-common.osTypeArray",
-        "type": "Object",
-        "tags": [],
-        "label": "osTypeArray",
-        "description": [],
-        "signature": [
-          "Type",
-          "<(\"windows\" | \"linux\" | \"macos\")[], (\"windows\" | \"linux\" | \"macos\")[] | undefined, unknown>"
-        ],
-        "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/os_type/index.d.ts",
-          "lineNumber": 8
-        },
-        "deprecated": false,
-        "initialIsOpen": false
       }
     ]
   }
diff --git a/api_docs/lists.mdx b/api_docs/lists.mdx
index 9c6edcab18c90..8229af985b391 100644
--- a/api_docs/lists.mdx
+++ b/api_docs/lists.mdx
@@ -47,9 +47,6 @@ import listsObj from './lists.json';
 ### Functions
 <DocDefinitionList data={listsObj.common.functions}/>
 
-### Enums
-<DocDefinitionList data={listsObj.common.enums}/>
-
 ### Consts, variables and types
 <DocDefinitionList data={listsObj.common.misc}/>
 
diff --git a/api_docs/observability.json b/api_docs/observability.json
index 980df52f0e77a..4b2cf6ad598d4 100644
--- a/api_docs/observability.json
+++ b/api_docs/observability.json
@@ -3264,7 +3264,7 @@
         "label": "rangeQuery",
         "description": [],
         "signature": [
-          "(start: number, end: number, field: string) => ",
+          "(start: number | undefined, end: number | undefined, field: string) => ",
           "QueryContainer",
           "[]"
         ],
@@ -3282,14 +3282,14 @@
             "label": "start",
             "description": [],
             "signature": [
-              "number"
+              "number | undefined"
             ],
             "source": {
               "path": "x-pack/plugins/observability/server/utils/queries.ts",
               "lineNumber": 11
             },
             "deprecated": false,
-            "isRequired": true
+            "isRequired": false
           },
           {
             "parentPluginId": "observability",
@@ -3299,14 +3299,14 @@
             "label": "end",
             "description": [],
             "signature": [
-              "number"
+              "number | undefined"
             ],
             "source": {
               "path": "x-pack/plugins/observability/server/utils/queries.ts",
               "lineNumber": 11
             },
             "deprecated": false,
-            "isRequired": true
+            "isRequired": false
           },
           {
             "parentPluginId": "observability",
@@ -3580,7 +3580,7 @@
         "label": "ObservabilityAPIReturnType",
         "description": [],
         "signature": [
-          "TEndpoint extends \"GET /api/observability/rules/alerts/top\" | \"GET /api/observability/rules/alerts/dynamic_index_pattern\" ? ({ \"GET /api/observability/rules/alerts/top\": ServerRoute<\"GET /api/observability/rules/alerts/top\", t.TypeC<{ query: t.IntersectionC<[t.TypeC<{ start: t.Type<number, string, unknown>; end: t.Type<number, string, unknown>; }>, t.PartialC<{ kuery: t.StringC; size: t.Type<number, unknown, unknown>; }>]>; }>, ObservabilityRouteHandlerResources, Partial<Record<never, unknown[]>>[], ObservabilityRouteCreateOptions>; } & { \"GET /api/observability/rules/alerts/dynamic_index_pattern\": ServerRoute<\"GET /api/observability/rules/alerts/dynamic_index_pattern\", undefined, ObservabilityRouteHandlerResources, { title: string; timeFieldName: string; fields: ",
+          "TEndpoint extends \"GET /api/observability/rules/alerts/top\" | \"GET /api/observability/rules/alerts/dynamic_index_pattern\" ? ({ \"GET /api/observability/rules/alerts/top\": ServerRoute<\"GET /api/observability/rules/alerts/top\", t.TypeC<{ query: t.IntersectionC<[t.TypeC<{ start: t.Type<number, string, unknown>; end: t.Type<number, string, unknown>; }>, t.PartialC<{ kuery: t.StringC; size: t.Type<number, unknown, unknown>; }>]>; }>, ObservabilityRouteHandlerResources, any[], ObservabilityRouteCreateOptions>; } & { \"GET /api/observability/rules/alerts/dynamic_index_pattern\": ServerRoute<\"GET /api/observability/rules/alerts/dynamic_index_pattern\", undefined, ObservabilityRouteHandlerResources, { title: string; timeFieldName: string; fields: ",
           "IndexPatternFieldDescriptor",
           "[]; }, ObservabilityRouteCreateOptions>; })[TEndpoint] extends ServerRoute<any, any, any, infer TReturnType, Record<string, any>> ? TReturnType : never : never"
         ],
diff --git a/api_docs/reporting.json b/api_docs/reporting.json
index 66cb2e3f4d68d..fc653b740d47c 100644
--- a/api_docs/reporting.json
+++ b/api_docs/reporting.json
@@ -1413,7 +1413,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"addToNamespaces\" | \"deleteFromNamespaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">) => Promise<",
+              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">) => Promise<",
               {
                 "pluginId": "core",
                 "scope": "server",
@@ -1445,7 +1445,7 @@
                     "section": "def-server.SavedObjectsClient",
                     "text": "SavedObjectsClient"
                   },
-                  ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"addToNamespaces\" | \"deleteFromNamespaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
+                  ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
                 ],
                 "source": {
                   "path": "x-pack/plugins/reporting/server/core.ts",
diff --git a/api_docs/rule_registry.json b/api_docs/rule_registry.json
index 9d5b2997cd2e4..4bc3565e4d56e 100644
--- a/api_docs/rule_registry.json
+++ b/api_docs/rule_registry.json
@@ -719,11 +719,11 @@
         "label": "RuleRegistryPluginConfig",
         "description": [],
         "signature": [
-          "{ readonly enabled: boolean; readonly unsafe: Readonly<{} & { write: Readonly<{} & { enabled: boolean; }>; }>; }"
+          "{ readonly enabled: boolean; readonly write: Readonly<{} & { enabled: boolean; }>; readonly index: string; }"
         ],
         "source": {
           "path": "x-pack/plugins/rule_registry/server/index.ts",
-          "lineNumber": 28
+          "lineNumber": 29
         },
         "deprecated": false,
         "initialIsOpen": false
diff --git a/api_docs/security.json b/api_docs/security.json
index a8fae398cbf22..c8f3b1f6c5b76 100644
--- a/api_docs/security.json
+++ b/api_docs/security.json
@@ -510,7 +510,7 @@
       "label": "SecurityPluginSetup",
       "description": [],
       "signature": [
-        "{ authc: AuthenticationServiceSetup; sessionTimeout: ISessionTimeout; license: Readonly<{ isLicenseAvailable: () => boolean; isEnabled: () => boolean; getType: () => \"basic\" | \"standard\" | \"gold\" | \"platinum\" | \"enterprise\" | \"trial\" | undefined; getFeatures: () => ",
+        "{ authc: AuthenticationServiceSetup; sessionTimeout: SessionTimeout; license: Readonly<{ isLicenseAvailable: () => boolean; isEnabled: () => boolean; getType: () => \"basic\" | \"standard\" | \"gold\" | \"platinum\" | \"enterprise\" | \"trial\" | undefined; getFeatures: () => ",
         "SecurityLicenseFeatures",
         "; features$: ",
         "Observable",
@@ -520,7 +520,7 @@
       ],
       "source": {
         "path": "x-pack/plugins/security/public/plugin.tsx",
-        "lineNumber": 171
+        "lineNumber": 164
       },
       "deprecated": false,
       "lifecycle": "setup",
@@ -540,7 +540,7 @@
       ],
       "source": {
         "path": "x-pack/plugins/security/public/plugin.tsx",
-        "lineNumber": 172
+        "lineNumber": 165
       },
       "deprecated": false,
       "lifecycle": "start",
@@ -1229,6 +1229,13 @@
                   "lineNumber": 444
                 }
               },
+              {
+                "plugin": "cases",
+                "link": {
+                  "path": "x-pack/plugins/cases/server/plugin.ts",
+                  "lineNumber": 89
+                }
+              },
               {
                 "plugin": "ml",
                 "link": {
@@ -1264,13 +1271,6 @@
                   "lineNumber": 44
                 }
               },
-              {
-                "plugin": "cases",
-                "link": {
-                  "path": "x-pack/plugins/cases/server/plugin.ts",
-                  "lineNumber": 83
-                }
-              },
               {
                 "plugin": "dashboardMode",
                 "link": {
@@ -1312,7 +1312,13 @@
             "description": [],
             "signature": [
               "Pick<",
-              "AuthorizationServiceSetup",
+              {
+                "pluginId": "security",
+                "scope": "server",
+                "docId": "kibSecurityPluginApi",
+                "section": "def-server.AuthorizationServiceSetup",
+                "text": "AuthorizationServiceSetup"
+              },
               ", \"mode\" | \"actions\" | \"checkPrivilegesDynamicallyWithRequest\" | \"checkPrivilegesWithRequest\">"
             ],
             "source": {
@@ -1456,7 +1462,13 @@
             "description": [],
             "signature": [
               "Pick<",
-              "AuthorizationServiceSetup",
+              {
+                "pluginId": "security",
+                "scope": "server",
+                "docId": "kibSecurityPluginApi",
+                "section": "def-server.AuthorizationServiceSetup",
+                "text": "AuthorizationServiceSetup"
+              },
               ", \"mode\" | \"actions\" | \"checkPrivilegesDynamicallyWithRequest\" | \"checkPrivilegesWithRequest\">"
             ],
             "source": {
@@ -1471,6 +1483,31 @@
     ],
     "enums": [],
     "misc": [
+      {
+        "parentPluginId": "security",
+        "id": "def-server.AuthorizationServiceSetup",
+        "type": "Type",
+        "tags": [],
+        "label": "AuthorizationServiceSetup",
+        "description": [],
+        "signature": [
+          "{ mode: ",
+          "AuthorizationMode",
+          "; actions: ",
+          "Actions",
+          "; checkPrivilegesDynamicallyWithRequest: ",
+          "CheckPrivilegesDynamicallyWithRequest",
+          "; checkPrivilegesWithRequest: ",
+          "CheckPrivilegesWithRequest",
+          "; }"
+        ],
+        "source": {
+          "path": "x-pack/plugins/security/server/index.ts",
+          "lineNumber": 30
+        },
+        "deprecated": false,
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "security",
         "id": "def-server.ROUTE_TAG_CAN_REDIRECT",
diff --git a/api_docs/security_solution.json b/api_docs/security_solution.json
index 3ea7554e374a6..3a7740de1b839 100644
--- a/api_docs/security_solution.json
+++ b/api_docs/security_solution.json
@@ -437,7 +437,7 @@
         ],
         "source": {
           "path": "x-pack/plugins/security_solution/server/plugin.ts",
-          "lineNumber": 139
+          "lineNumber": 141
         },
         "deprecated": false,
         "children": [
@@ -453,7 +453,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/security_solution/server/plugin.ts",
-              "lineNumber": 155
+              "lineNumber": 157
             },
             "deprecated": false,
             "children": [
@@ -476,7 +476,7 @@
                 ],
                 "source": {
                   "path": "x-pack/plugins/security_solution/server/plugin.ts",
-                  "lineNumber": 155
+                  "lineNumber": 157
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -516,7 +516,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/security_solution/server/plugin.ts",
-              "lineNumber": 167
+              "lineNumber": 169
             },
             "deprecated": false,
             "children": [
@@ -549,7 +549,7 @@
                 ],
                 "source": {
                   "path": "x-pack/plugins/security_solution/server/plugin.ts",
-                  "lineNumber": 167
+                  "lineNumber": 169
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -566,7 +566,7 @@
                 ],
                 "source": {
                   "path": "x-pack/plugins/security_solution/server/plugin.ts",
-                  "lineNumber": 167
+                  "lineNumber": 169
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -596,7 +596,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/security_solution/server/plugin.ts",
-              "lineNumber": 384
+              "lineNumber": 386
             },
             "deprecated": false,
             "children": [
@@ -618,7 +618,7 @@
                 ],
                 "source": {
                   "path": "x-pack/plugins/security_solution/server/plugin.ts",
-                  "lineNumber": 384
+                  "lineNumber": 386
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -635,7 +635,7 @@
                 ],
                 "source": {
                   "path": "x-pack/plugins/security_solution/server/plugin.ts",
-                  "lineNumber": 384
+                  "lineNumber": 386
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -655,7 +655,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/security_solution/server/plugin.ts",
-              "lineNumber": 458
+              "lineNumber": 461
             },
             "deprecated": false,
             "children": [],
@@ -665,898 +665,7 @@
         "initialIsOpen": false
       }
     ],
-    "functions": [
-      {
-        "parentPluginId": "securitySolution",
-        "id": "def-server.buildRouteValidation",
-        "type": "Function",
-        "tags": [],
-        "label": "buildRouteValidation",
-        "description": [],
-        "signature": [
-          "<T extends ",
-          "Mixed",
-          ", A = ",
-          "TypeOf",
-          "<T>>(schema: T) => ",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCoreHttpPluginApi",
-            "section": "def-server.RouteValidationFunction",
-            "text": "RouteValidationFunction"
-          },
-          "<A>"
-        ],
-        "source": {
-          "path": "x-pack/plugins/security_solution/server/utils/build_validation/route_validation.ts",
-          "lineNumber": 30
-        },
-        "deprecated": false,
-        "children": [
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.buildRouteValidation.$1",
-            "type": "Uncategorized",
-            "tags": [],
-            "label": "schema",
-            "description": [],
-            "signature": [
-              "T"
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/utils/build_validation/route_validation.ts",
-              "lineNumber": 31
-            },
-            "deprecated": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "securitySolution",
-        "id": "def-server.buildSiemResponse",
-        "type": "Function",
-        "tags": [],
-        "label": "buildSiemResponse",
-        "description": [],
-        "signature": [
-          "(response: { custom: <T extends string | Record<string, any> | Error | { message: string | Error; attributes?: Record<string, any> | undefined; } | Buffer | ",
-          "Stream",
-          " | undefined>(options: ",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCoreHttpPluginApi",
-            "section": "def-server.CustomHttpResponseOptions",
-            "text": "CustomHttpResponseOptions"
-          },
-          "<T>) => ",
-          "KibanaResponse",
-          "<T>; badRequest: (options?: ",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCoreHttpPluginApi",
-            "section": "def-server.ErrorHttpResponseOptions",
-            "text": "ErrorHttpResponseOptions"
-          },
-          ") => ",
-          "KibanaResponse"
-        ],
-        "source": {
-          "path": "x-pack/plugins/security_solution/server/lib/detection_engine/routes/utils.ts",
-          "lineNumber": 295
-        },
-        "deprecated": false,
-        "children": [
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.buildSiemResponse.$1",
-            "type": "Object",
-            "tags": [],
-            "label": "response",
-            "description": [],
-            "signature": [
-              "{ custom: <T extends string | Record<string, any> | Error | { message: string | Error; attributes?: Record<string, any> | undefined; } | Buffer | ",
-              "Stream",
-              " | undefined>(options: ",
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCoreHttpPluginApi",
-                "section": "def-server.CustomHttpResponseOptions",
-                "text": "CustomHttpResponseOptions"
-              },
-              "<T>) => ",
-              "KibanaResponse",
-              "<T>; badRequest: (options?: ",
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCoreHttpPluginApi",
-                "section": "def-server.ErrorHttpResponseOptions",
-                "text": "ErrorHttpResponseOptions"
-              },
-              ") => ",
-              "KibanaResponse"
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/routes/utils.ts",
-              "lineNumber": 295
-            },
-            "deprecated": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "securitySolution",
-        "id": "def-server.createBootstrapIndex",
-        "type": "Function",
-        "tags": [],
-        "label": "createBootstrapIndex",
-        "description": [],
-        "signature": [
-          "(esClient: ",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCorePluginApi",
-            "section": "def-server.ElasticsearchClient",
-            "text": "ElasticsearchClient"
-          },
-          ", index: string) => Promise<unknown>"
-        ],
-        "source": {
-          "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/create_bootstrap_index.ts",
-          "lineNumber": 13
-        },
-        "deprecated": false,
-        "children": [
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.createBootstrapIndex.$1",
-            "type": "CompoundType",
-            "tags": [],
-            "label": "esClient",
-            "description": [],
-            "signature": [
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCorePluginApi",
-                "section": "def-server.ElasticsearchClient",
-                "text": "ElasticsearchClient"
-              }
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/create_bootstrap_index.ts",
-              "lineNumber": 14
-            },
-            "deprecated": false,
-            "isRequired": true
-          },
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.createBootstrapIndex.$2",
-            "type": "string",
-            "tags": [],
-            "label": "index",
-            "description": [],
-            "signature": [
-              "string"
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/create_bootstrap_index.ts",
-              "lineNumber": 15
-            },
-            "deprecated": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "securitySolution",
-        "id": "def-server.deleteAllIndex",
-        "type": "Function",
-        "tags": [],
-        "label": "deleteAllIndex",
-        "description": [],
-        "signature": [
-          "(esClient: ",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCorePluginApi",
-            "section": "def-server.ElasticsearchClient",
-            "text": "ElasticsearchClient"
-          },
-          ", pattern: string, maxAttempts?: number) => Promise<boolean>"
-        ],
-        "source": {
-          "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/delete_all_index.ts",
-          "lineNumber": 10
-        },
-        "deprecated": false,
-        "children": [
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.deleteAllIndex.$1",
-            "type": "CompoundType",
-            "tags": [],
-            "label": "esClient",
-            "description": [],
-            "signature": [
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCorePluginApi",
-                "section": "def-server.ElasticsearchClient",
-                "text": "ElasticsearchClient"
-              }
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/delete_all_index.ts",
-              "lineNumber": 11
-            },
-            "deprecated": false,
-            "isRequired": true
-          },
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.deleteAllIndex.$2",
-            "type": "string",
-            "tags": [],
-            "label": "pattern",
-            "description": [],
-            "signature": [
-              "string"
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/delete_all_index.ts",
-              "lineNumber": 12
-            },
-            "deprecated": false,
-            "isRequired": true
-          },
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.deleteAllIndex.$3",
-            "type": "number",
-            "tags": [],
-            "label": "maxAttempts",
-            "description": [],
-            "signature": [
-              "number"
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/delete_all_index.ts",
-              "lineNumber": 13
-            },
-            "deprecated": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "securitySolution",
-        "id": "def-server.deletePolicy",
-        "type": "Function",
-        "tags": [],
-        "label": "deletePolicy",
-        "description": [],
-        "signature": [
-          "(esClient: ",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCorePluginApi",
-            "section": "def-server.ElasticsearchClient",
-            "text": "ElasticsearchClient"
-          },
-          ", policy: string) => Promise<unknown>"
-        ],
-        "source": {
-          "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/delete_policy.ts",
-          "lineNumber": 10
-        },
-        "deprecated": false,
-        "children": [
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.deletePolicy.$1",
-            "type": "CompoundType",
-            "tags": [],
-            "label": "esClient",
-            "description": [],
-            "signature": [
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCorePluginApi",
-                "section": "def-server.ElasticsearchClient",
-                "text": "ElasticsearchClient"
-              }
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/delete_policy.ts",
-              "lineNumber": 11
-            },
-            "deprecated": false,
-            "isRequired": true
-          },
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.deletePolicy.$2",
-            "type": "string",
-            "tags": [],
-            "label": "policy",
-            "description": [],
-            "signature": [
-              "string"
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/delete_policy.ts",
-              "lineNumber": 12
-            },
-            "deprecated": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "securitySolution",
-        "id": "def-server.deleteTemplate",
-        "type": "Function",
-        "tags": [],
-        "label": "deleteTemplate",
-        "description": [],
-        "signature": [
-          "(esClient: ",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCorePluginApi",
-            "section": "def-server.ElasticsearchClient",
-            "text": "ElasticsearchClient"
-          },
-          ", name: string) => Promise<unknown>"
-        ],
-        "source": {
-          "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/delete_template.ts",
-          "lineNumber": 9
-        },
-        "deprecated": false,
-        "children": [
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.deleteTemplate.$1",
-            "type": "CompoundType",
-            "tags": [],
-            "label": "esClient",
-            "description": [],
-            "signature": [
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCorePluginApi",
-                "section": "def-server.ElasticsearchClient",
-                "text": "ElasticsearchClient"
-              }
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/delete_template.ts",
-              "lineNumber": 10
-            },
-            "deprecated": false,
-            "isRequired": true
-          },
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.deleteTemplate.$2",
-            "type": "string",
-            "tags": [],
-            "label": "name",
-            "description": [],
-            "signature": [
-              "string"
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/delete_template.ts",
-              "lineNumber": 11
-            },
-            "deprecated": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "securitySolution",
-        "id": "def-server.getIndexExists",
-        "type": "Function",
-        "tags": [],
-        "label": "getIndexExists",
-        "description": [],
-        "signature": [
-          "(esClient: ",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCorePluginApi",
-            "section": "def-server.ElasticsearchClient",
-            "text": "ElasticsearchClient"
-          },
-          ", index: string) => Promise<boolean>"
-        ],
-        "source": {
-          "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/get_index_exists.ts",
-          "lineNumber": 10
-        },
-        "deprecated": false,
-        "children": [
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.getIndexExists.$1",
-            "type": "CompoundType",
-            "tags": [],
-            "label": "esClient",
-            "description": [],
-            "signature": [
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCorePluginApi",
-                "section": "def-server.ElasticsearchClient",
-                "text": "ElasticsearchClient"
-              }
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/get_index_exists.ts",
-              "lineNumber": 11
-            },
-            "deprecated": false,
-            "isRequired": true
-          },
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.getIndexExists.$2",
-            "type": "string",
-            "tags": [],
-            "label": "index",
-            "description": [],
-            "signature": [
-              "string"
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/get_index_exists.ts",
-              "lineNumber": 12
-            },
-            "deprecated": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "securitySolution",
-        "id": "def-server.getPolicyExists",
-        "type": "Function",
-        "tags": [],
-        "label": "getPolicyExists",
-        "description": [],
-        "signature": [
-          "(esClient: ",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCorePluginApi",
-            "section": "def-server.ElasticsearchClient",
-            "text": "ElasticsearchClient"
-          },
-          ", policy: string) => Promise<boolean>"
-        ],
-        "source": {
-          "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/get_policy_exists.ts",
-          "lineNumber": 10
-        },
-        "deprecated": false,
-        "children": [
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.getPolicyExists.$1",
-            "type": "CompoundType",
-            "tags": [],
-            "label": "esClient",
-            "description": [],
-            "signature": [
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCorePluginApi",
-                "section": "def-server.ElasticsearchClient",
-                "text": "ElasticsearchClient"
-              }
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/get_policy_exists.ts",
-              "lineNumber": 11
-            },
-            "deprecated": false,
-            "isRequired": true
-          },
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.getPolicyExists.$2",
-            "type": "string",
-            "tags": [],
-            "label": "policy",
-            "description": [],
-            "signature": [
-              "string"
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/get_policy_exists.ts",
-              "lineNumber": 12
-            },
-            "deprecated": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "securitySolution",
-        "id": "def-server.getTemplateExists",
-        "type": "Function",
-        "tags": [],
-        "label": "getTemplateExists",
-        "description": [],
-        "signature": [
-          "(esClient: ",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCorePluginApi",
-            "section": "def-server.ElasticsearchClient",
-            "text": "ElasticsearchClient"
-          },
-          ", template: string) => Promise<boolean>"
-        ],
-        "source": {
-          "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/get_template_exists.ts",
-          "lineNumber": 10
-        },
-        "deprecated": false,
-        "children": [
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.getTemplateExists.$1",
-            "type": "CompoundType",
-            "tags": [],
-            "label": "esClient",
-            "description": [],
-            "signature": [
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCorePluginApi",
-                "section": "def-server.ElasticsearchClient",
-                "text": "ElasticsearchClient"
-              }
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/get_template_exists.ts",
-              "lineNumber": 11
-            },
-            "deprecated": false,
-            "isRequired": true
-          },
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.getTemplateExists.$2",
-            "type": "string",
-            "tags": [],
-            "label": "template",
-            "description": [],
-            "signature": [
-              "string"
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/get_template_exists.ts",
-              "lineNumber": 12
-            },
-            "deprecated": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "securitySolution",
-        "id": "def-server.readPrivileges",
-        "type": "Function",
-        "tags": [],
-        "label": "readPrivileges",
-        "description": [],
-        "signature": [
-          "(callWithRequest: ",
-          "CallWithRequest",
-          "<{}, unknown>, index: string) => Promise<unknown>"
-        ],
-        "source": {
-          "path": "x-pack/plugins/security_solution/server/lib/detection_engine/privileges/read_privileges.ts",
-          "lineNumber": 10
-        },
-        "deprecated": false,
-        "children": [
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.readPrivileges.$1",
-            "type": "Function",
-            "tags": [],
-            "label": "callWithRequest",
-            "description": [],
-            "signature": [
-              "CallWithRequest",
-              "<{}, unknown>"
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/privileges/read_privileges.ts",
-              "lineNumber": 11
-            },
-            "deprecated": false,
-            "isRequired": true
-          },
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.readPrivileges.$2",
-            "type": "string",
-            "tags": [],
-            "label": "index",
-            "description": [],
-            "signature": [
-              "string"
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/privileges/read_privileges.ts",
-              "lineNumber": 12
-            },
-            "deprecated": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "securitySolution",
-        "id": "def-server.setPolicy",
-        "type": "Function",
-        "tags": [],
-        "label": "setPolicy",
-        "description": [],
-        "signature": [
-          "(esClient: ",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCorePluginApi",
-            "section": "def-server.ElasticsearchClient",
-            "text": "ElasticsearchClient"
-          },
-          ", policy: string, body: Record<string, unknown>) => Promise<unknown>"
-        ],
-        "source": {
-          "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/set_policy.ts",
-          "lineNumber": 10
-        },
-        "deprecated": false,
-        "children": [
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.setPolicy.$1",
-            "type": "CompoundType",
-            "tags": [],
-            "label": "esClient",
-            "description": [],
-            "signature": [
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCorePluginApi",
-                "section": "def-server.ElasticsearchClient",
-                "text": "ElasticsearchClient"
-              }
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/set_policy.ts",
-              "lineNumber": 11
-            },
-            "deprecated": false,
-            "isRequired": true
-          },
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.setPolicy.$2",
-            "type": "string",
-            "tags": [],
-            "label": "policy",
-            "description": [],
-            "signature": [
-              "string"
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/set_policy.ts",
-              "lineNumber": 12
-            },
-            "deprecated": false,
-            "isRequired": true
-          },
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.setPolicy.$3",
-            "type": "Object",
-            "tags": [],
-            "label": "body",
-            "description": [],
-            "signature": [
-              "Record<string, unknown>"
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/set_policy.ts",
-              "lineNumber": 13
-            },
-            "deprecated": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "securitySolution",
-        "id": "def-server.setTemplate",
-        "type": "Function",
-        "tags": [],
-        "label": "setTemplate",
-        "description": [],
-        "signature": [
-          "(esClient: ",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCorePluginApi",
-            "section": "def-server.ElasticsearchClient",
-            "text": "ElasticsearchClient"
-          },
-          ", name: string, body: Record<string, unknown>) => Promise<unknown>"
-        ],
-        "source": {
-          "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/set_template.ts",
-          "lineNumber": 10
-        },
-        "deprecated": false,
-        "children": [
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.setTemplate.$1",
-            "type": "CompoundType",
-            "tags": [],
-            "label": "esClient",
-            "description": [],
-            "signature": [
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCorePluginApi",
-                "section": "def-server.ElasticsearchClient",
-                "text": "ElasticsearchClient"
-              }
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/set_template.ts",
-              "lineNumber": 11
-            },
-            "deprecated": false,
-            "isRequired": true
-          },
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.setTemplate.$2",
-            "type": "string",
-            "tags": [],
-            "label": "name",
-            "description": [],
-            "signature": [
-              "string"
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/set_template.ts",
-              "lineNumber": 12
-            },
-            "deprecated": false,
-            "isRequired": true
-          },
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.setTemplate.$3",
-            "type": "Object",
-            "tags": [],
-            "label": "body",
-            "description": [],
-            "signature": [
-              "Record<string, unknown>"
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/set_template.ts",
-              "lineNumber": 13
-            },
-            "deprecated": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "securitySolution",
-        "id": "def-server.transformError",
-        "type": "Function",
-        "tags": [],
-        "label": "transformError",
-        "description": [],
-        "signature": [
-          "(err: Error & Partial<",
-          "ResponseError",
-          "<Record<string, any>, unknown>>) => ",
-          "OutputError"
-        ],
-        "source": {
-          "path": "x-pack/plugins/security_solution/server/lib/detection_engine/routes/utils.ts",
-          "lineNumber": 28
-        },
-        "deprecated": false,
-        "children": [
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.transformError.$1",
-            "type": "CompoundType",
-            "tags": [],
-            "label": "err",
-            "description": [],
-            "signature": [
-              "Error & Partial<",
-              "ResponseError",
-              "<Record<string, any>, unknown>>"
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/routes/utils.ts",
-              "lineNumber": 28
-            },
-            "deprecated": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      }
-    ],
+    "functions": [],
     "interfaces": [
       {
         "parentPluginId": "securitySolution",
@@ -1628,7 +737,7 @@
       "description": [],
       "source": {
         "path": "x-pack/plugins/security_solution/server/plugin.ts",
-        "lineNumber": 115
+        "lineNumber": 117
       },
       "deprecated": false,
       "children": [],
@@ -1644,7 +753,7 @@
       "description": [],
       "source": {
         "path": "x-pack/plugins/security_solution/server/plugin.ts",
-        "lineNumber": 118
+        "lineNumber": 120
       },
       "deprecated": false,
       "children": [],
@@ -1855,15 +964,7 @@
           "lineNumber": 14
         },
         "deprecated": true,
-        "references": [
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/server/siem_server_deps.ts",
-              "lineNumber": 24
-            }
-          }
-        ],
+        "references": [],
         "children": [
           {
             "parentPluginId": "securitySolution",
diff --git a/api_docs/security_solution.mdx b/api_docs/security_solution.mdx
index 397b2d5238596..4cd726b97bbc7 100644
--- a/api_docs/security_solution.mdx
+++ b/api_docs/security_solution.mdx
@@ -27,9 +27,6 @@ import securitySolutionObj from './security_solution.json';
 ### Start
 <DocDefinitionList data={[securitySolutionObj.server.start]}/>
 
-### Functions
-<DocDefinitionList data={securitySolutionObj.server.functions}/>
-
 ### Classes
 <DocDefinitionList data={securitySolutionObj.server.classes}/>
 
diff --git a/api_docs/spaces.json b/api_docs/spaces.json
index 6edfbd5c2bc47..09b27bf771621 100644
--- a/api_docs/spaces.json
+++ b/api_docs/spaces.json
@@ -1211,7 +1211,7 @@
                 "plugin": "securitySolution",
                 "link": {
                   "path": "x-pack/plugins/security_solution/server/plugin.ts",
-                  "lineNumber": 202
+                  "lineNumber": 204
                 }
               },
               {
@@ -1363,14 +1363,14 @@
                 "plugin": "security",
                 "link": {
                   "path": "x-pack/plugins/security/server/saved_objects/secure_saved_objects_client_wrapper.ts",
-                  "lineNumber": 784
+                  "lineNumber": 1000
                 }
               },
               {
                 "plugin": "security",
                 "link": {
                   "path": "x-pack/plugins/security/server/saved_objects/secure_saved_objects_client_wrapper.ts",
-                  "lineNumber": 811
+                  "lineNumber": 1027
                 }
               },
               {
@@ -2017,7 +2017,7 @@
               "plugin": "securitySolution",
               "link": {
                 "path": "x-pack/plugins/security_solution/server/plugin.ts",
-                "lineNumber": 202
+                "lineNumber": 204
               }
             },
             {
diff --git a/api_docs/spaces_oss.json b/api_docs/spaces_oss.json
index 76ebab516b91c..b3c91875c8a24 100644
--- a/api_docs/spaces_oss.json
+++ b/api_docs/spaces_oss.json
@@ -221,7 +221,7 @@
             "tags": [],
             "label": "changeSpacesHandler",
             "description": [
-              "\nOptional handler that is called when the user has saved changes and there are spaces to be added to and/or removed from the object. If\nthis is not defined, a default handler will be used that calls `/api/spaces/_share_saved_object_add` and/or\n`/api/spaces/_share_saved_object_remove` and displays toast(s) indicating what occurred."
+              "\nOptional handler that is called when the user has saved changes and there are spaces to be added to and/or removed from the object. If\nthis is not defined, a default handler will be used that calls `/api/spaces/_update_objects_spaces` and displays a toast indicating\nwhat occurred."
             ],
             "signature": [
               "((spacesToAdd: string[], spacesToRemove: string[]) => Promise<void>) | undefined"
diff --git a/api_docs/telemetry_collection_manager.json b/api_docs/telemetry_collection_manager.json
index 713eb39085209..1abe3a5acbda7 100644
--- a/api_docs/telemetry_collection_manager.json
+++ b/api_docs/telemetry_collection_manager.json
@@ -114,7 +114,7 @@
                 "section": "def-server.SavedObjectsClient",
                 "text": "SavedObjectsClient"
               },
-              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"addToNamespaces\" | \"deleteFromNamespaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
+              ", \"get\" | \"delete\" | \"create\" | \"bulkCreate\" | \"checkConflicts\" | \"find\" | \"bulkGet\" | \"resolve\" | \"update\" | \"collectMultiNamespaceReferences\" | \"updateObjectsSpaces\" | \"bulkUpdate\" | \"removeReferencesTo\" | \"openPointInTimeForType\" | \"closePointInTime\" | \"createPointInTimeFinder\" | \"errors\">"
             ],
             "source": {
               "path": "src/plugins/telemetry_collection_manager/server/types.ts",
diff --git a/x-pack/plugins/apm/public/components/alerting/register_apm_alerts.ts b/x-pack/plugins/apm/public/components/alerting/register_apm_alerts.ts
index 35dbca0df1ec4..7e788016baad2 100644
--- a/x-pack/plugins/apm/public/components/alerting/register_apm_alerts.ts
+++ b/x-pack/plugins/apm/public/components/alerting/register_apm_alerts.ts
@@ -16,11 +16,11 @@ import {
 import type { ObservabilityRuleTypeRegistry } from '../../../../observability/public';
 import { ENVIRONMENT_ALL } from '../../../common/environment_filter_values';
 import { AlertType } from '../../../common/alert_types';
-import {
-  SERVICE_ENVIRONMENT,
-  SERVICE_NAME,
-  TRANSACTION_TYPE,
-} from '../../../common/elasticsearch_fieldnames';
+
+// copied from elasticsearch_fieldnames.ts to limit page load bundle size
+const SERVICE_ENVIRONMENT = 'service.environment';
+const SERVICE_NAME = 'service.name';
+const TRANSACTION_TYPE = 'transaction.type';
 
 const format = ({
   pathname,
diff --git a/x-pack/plugins/security_solution/common/constants.ts b/x-pack/plugins/security_solution/common/constants.ts
index e913077ce0314..dddfafc7ddf05 100644
--- a/x-pack/plugins/security_solution/common/constants.ts
+++ b/x-pack/plugins/security_solution/common/constants.ts
@@ -25,12 +25,12 @@ export const DEFAULT_TIME_RANGE = 'timepicker:timeDefaults';
 export const DEFAULT_REFRESH_RATE_INTERVAL = 'timepicker:refreshIntervalDefaults';
 export const DEFAULT_APP_TIME_RANGE = 'securitySolution:timeDefaults';
 export const DEFAULT_APP_REFRESH_INTERVAL = 'securitySolution:refreshIntervalDefaults';
+export const DEFAULT_ALERTS_INDEX = '*alerts-security-solution*';
 export const DEFAULT_SIGNALS_INDEX = '.siem-signals';
 export const DEFAULT_LISTS_INDEX = '.lists';
 export const DEFAULT_ITEMS_INDEX = '.items';
 // The DEFAULT_MAX_SIGNALS value exists also in `x-pack/plugins/cases/common/constants.ts`
 // If either changes, engineer should ensure both values are updated
-export const DEFAULT_ALERTS_INDEX = '*alerts-security-solution*';
 export const DEFAULT_MAX_SIGNALS = 100;
 export const DEFAULT_SEARCH_AFTER_PAGE_SIZE = 100;
 export const DEFAULT_ANOMALY_SCORE = 'securitySolution:defaultAnomalyScore';
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.tsx
index 614f5301c82e2..23bbf1376c1b6 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.tsx
@@ -19,9 +19,11 @@ import { getUpdateAlertsQuery } from '../../../detections/components/alerts_tabl
 import {
   buildAlertStatusFilter,
   buildAlertsRuleIdFilter,
+  buildAlertStatusFilterRuleRegistry,
 } from '../../../detections/components/alerts_table/default_config';
 import { getQueryFilter } from '../../../../common/detection_engine/get_query_filter';
 import { Index } from '../../../../common/detection_engine/schemas/common/schemas';
+import { useIsExperimentalFeatureEnabled } from '../../hooks/use_experimental_features';
 import { formatExceptionItemForUpdate, prepareExceptionItemsForBulkClose } from './helpers';
 import { useKibana } from '../../lib/kibana';
 
@@ -82,6 +84,8 @@ export const useAddOrUpdateException = ({
     },
     []
   );
+  // TODO: Once we are past experimental phase this code should be removed
+  const ruleRegistryEnabled = useIsExperimentalFeatureEnabled('ruleRegistryEnabled');
 
   useEffect(() => {
     let isSubscribed = true;
@@ -127,10 +131,15 @@ export const useAddOrUpdateException = ({
         }
 
         if (bulkCloseIndex != null) {
+          // TODO: Once we are past experimental phase this code should be removed
+          const alertStatusFilter = ruleRegistryEnabled
+            ? buildAlertStatusFilterRuleRegistry('open')
+            : buildAlertStatusFilter('open');
+
           const filter = getQueryFilter(
             '',
             'kuery',
-            [...buildAlertsRuleIdFilter(ruleId), ...buildAlertStatusFilter('open')],
+            [...buildAlertsRuleIdFilter(ruleId), ...alertStatusFilter],
             bulkCloseIndex,
             prepareExceptionItemsForBulkClose(exceptionItemsToAddOrUpdate),
             false
@@ -176,7 +185,14 @@ export const useAddOrUpdateException = ({
       isSubscribed = false;
       abortCtrl.abort();
     };
-  }, [http, onSuccess, onError, updateExceptionListItem, addExceptionListItem]);
+  }, [
+    addExceptionListItem,
+    http,
+    onSuccess,
+    onError,
+    ruleRegistryEnabled,
+    updateExceptionListItem,
+  ]);
 
   return [{ isLoading }, addOrUpdateException];
 };
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/default_config.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/default_config.tsx
index 42a3901a3a54d..eb922ffeb3361 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/default_config.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/default_config.tsx
@@ -15,23 +15,23 @@ import { timelineDefaults } from '../../../timelines/store/timeline/defaults';
 import { columns } from '../../configurations/security_solution_detections/columns';
 
 export const buildAlertStatusFilter = (status: Status): Filter[] => [
-  // {
-  //   meta: {
-  //     alias: null,
-  //     negate: false,
-  //     disabled: false,
-  //     type: 'phrase',
-  //     key: 'signal.status',
-  //     params: {
-  //       query: status,
-  //     },
-  //   },
-  //   query: {
-  //     term: {
-  //       'signal.status': status,
-  //     },
-  //   },
-  // },
+  {
+    meta: {
+      alias: null,
+      negate: false,
+      disabled: false,
+      type: 'phrase',
+      key: 'signal.status',
+      params: {
+        query: status,
+      },
+    },
+    query: {
+      term: {
+        'signal.status': status,
+      },
+    },
+  },
 ];
 
 export const buildAlertsRuleIdFilter = (ruleId: string | null): Filter[] =>
@@ -61,18 +61,18 @@ export const buildShowBuildingBlockFilter = (showBuildingBlockAlerts: boolean):
   showBuildingBlockAlerts
     ? []
     : [
-        // {
-        //   meta: {
-        //     alias: null,
-        //     negate: true,
-        //     disabled: false,
-        //     type: 'exists',
-        //     key: 'signal.rule.building_block_type',
-        //     value: 'exists',
-        //   },
-        //   // @ts-expect-error TODO: Rework parent typings to support ExistsFilter[]
-        //   exists: { field: 'signal.rule.building_block_type' },
-        // },
+        {
+          meta: {
+            alias: null,
+            negate: true,
+            disabled: false,
+            type: 'exists',
+            key: 'signal.rule.building_block_type',
+            value: 'exists',
+          },
+          // @ts-expect-error TODO: Rework parent typings to support ExistsFilter[]
+          exists: { field: 'signal.rule.building_block_type' },
+        },
       ];
 
 export const buildThreatMatchFilter = (showOnlyThreatIndicatorAlerts: boolean): Filter[] =>
@@ -127,6 +127,46 @@ export const requiredFieldsForActions = [
 ];
 
 // TODO: Once we are past experimental phase this code should be removed
+export const buildAlertStatusFilterRuleRegistry = (status: Status): Filter[] => [
+  {
+    meta: {
+      alias: null,
+      negate: false,
+      disabled: false,
+      type: 'phrase',
+      key: 'kibana.rac.alert.status',
+      params: {
+        query: status,
+      },
+    },
+    query: {
+      term: {
+        'kibana.rac.alert.status': status,
+      },
+    },
+  },
+];
+
+export const buildShowBuildingBlockFilterRuleRegistry = (
+  showBuildingBlockAlerts: boolean
+): Filter[] =>
+  showBuildingBlockAlerts
+    ? []
+    : [
+        {
+          meta: {
+            alias: null,
+            negate: true,
+            disabled: false,
+            type: 'exists',
+            key: 'kibana.rac.rule.building_block_type',
+            value: 'exists',
+          },
+          // @ts-expect-error TODO: Rework parent typings to support ExistsFilter[]
+          exists: { field: 'kibana.rac.rule.building_block_type' },
+        },
+      ];
+
 export const requiredFieldsForActionsRuleRegistry = [
   'alert.id',
   '@timestamp',
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx
index 04140e167bb54..f20754fc446d6 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx
@@ -31,6 +31,7 @@ import {
   alertsDefaultModel,
   buildAlertStatusFilter,
   alertsDefaultModelRuleRegistry,
+  buildAlertStatusFilterRuleRegistry,
 } from './default_config';
 import { FILTER_OPEN, AlertsTableFilterGroup } from './alerts_filter_group';
 import { AlertsUtilityBar } from './alerts_utility_bar';
@@ -240,7 +241,11 @@ export const AlertsTableComponent: React.FC<AlertsTableComponentProps> = ({
       refetchQuery: inputsModel.Refetch,
       { status, selectedStatus }: UpdateAlertsStatusProps
     ) => {
-      const currentStatusFilter = buildAlertStatusFilter(status);
+      // TODO: Once we are past experimental phase this code should be removed
+      const currentStatusFilter = ruleRegistryEnabled
+        ? buildAlertStatusFilterRuleRegistry(status)
+        : buildAlertStatusFilter(status);
+
       await updateAlertStatusAction({
         query: showClearSelectionAction
           ? getGlobalQuery(currentStatusFilter)?.filterQuery
@@ -262,6 +267,7 @@ export const AlertsTableComponent: React.FC<AlertsTableComponentProps> = ({
       showClearSelectionAction,
       onAlertStatusUpdateSuccess,
       onAlertStatusUpdateFailure,
+      ruleRegistryEnabled,
     ]
   );
 
@@ -305,12 +311,17 @@ export const AlertsTableComponent: React.FC<AlertsTableComponentProps> = ({
   );
 
   const defaultFiltersMemo = useMemo(() => {
+    // TODO: Once we are past experimental phase this code should be removed
+    const alertStatusFilter = ruleRegistryEnabled
+      ? buildAlertStatusFilterRuleRegistry(filterGroup)
+      : buildAlertStatusFilter(filterGroup);
+
     if (isEmpty(defaultFilters)) {
-      return buildAlertStatusFilter(filterGroup);
+      return alertStatusFilter;
     } else if (defaultFilters != null && !isEmpty(defaultFilters)) {
-      return [...defaultFilters, ...buildAlertStatusFilter(filterGroup)];
+      return [...defaultFilters, ...alertStatusFilter];
     }
-  }, [defaultFilters, filterGroup]);
+  }, [defaultFilters, filterGroup, ruleRegistryEnabled]);
   const { filterManager } = useKibana().services.data.query;
 
   // TODO: Once we are past experimental phase this code should be removed
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.tsx
index c1c7e4688bbbe..8ae7e4fb2852b 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.tsx
@@ -11,6 +11,7 @@ import { noop } from 'lodash/fp';
 import React, { useCallback, useMemo, useRef, useState } from 'react';
 import { useDispatch } from 'react-redux';
 import { useHistory } from 'react-router-dom';
+import { useIsExperimentalFeatureEnabled } from '../../../common/hooks/use_experimental_features';
 
 import { useDeepEqualSelector, useShallowEqualSelector } from '../../../common/hooks/use_selector';
 import { SecurityPageName } from '../../../app/types';
@@ -51,6 +52,7 @@ import { timelineSelectors } from '../../../timelines/store/timeline';
 import { timelineDefaults } from '../../../timelines/store/timeline/defaults';
 import {
   buildShowBuildingBlockFilter,
+  buildShowBuildingBlockFilterRuleRegistry,
   buildThreatMatchFilter,
 } from '../../components/alerts_table/default_config';
 import { useSourcererScope } from '../../../common/containers/sourcerer';
@@ -81,6 +83,8 @@ const DetectionEnginePageComponent = () => {
   const getGlobalQuerySelector = useMemo(() => inputsSelectors.globalQuerySelector(), []);
   const query = useDeepEqualSelector(getGlobalQuerySelector);
   const filters = useDeepEqualSelector(getGlobalFiltersQuerySelector);
+  // TODO: Once we are past experimental phase this code should be removed
+  const ruleRegistryEnabled = useIsExperimentalFeatureEnabled('ruleRegistryEnabled');
 
   const { to, from, deleteQuery, setQuery } = useGlobalTime();
   const { globalFullScreen } = useGlobalFullScreen();
@@ -134,19 +138,23 @@ const DetectionEnginePageComponent = () => {
   const alertsHistogramDefaultFilters = useMemo(
     () => [
       ...filters,
-      ...buildShowBuildingBlockFilter(showBuildingBlockAlerts),
+      ...(ruleRegistryEnabled
+        ? buildShowBuildingBlockFilterRuleRegistry(showBuildingBlockAlerts) // TODO: Once we are past experimental phase this code should be removed
+        : buildShowBuildingBlockFilter(showBuildingBlockAlerts)),
       ...buildThreatMatchFilter(showOnlyThreatIndicatorAlerts),
     ],
-    [filters, showBuildingBlockAlerts, showOnlyThreatIndicatorAlerts]
+    [filters, ruleRegistryEnabled, showBuildingBlockAlerts, showOnlyThreatIndicatorAlerts]
   );
 
   // AlertsTable manages global filters itself, so not including `filters`
   const alertsTableDefaultFilters = useMemo(
     () => [
-      ...buildShowBuildingBlockFilter(showBuildingBlockAlerts),
+      ...(ruleRegistryEnabled
+        ? buildShowBuildingBlockFilterRuleRegistry(showBuildingBlockAlerts) // TODO: Once we are past experimental phase this code should be removed
+        : buildShowBuildingBlockFilter(showBuildingBlockAlerts)),
       ...buildThreatMatchFilter(showOnlyThreatIndicatorAlerts),
     ],
-    [showBuildingBlockAlerts, showOnlyThreatIndicatorAlerts]
+    [ruleRegistryEnabled, showBuildingBlockAlerts, showOnlyThreatIndicatorAlerts]
   );
 
   const onShowBuildingBlockAlertsChangedCallback = useCallback(
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx
index 0fab428ef6d1b..0f379acd6c5cc 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx
@@ -27,6 +27,7 @@ import { useParams, useHistory } from 'react-router-dom';
 import { useDispatch } from 'react-redux';
 import styled from 'styled-components';
 import deepEqual from 'fast-deep-equal';
+import { useIsExperimentalFeatureEnabled } from '../../../../../common/hooks/use_experimental_features';
 
 import {
   useDeepEqualSelector,
@@ -60,6 +61,7 @@ import { StepScheduleRule } from '../../../../components/rules/step_schedule_rul
 import {
   buildAlertsRuleIdFilter,
   buildShowBuildingBlockFilter,
+  buildShowBuildingBlockFilterRuleRegistry,
   buildThreatMatchFilter,
 } from '../../../../components/alerts_table/default_config';
 import { RuleSwitch } from '../../../../components/rules/rule_switch';
@@ -218,6 +220,9 @@ const RuleDetailsPageComponent = () => {
   const { formatUrl } = useFormatUrl(SecurityPageName.detections);
   const { globalFullScreen } = useGlobalFullScreen();
 
+  // TODO: Once we are past experimental phase this code should be removed
+  const ruleRegistryEnabled = useIsExperimentalFeatureEnabled('ruleRegistryEnabled');
+
   // TODO: Refactor license check + hasMlAdminPermissions to common check
   const hasMlPermissions = hasMlLicense(mlCapabilities) && hasMlAdminPermissions(mlCapabilities);
   const {
@@ -303,10 +308,12 @@ const RuleDetailsPageComponent = () => {
   const alertDefaultFilters = useMemo(
     () => [
       ...buildAlertsRuleIdFilter(ruleId),
-      ...buildShowBuildingBlockFilter(showBuildingBlockAlerts),
+      ...(ruleRegistryEnabled
+        ? buildShowBuildingBlockFilterRuleRegistry(showBuildingBlockAlerts) // TODO: Once we are past experimental phase this code should be removed
+        : buildShowBuildingBlockFilter(showBuildingBlockAlerts)),
       ...buildThreatMatchFilter(showOnlyThreatIndicatorAlerts),
     ],
-    [ruleId, showBuildingBlockAlerts, showOnlyThreatIndicatorAlerts]
+    [ruleId, ruleRegistryEnabled, showBuildingBlockAlerts, showOnlyThreatIndicatorAlerts]
   );
 
   const alertMergedFilters = useMemo(() => [...alertDefaultFilters, ...filters], [
diff --git a/x-pack/plugins/security_solution/public/plugin.tsx b/x-pack/plugins/security_solution/public/plugin.tsx
index efbe857d168d8..afa8974dfc522 100644
--- a/x-pack/plugins/security_solution/public/plugin.tsx
+++ b/x-pack/plugins/security_solution/public/plugin.tsx
@@ -44,6 +44,7 @@ import {
   APP_PATH,
   DEFAULT_INDEX_KEY,
   DETECTION_ENGINE_INDEX_URL,
+  DEFAULT_ALERTS_INDEX,
 } from '../common/constants';
 
 import { SecurityPageName } from './app/types';
@@ -446,6 +447,9 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
    */
   private async store(coreStart: CoreStart, startPlugins: StartPlugins): Promise<SecurityAppStore> {
     if (!this._store) {
+      const experimentalFeatures = parseExperimentalConfigValue(
+        this.config.enableExperimental || []
+      );
       const defaultIndicesName = coreStart.uiSettings.get(DEFAULT_INDEX_KEY);
       const [
         { createStore, createInitialState },
@@ -474,9 +478,15 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
 
       let signal: { name: string | null } = { name: null };
       try {
-        signal = await coreStart.http.fetch(DETECTION_ENGINE_INDEX_URL, {
-          method: 'GET',
-        });
+        // TODO: Once we are past experimental phase this code should be removed
+        // TODO: This currently prevents TGrid from refreshing
+        if (experimentalFeatures.ruleRegistryEnabled) {
+          signal = { name: DEFAULT_ALERTS_INDEX };
+        } else {
+          signal = await coreStart.http.fetch(DETECTION_ENGINE_INDEX_URL, {
+            method: 'GET',
+          });
+        }
       } catch {
         signal = { name: null };
       }
@@ -514,7 +524,7 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
             kibanaIndexPatterns,
             configIndexPatterns: configIndexPatterns.indicesExist,
             signalIndexName: signal.name,
-            enableExperimental: parseExperimentalConfigValue(this.config.enableExperimental || []),
+            enableExperimental: experimentalFeatures,
           }
         ),
         {
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_eql.sh b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_eql.sh
old mode 100644
new mode 100755
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_query.sh b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_query.sh
old mode 100644
new mode 100755
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_threshold.sh b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_threshold.sh
old mode 100644
new mode 100755
index 95481ee4ad0df..8b486b165c34b
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_threshold.sh
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/scripts/create_reference_rule_threshold.sh
@@ -16,7 +16,9 @@ curl -X POST http://localhost:5601/${BASE_PATH}/api/alerts/alert \
   "params":{
      "indexPatterns": ["*"],
      "customQuery": "*:*",
-     "thresholdFields": ["source.ip", "destination.ip"]
+     "thresholdFields": ["source.ip", "destination.ip"],
+     "thresholdValue": 50,
+     "thresholdCardinality": []
    },
    "consumer":"alerts",
    "alertTypeId":"siem.thresholdRule",
diff --git a/x-pack/plugins/security_solution/server/plugin.ts b/x-pack/plugins/security_solution/server/plugin.ts
index 0d3447160d98c..6789103be227e 100644
--- a/x-pack/plugins/security_solution/server/plugin.ts
+++ b/x-pack/plugins/security_solution/server/plugin.ts
@@ -248,7 +248,11 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
       REFERENCE_RULE_ALERT_TYPE_ID,
       REFERENCE_RULE_PERSISTENCE_ALERT_TYPE_ID,
     ];
-    const ruleTypes = [SIGNALS_ID, NOTIFICATIONS_ID, ...referenceRuleTypes];
+    const ruleTypes = [
+      SIGNALS_ID,
+      NOTIFICATIONS_ID,
+      ...(experimentalFeatures.ruleRegistryEnabled ? referenceRuleTypes : []),
+    ];
 
     plugins.features.registerKibanaFeature({
       id: SERVER_APP_ID,

From 14a0f807728d58c9ac0268e6beac69b460b482d6 Mon Sep 17 00:00:00 2001
From: Garrett Spong <garrett.spong@elastic.co>
Date: Fri, 14 May 2021 19:27:51 -0600
Subject: [PATCH 52/54] Fixing the jester

---
 .../exceptions/use_add_exception.test.tsx       | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.test.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.test.tsx
index 0f6dd19ea9b66..6d9f7234e8f27 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.test.tsx
@@ -21,6 +21,7 @@ import {
   CreateExceptionListItemSchema,
   UpdateExceptionListItemSchema,
 } from '../../../lists_plugin_deps';
+import { TestProviders } from '../../mock';
 import {
   useAddOrUpdateException,
   UseAddOrUpdateExceptionProps,
@@ -133,12 +134,16 @@ describe('useAddOrUpdateException', () => {
 
     addOrUpdateItemsArgs = [ruleId, itemsToAddOrUpdate];
     render = () =>
-      renderHook<UseAddOrUpdateExceptionProps, ReturnUseAddOrUpdateException>(() =>
-        useAddOrUpdateException({
-          http: mockKibanaHttpService,
-          onError,
-          onSuccess,
-        })
+      renderHook<UseAddOrUpdateExceptionProps, ReturnUseAddOrUpdateException>(
+        () =>
+          useAddOrUpdateException({
+            http: mockKibanaHttpService,
+            onError,
+            onSuccess,
+          }),
+        {
+          wrapper: TestProviders,
+        }
       );
   });
 

From 52016675ab30092dc938444ece37a3b0b1baca26 Mon Sep 17 00:00:00 2001
From: Garrett Spong <garrett.spong@elastic.co>
Date: Thu, 27 May 2021 18:15:26 -0600
Subject: [PATCH 53/54] Scopes ruleDataService to security-solution and updates
 timeline to query alerts as data index if configured

---
 .../server/rule_data_client/index.ts          |  4 +-
 .../create_persistence_rule_type_factory.ts   |  8 +--
 .../security_solution/common/constants.ts     |  2 +-
 .../alerts_table/default_config.tsx           | 46 +++++++--------
 .../public/timelines/containers/helpers.ts    | 12 +++-
 .../public/timelines/containers/index.tsx     | 15 ++++-
 .../detection_engine/reference_rules/query.ts | 55 ++++++++++--------
 .../routes/index/read_index_route.ts          | 16 ++++-
 .../signals/query_signals_route.test.ts       |  4 +-
 .../routes/signals/query_signals_route.ts     | 14 ++++-
 .../security_solution/server/plugin.ts        | 58 +++++++++++++++++--
 .../security_solution/server/routes/index.ts  |  4 +-
 12 files changed, 162 insertions(+), 76 deletions(-)

diff --git a/x-pack/plugins/rule_registry/server/rule_data_client/index.ts b/x-pack/plugins/rule_registry/server/rule_data_client/index.ts
index 135c870f20727..43122ba49519a 100644
--- a/x-pack/plugins/rule_registry/server/rule_data_client/index.ts
+++ b/x-pack/plugins/rule_registry/server/rule_data_client/index.ts
@@ -73,8 +73,8 @@ export class RuleDataClient implements IRuleDataClient {
         return clusterClient.bulk(requestWithDefaultParameters).then((response) => {
           if (response.body.errors) {
             if (
-              response.body.items.length === 1 &&
-              response.body.items[0]?.index?.error?.type === 'index_not_found_exception'
+              response.body.items.length > 0 &&
+              response.body.items?.[0]?.index?.error?.type === 'index_not_found_exception'
             ) {
               return this.createOrUpdateWriteTarget({ namespace }).then(() => {
                 return clusterClient.bulk(requestWithDefaultParameters);
diff --git a/x-pack/plugins/rule_registry/server/utils/create_persistence_rule_type_factory.ts b/x-pack/plugins/rule_registry/server/utils/create_persistence_rule_type_factory.ts
index 2d0b4e0ae33c3..0e244fbaa2ee3 100644
--- a/x-pack/plugins/rule_registry/server/utils/create_persistence_rule_type_factory.ts
+++ b/x-pack/plugins/rule_registry/server/utils/create_persistence_rule_type_factory.ts
@@ -80,6 +80,7 @@ export const createPersistenceRuleTypeFactory: CreatePersistenceRuleTypeFactory
                   ...event,
                   'event.kind': 'signal',
                   'kibana.rac.alert.id': '???',
+                  'kibana.rac.alert.status': 'open',
                   'kibana.rac.alert.uuid': v4(),
                   'kibana.rac.alert.ancestors': isAlert
                     ? ((event['kibana.rac.alert.ancestors'] as string[]) ?? []).concat([
@@ -101,12 +102,7 @@ export const createPersistenceRuleTypeFactory: CreatePersistenceRuleTypeFactory
 
       if (ruleDataClient && numAlerts) {
         await ruleDataClient.getWriter().bulk({
-          body: currentAlerts.map((alert) => ({
-            create: {
-              _index: {},
-            },
-            alert,
-          })),
+          body: currentAlerts.flatMap((event) => [{ index: {} }, event]),
         });
       }
 
diff --git a/x-pack/plugins/security_solution/common/constants.ts b/x-pack/plugins/security_solution/common/constants.ts
index dddfafc7ddf05..91b48afdc4ed1 100644
--- a/x-pack/plugins/security_solution/common/constants.ts
+++ b/x-pack/plugins/security_solution/common/constants.ts
@@ -25,7 +25,7 @@ export const DEFAULT_TIME_RANGE = 'timepicker:timeDefaults';
 export const DEFAULT_REFRESH_RATE_INTERVAL = 'timepicker:refreshIntervalDefaults';
 export const DEFAULT_APP_TIME_RANGE = 'securitySolution:timeDefaults';
 export const DEFAULT_APP_REFRESH_INTERVAL = 'securitySolution:refreshIntervalDefaults';
-export const DEFAULT_ALERTS_INDEX = '*alerts-security-solution*';
+export const DEFAULT_ALERTS_INDEX = '.alerts-security-solution';
 export const DEFAULT_SIGNALS_INDEX = '.siem-signals';
 export const DEFAULT_LISTS_INDEX = '.lists';
 export const DEFAULT_ITEMS_INDEX = '.items';
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/default_config.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/default_config.tsx
index eb922ffeb3361..02a815bc59f3b 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/default_config.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/default_config.tsx
@@ -167,30 +167,30 @@ export const buildShowBuildingBlockFilterRuleRegistry = (
         },
       ];
 
-export const requiredFieldsForActionsRuleRegistry = [
-  'alert.id',
-  '@timestamp',
-  'event.kind',
-  'alert.start',
-  'alert.uuid',
-  'event.action',
-  'alert.status',
-  'alert.duration.us',
-  'rule.uuid',
-  'rule.id',
-  'rule.name',
-  'rule.category',
-  'producer',
-  'tags',
-];
+export const requiredFieldMappingsForActionsRuleRegistry = {
+  '@timestamp': '@timestamp',
+  'alert.id': 'kibana.rac.alert.id',
+  'event.kind': 'event.kind',
+  'alert.start': 'kibana.rac.alert.start',
+  'alert.uuid': 'kibana.rac.alert.uuid',
+  'event.action': 'event.action',
+  'alert.status': 'kibana.rac.alert.status',
+  'alert.duration.us': 'kibana.rac.alert.duration.us',
+  'rule.uuid': 'rule.uuid',
+  'rule.id': 'rule.id',
+  'rule.name': 'rule.name',
+  'rule.category': 'rule.category',
+  producer: 'kibana.rac.alert.producer',
+  tags: 'tags',
+};
 
-export const alertsHeadersRuleRegistry: ColumnHeaderOptions[] = requiredFieldsForActionsRuleRegistry.map<ColumnHeaderOptions>(
-  (field) => ({
-    columnHeaderType: defaultColumnHeaderType,
-    id: field,
-    width: 120,
-  })
-);
+export const alertsHeadersRuleRegistry: ColumnHeaderOptions[] = Object.entries(
+  requiredFieldMappingsForActionsRuleRegistry
+).map<ColumnHeaderOptions>(([alias, field]) => ({
+  columnHeaderType: defaultColumnHeaderType,
+  displayAsText: alias,
+  id: field,
+}));
 
 export const alertsDefaultModelRuleRegistry: SubsetTimelineModel = {
   ...timelineDefaults,
diff --git a/x-pack/plugins/security_solution/public/timelines/containers/helpers.ts b/x-pack/plugins/security_solution/public/timelines/containers/helpers.ts
index 068f813e0fc40..2f815cc44b3ac 100644
--- a/x-pack/plugins/security_solution/public/timelines/containers/helpers.ts
+++ b/x-pack/plugins/security_solution/public/timelines/containers/helpers.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { DEFAULT_ALERTS_INDEX } from '../../../common/constants';
 import { TimelineId } from '../../../common/types/timeline';
 
 export const detectionsTimelineIds = [
@@ -12,7 +13,14 @@ export const detectionsTimelineIds = [
   TimelineId.detectionsRulesDetailsPage,
 ];
 
-export const skipQueryForDetectionsPage = (id: string, defaultIndex: string[]) =>
+// TODO: Once we are past experimental phase `useRuleRegistry` should be removed
+export const skipQueryForDetectionsPage = (
+  id: string,
+  defaultIndex: string[],
+  useRuleRegistry = false
+) =>
   id != null &&
   detectionsTimelineIds.some((timelineId) => timelineId === id) &&
-  !defaultIndex.some((di) => di.toLowerCase().startsWith('.siem-signals'));
+  !defaultIndex.some((di) =>
+    di.toLowerCase().startsWith(useRuleRegistry ? DEFAULT_ALERTS_INDEX : '.siem-signals')
+  );
diff --git a/x-pack/plugins/security_solution/public/timelines/containers/index.tsx b/x-pack/plugins/security_solution/public/timelines/containers/index.tsx
index 92199336b978c..17c107899d85a 100644
--- a/x-pack/plugins/security_solution/public/timelines/containers/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/containers/index.tsx
@@ -13,6 +13,7 @@ import { Subscription } from 'rxjs';
 
 import { ESQuery } from '../../../common/typed_json';
 import { isCompleteResponse, isErrorResponse } from '../../../../../../src/plugins/data/public';
+import { useIsExperimentalFeatureEnabled } from '../../common/hooks/use_experimental_features';
 import { inputsModel, KueryFilterQueryKind } from '../../common/store';
 import { useKibana } from '../../common/lib/kibana';
 import { createFilter } from '../../common/containers/helpers';
@@ -197,6 +198,9 @@ export const useTimelineEvents = ({
   });
   const { addError, addWarning } = useAppToasts();
 
+  // TODO: Once we are past experimental phase this code should be removed
+  const ruleRegistryEnabled = useIsExperimentalFeatureEnabled('ruleRegistryEnabled');
+
   const timelineSearch = useCallback(
     (request: TimelineRequest<typeof language> | null) => {
       if (request == null || pageName === '' || skip) {
@@ -305,7 +309,10 @@ export const useTimelineEvents = ({
   );
 
   useEffect(() => {
-    if (skipQueryForDetectionsPage(id, indexNames) || indexNames.length === 0) {
+    if (
+      skipQueryForDetectionsPage(id, indexNames, ruleRegistryEnabled) ||
+      indexNames.length === 0
+    ) {
       return;
     }
 
@@ -364,7 +371,10 @@ export const useTimelineEvents = ({
           activeTimeline.setActivePage(newActivePage);
         }
       }
-      if (!skipQueryForDetectionsPage(id, indexNames) && !deepEqual(prevRequest, currentRequest)) {
+      if (
+        !skipQueryForDetectionsPage(id, indexNames, ruleRegistryEnabled) &&
+        !deepEqual(prevRequest, currentRequest)
+      ) {
         return currentRequest;
       }
       return prevRequest;
@@ -380,6 +390,7 @@ export const useTimelineEvents = ({
     id,
     language,
     limit,
+    ruleRegistryEnabled,
     startDate,
     sort,
     fields,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/query.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/query.ts
index dd4d4fb54afba..3911dcabc34de 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/query.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/reference_rules/query.ts
@@ -48,36 +48,41 @@ export const createQueryAlertType = (ruleDataClient: RuleDataClient, logger: Log
       services: { alertWithPersistence, findAlerts },
       params: { indexPatterns, customQuery },
     }) {
-      const indexPattern: IIndexPattern = {
-        fields: [],
-        title: indexPatterns.join(),
-      };
+      try {
+        const indexPattern: IIndexPattern = {
+          fields: [],
+          title: indexPatterns.join(),
+        };
 
-      // TODO: kql or lucene?
+        // TODO: kql or lucene?
 
-      const esQuery = buildEsQuery(
-        indexPattern,
-        { query: customQuery, language: 'kuery' },
-        []
-      ) as QueryContainer;
-      const query: ESSearchRequest = {
-        body: {
-          query: esQuery,
-          fields: ['*'],
-          sort: {
-            '@timestamp': 'asc' as const,
+        const esQuery = buildEsQuery(
+          indexPattern,
+          { query: customQuery, language: 'kuery' },
+          []
+        ) as QueryContainer;
+        const query: ESSearchRequest = {
+          body: {
+            query: esQuery,
+            fields: ['*'],
+            sort: {
+              '@timestamp': 'asc' as const,
+            },
           },
-        },
-      };
+        };
 
-      const alerts = await findAlerts(query);
-      alertWithPersistence(alerts).forEach((alert) => {
-        alert.scheduleActions('default', { server: 'server-test' });
-      });
+        const alerts = await findAlerts(query);
+        // console.log('alerts', alerts);
+        alertWithPersistence(alerts).forEach((alert) => {
+          alert.scheduleActions('default', { server: 'server-test' });
+        });
 
-      return {
-        lastChecked: new Date(),
-      };
+        return {
+          lastChecked: new Date(),
+        };
+      } catch (error) {
+        logger.error(error);
+      }
     },
   });
 };
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/read_index_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/read_index_route.ts
index 6af4397a4193a..3527e43c03d52 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/read_index_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/read_index_route.ts
@@ -6,15 +6,17 @@
  */
 
 import { transformError, getIndexExists } from '@kbn/securitysolution-es-utils';
+import { parseExperimentalConfigValue } from '../../../../../common/experimental_features';
+import { ConfigType } from '../../../../config';
 import type { SecuritySolutionPluginRouter } from '../../../../types';
-import { DETECTION_ENGINE_INDEX_URL } from '../../../../../common/constants';
+import { DEFAULT_ALERTS_INDEX, DETECTION_ENGINE_INDEX_URL } from '../../../../../common/constants';
 
 import { buildSiemResponse } from '../utils';
 import { SIGNALS_TEMPLATE_VERSION } from './get_signals_template';
 import { getIndexVersion } from './get_index_version';
 import { isOutdated } from '../../migrations/helpers';
 
-export const readIndexRoute = (router: SecuritySolutionPluginRouter) => {
+export const readIndexRoute = (router: SecuritySolutionPluginRouter, config: ConfigType) => {
   router.get(
     {
       path: DETECTION_ENGINE_INDEX_URL,
@@ -34,8 +36,16 @@ export const readIndexRoute = (router: SecuritySolutionPluginRouter) => {
           return siemResponse.error({ statusCode: 404 });
         }
 
+        // TODO: Once we are past experimental phase this code should be removed
+        const { ruleRegistryEnabled } = parseExperimentalConfigValue(config.enableExperimental);
+        if (ruleRegistryEnabled) {
+          return response.ok({
+            body: { name: DEFAULT_ALERTS_INDEX, index_mapping_outdated: false },
+          });
+        }
+
         const index = siemClient.getSignalsIndex();
-        const indexExists = await getIndexExists(esClient, index);
+        const indexExists = ruleRegistryEnabled ? true : await getIndexExists(esClient, index);
 
         if (indexExists) {
           let mappingOutdated: boolean | null = null;
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/signals/query_signals_route.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/signals/query_signals_route.test.ts
index 909c94f145528..d6b998e314234 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/signals/query_signals_route.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/signals/query_signals_route.test.ts
@@ -14,7 +14,7 @@ import {
   getSignalsAggsAndQueryRequest,
   getEmptySignalsResponse,
 } from '../__mocks__/request_responses';
-import { requestContextMock, serverMock, requestMock } from '../__mocks__';
+import { requestContextMock, serverMock, requestMock, createMockConfig } from '../__mocks__';
 import { querySignalsRoute } from './query_signals_route';
 
 describe('query for signal', () => {
@@ -27,7 +27,7 @@ describe('query for signal', () => {
 
     clients.clusterClient.callAsCurrentUser.mockResolvedValue(getEmptySignalsResponse());
 
-    querySignalsRoute(server.router);
+    querySignalsRoute(server.router, createMockConfig());
   });
 
   describe('query and agg on signals index', () => {
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/signals/query_signals_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/signals/query_signals_route.ts
index 91172a277bf54..770c1a5da344f 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/signals/query_signals_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/signals/query_signals_route.ts
@@ -6,8 +6,13 @@
  */
 
 import { transformError } from '@kbn/securitysolution-es-utils';
+import { parseExperimentalConfigValue } from '../../../../../common/experimental_features';
+import { ConfigType } from '../../../../config';
 import type { SecuritySolutionPluginRouter } from '../../../../types';
-import { DETECTION_ENGINE_QUERY_SIGNALS_URL } from '../../../../../common/constants';
+import {
+  DEFAULT_ALERTS_INDEX,
+  DETECTION_ENGINE_QUERY_SIGNALS_URL,
+} from '../../../../../common/constants';
 import { buildSiemResponse } from '../utils';
 import { buildRouteValidation } from '../../../../utils/build_validation/route_validation';
 
@@ -16,7 +21,7 @@ import {
   QuerySignalsSchemaDecoded,
 } from '../../../../../common/detection_engine/schemas/request/query_signals_index_schema';
 
-export const querySignalsRoute = (router: SecuritySolutionPluginRouter) => {
+export const querySignalsRoute = (router: SecuritySolutionPluginRouter, config: ConfigType) => {
   router.post(
     {
       path: DETECTION_ENGINE_QUERY_SIGNALS_URL,
@@ -48,9 +53,12 @@ export const querySignalsRoute = (router: SecuritySolutionPluginRouter) => {
       const clusterClient = context.core.elasticsearch.legacy.client;
       const siemClient = context.securitySolution!.getAppClient();
 
+      // TODO: Once we are past experimental phase this code should be removed
+      const { ruleRegistryEnabled } = parseExperimentalConfigValue(config.enableExperimental);
+
       try {
         const result = await clusterClient.callAsCurrentUser('search', {
-          index: siemClient.getSignalsIndex(),
+          index: ruleRegistryEnabled ? DEFAULT_ALERTS_INDEX : siemClient.getSignalsIndex(),
           body: { query, aggs, _source, track_total_hits, size },
           ignoreUnavailable: true,
         });
diff --git a/x-pack/plugins/security_solution/server/plugin.ts b/x-pack/plugins/security_solution/server/plugin.ts
index 14119a8796368..2507475592e88 100644
--- a/x-pack/plugins/security_solution/server/plugin.ts
+++ b/x-pack/plugins/security_solution/server/plugin.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { once } from 'lodash';
 import { Observable } from 'rxjs';
 import { i18n } from '@kbn/i18n';
 import LRU from 'lru-cache';
@@ -27,9 +28,18 @@ import {
   PluginSetupContract as AlertingSetup,
   PluginStartContract as AlertPluginStartContract,
 } from '../../alerting/server';
+
 import { PluginStartContract as CasesPluginStartContract } from '../../cases/server';
+import {
+  ECS_COMPONENT_TEMPLATE_NAME,
+  TECHNICAL_COMPONENT_TEMPLATE_NAME,
+} from '../../rule_registry/common/assets';
 import { SecurityPluginSetup as SecuritySetup, SecurityPluginStart } from '../../security/server';
-import { RuleDataClient, RuleRegistryPluginSetupContract } from '../../rule_registry/server';
+import {
+  RuleDataClient,
+  RuleRegistryPluginSetupContract,
+  RuleRegistryPluginStartContract,
+} from '../../rule_registry/server';
 import { PluginSetupContract as FeaturesSetup } from '../../features/server';
 import { MlPluginSetup as MlSetup } from '../../ml/server';
 import { ListPluginSetup } from '../../lists/server';
@@ -106,7 +116,7 @@ export interface StartPlugins {
   data: DataPluginStart;
   fleet?: FleetStartContract;
   licensing: LicensingPluginStart;
-  ruleRegistry: RuleRegistryPluginSetupContract;
+  ruleRegistry: RuleRegistryPluginStartContract;
   taskManager?: TaskManagerStartContract;
   telemetry?: TelemetryPluginStart;
   security: SecurityPluginStart;
@@ -208,16 +218,54 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
     // TODO: Once we are past experimental phase this check can be removed along with legacy registration of rules
     let ruleDataClient: RuleDataClient | null = null;
     if (experimentalFeatures.ruleRegistryEnabled) {
-      // Create rule-registry data client scoped to security-solution
+      const { ruleDataService } = plugins.ruleRegistry;
       const start = () => core.getStartServices().then(([coreStart]) => coreStart);
 
+      const ready = once(async () => {
+        const componentTemplateName = ruleDataService.getFullAssetName(
+          'security-solution-mappings'
+        );
+
+        if (!ruleDataService.isWriteEnabled()) {
+          return;
+        }
+
+        await ruleDataService.createOrUpdateComponentTemplate({
+          name: componentTemplateName,
+          body: {
+            template: {
+              settings: {
+                number_of_shards: 1,
+              },
+              mappings: {}, // TODO: Add mappings here via `mappingFromFieldMap()`
+            },
+          },
+        });
+
+        await ruleDataService.createOrUpdateIndexTemplate({
+          name: ruleDataService.getFullAssetName('security-solution-index-template'),
+          body: {
+            index_patterns: [ruleDataService.getFullAssetName('security-solution*')],
+            composed_of: [
+              ruleDataService.getFullAssetName(TECHNICAL_COMPONENT_TEMPLATE_NAME),
+              ruleDataService.getFullAssetName(ECS_COMPONENT_TEMPLATE_NAME),
+              componentTemplateName,
+            ],
+          },
+        });
+      });
+
+      ready().catch((err) => {
+        this.logger!.error(err);
+      });
+
       ruleDataClient = new RuleDataClient({
+        alias: plugins.ruleRegistry.ruleDataService.getFullAssetName('security-solution'),
         getClusterClient: async () => {
           const coreStart = await start();
           return coreStart.elasticsearch.client.asInternalUser;
         },
-        ready: () => Promise.resolve(),
-        alias: plugins.ruleRegistry.getFullAssetName(),
+        ready,
       });
 
       // Register reference rule types via rule-registry
diff --git a/x-pack/plugins/security_solution/server/routes/index.ts b/x-pack/plugins/security_solution/server/routes/index.ts
index 0ea7809bd1a15..0245d4cb99cc0 100644
--- a/x-pack/plugins/security_solution/server/routes/index.ts
+++ b/x-pack/plugins/security_solution/server/routes/index.ts
@@ -107,7 +107,7 @@ export const initRoutes = (
   // POST /api/detection_engine/signals/status
   // Example usage can be found in security_solution/server/lib/detection_engine/scripts/signals
   setSignalsStatusRoute(router);
-  querySignalsRoute(router);
+  querySignalsRoute(router, config);
   getSignalsMigrationStatusRoute(router);
   createSignalsMigrationRoute(router, security);
   finalizeSignalsMigrationRoute(router, security);
@@ -116,7 +116,7 @@ export const initRoutes = (
   // Detection Engine index routes that have the REST endpoints of /api/detection_engine/index
   // All REST index creation, policy management for spaces
   createIndexRoute(router);
-  readIndexRoute(router);
+  readIndexRoute(router, config);
   deleteIndexRoute(router);
 
   // Detection Engine tags routes that have the REST endpoints of /api/detection_engine/tags

From 5c83a4184bf6743ea6b5794f178279dd1a3c36c4 Mon Sep 17 00:00:00 2001
From: Garrett Spong <garrett.spong@elastic.co>
Date: Thu, 27 May 2021 19:47:14 -0600
Subject: [PATCH 54/54] Fixing the jester

---
 .../public/timelines/containers/index.test.tsx               | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/x-pack/plugins/security_solution/public/timelines/containers/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/containers/index.test.tsx
index 1032d0ec1672a..62846eb01e60f 100644
--- a/x-pack/plugins/security_solution/public/timelines/containers/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/containers/index.test.tsx
@@ -9,6 +9,7 @@ import { renderHook, act } from '@testing-library/react-hooks';
 import { initSortDefault, TimelineArgs, useTimelineEvents, UseTimelineEventsProps } from '.';
 import { SecurityPageName } from '../../../common/constants';
 import { TimelineId } from '../../../common/types/timeline';
+import { useIsExperimentalFeatureEnabled } from '../../common/hooks/use_experimental_features';
 import { mockTimelineData } from '../../common/mock';
 import { useRouteSpy } from '../../common/utils/route/use_route_spy';
 
@@ -26,6 +27,9 @@ const mockEvents = mockTimelineData.filter((i, index) => index <= 11);
 
 const mockSearch = jest.fn();
 
+jest.mock('../../common/hooks/use_experimental_features');
+const useIsExperimentalFeatureEnabledMock = useIsExperimentalFeatureEnabled as jest.Mock;
+
 jest.mock('../../common/lib/kibana', () => ({
   useToasts: jest.fn().mockReturnValue({
     addError: jest.fn(),
@@ -93,6 +97,7 @@ mockUseRouteSpy.mockReturnValue([
 ]);
 
 describe('useTimelineEvents', () => {
+  useIsExperimentalFeatureEnabledMock.mockReturnValue(false);
   beforeEach(() => {
     mockSearch.mockReset();
   });